From 25f7f30e013f45595fd347eaab41b436eb94a748 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Wed, 26 Aug 2026 13:09:57 -0700 Subject: [PATCH] docs(networking): document tailscale-to-sandbox source NAT on gw01 Companion to GilmanLab/networking#19, which masquerades 100.64.0.0/10 out br40 so tailnet-member sandbox hosts reply symmetrically. --- docs/docs/reference/networking/address-plan.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/docs/reference/networking/address-plan.md b/docs/docs/reference/networking/address-plan.md index 0165d99..4f9edab 100644 --- a/docs/docs/reference/networking/address-plan.md +++ b/docs/docs/reference/networking/address-plan.md @@ -25,9 +25,13 @@ remains the source for network values. | Home | `192.168.2.0/24` | `rtr01` | Additional home network advertised through Tailscale | `gw01` uses `10.0.0.1` as its default route. `rtr01` routes `10.10.0.0/16` -through `10.0.0.2`. `gw01` applies source NAT only when lab traffic exits -toward the internet. Home-to-lab and inter-VLAN traffic retain their source -addresses. +through `10.0.0.2`. `gw01` applies source NAT in exactly two cases: lab +traffic exiting toward the internet, and Tailscale clients +(`100.64.0.0/10`) entering the sandbox/workload VLAN. The sandbox +masquerade keeps replies from tailnet-member hosts such as `sandbox01` +symmetric through `gw01` instead of leaking into the host's own tailscale +peer routes. All other home-to-lab, Tailscale-to-lab, and inter-VLAN +traffic retains its source addresses. ## VLANs