From 8bc945244dae4159ab7c5a9055f734767b6609c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 11 Apr 2024 23:58:09 +0200
Subject: [PATCH] upstream: fix masquerading

---
 nix/nixos-module/container/upstream.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/nix/nixos-module/container/upstream.nix b/nix/nixos-module/container/upstream.nix
index 7f47bc2..921e106 100644
--- a/nix/nixos-module/container/upstream.nix
+++ b/nix/nixos-module/container/upstream.nix
@@ -103,7 +103,17 @@ in
             -d ${staticIpv4Address} -p ${fwd.proto} \
             --dport ${builtins.toString fwd.sourcePort} \
             -j DNAT --to-destination ${fwd.destination}
-        '') config.networking.nat.forwardPorts}
+
+          iptables -t nat -A nixos-nat-post \
+            -d ${fwd.destination} -p ${fwd.proto} \
+            --dport ${builtins.toString fwd.destination} \
+            -s ${config.site.net.core.subnets4} -j MASQUERADE
+
+          iptables -t nat -A nixos-nat-post \
+            -d ${fwd.destination} -p ${fwd.proto} \
+            --dport ${builtins.toString fwd.destination} \
+            -s ${config.site.net.c3d2.subnets4} -j MASQUERADE
+        '')  config.networking.nat.forwardPorts}
       ''}
 
       # Do not NAT our public IPv4 addresses