Port forward with Tailscale

[nicolap8]

Hi,
I've two routers (Asus RT-AC85P), both with Tailscale installed and connected to a client (PLC) by cable.
The PLC responds only to local IPs...

I configured a port forward from lan:8080 to plc:80.

The router with OpenWrt 21.02 works correctly, connecting from a remote Tailscal it presents to PLC as local client.

That with OpenWrt 22.03, that uses NFTables, doesn't work because the IP shown to PLC is that of remote Tailscale.
It's my fault or an expected behaviour?
Thanks
Nic

[pavelgl]

@nicolap8

That with OpenWrt 22.03, that uses NFTables, doesn't work because the IP shown to PLC is that of remote Tailscale.

Create a SNAT rule to hide the tailscale address behind the router's LAN IP address.

uci add firewall nat
uci set firewall.@nat[-1].name='SNAT-rule'
uci set firewall.@nat[-1].src='lan'
uci set firewall.@nat[-1].target='SNAT'
uci set firewall.@nat[-1].dest_ip='192.168.0.241'
uci set firewall.@nat[-1].snat_ip='192.168.0.1' # Router LAN IP addr
uci set firewall.@nat[-1].src_ip='100.64.0.0/10'
uci set firewall.@nat[-1].proto='tcp'
uci set firewall.@nat[-1].dest_port='80'

[nicolap8]

Thanks!
My solution was to use a masquerade.
It is unfortunate that changing versions requires such action.
N