Configuring Asus router as gateway for all remote Zerotier nodes

bj.blazkowicz · November 5, 2023, 9:52am

I have installed Zerotier on my Asus AX3000 router through Entware. I am able to ping and access web portal on my router through other remote ZT clients. I now want to set up my my network in such a way so that all traffic from remote ZT nodes is router through my ZT on my Asus router.

Can someone please help ? I am a complete networking noob.

l0crian · November 5, 2023, 3:14pm

I don’t know anything about the Asus routers, but here’s some basic instructions:

First thing will be to add a default route in your managed routes. Add:
0.0.0.0/0 via <the ZT IP of your AX3000>
On the remote client, allow the use of a default route if needed. This will be a little different for every system you try to use. I recommend using a phone to do your initial testing, because enabling the default route is generally more straightforward on phones.

After that, the necessary routing will be in place. The unknown for me will be if the traffic is allowed through a firewall and property NATed. Try those first 2 steps and report back and we’ll go from there.

bj.blazkowicz · November 6, 2023, 4:59pm

hi, thanks for replying.
I did try adding the 0.0.0.0/0 via route, however, it does not work.
at this point, I am wondering if the router NAT table needs to be configured, which I know nothing of

l0crian · November 6, 2023, 6:38pm

If you can SSH into the router, you can try typing “iptables -L” and past what you have in here.

bj.blazkowicz · November 10, 2023, 2:27pm

hi l0crian,

below is the my iptables output.

iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere
2    INPUT_PING  icmp --  anywhere             anywhere             icmp echo-request
3    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
4    DROP       all  --  anywhere             anywhere             state INVALID
5    PTCSRVWAN  all  --  anywhere             anywhere
6    PTCSRVLAN  all  --  anywhere             anywhere
7    DROP       tcp  --  anywhere             anywhere             tcp dpt:5152
8    ACCEPT     all  --  anywhere             anywhere             state NEW
9    ACCEPT     all  --  anywhere             anywhere             state NEW
10   ACCEPT     udp  --  anywhere             anywhere             udp spt:bootps dpt:bootpc
11   ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
12   INPUT_ICMP  icmp --  anywhere             anywhere
13   WGSI       all  --  anywhere             anywhere
14   WGCI       all  --  anywhere             anywhere
15   OVPNSI     all  --  anywhere             anywhere
16   OVPNCI     all  --  anywhere             anywhere
17   DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    IPSEC_DROP_SUBNET_ICMP  all  --  anywhere             anywhere
2    IPSEC_STRONGSWAN  all  --  anywhere             anywhere
3    TCPMSS     tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN TCPMSS clamp to PMTU
4    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
5    WGSF       all  --  anywhere             anywhere
6    OVPNSF     all  --  anywhere             anywhere
7    DROP       all  --  anywhere             anywhere
8    DROP       all  --  anywhere             anywhere
9    ACCEPT     all  --  anywhere             anywhere
10   DROP       all  --  anywhere             anywhere             state INVALID
11   ACCEPT     all  --  anywhere             anywhere             ctstate DNAT
12   WGCF       all  --  anywhere             anywhere
13   OVPNCF     all  --  anywhere             anywhere
14   VPNCF      all  --  anywhere             anywhere
15   ACCEPT     all  --  anywhere             anywhere
16   DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
1    OUTPUT_DNS  udp  --  anywhere             anywhere             udp dpt:domain u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
2    OUTPUT_DNS  tcp  --  anywhere             anywhere             tcp dpt:domain u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
3    OUTPUT_IP  all  --  anywhere             anywhere

Chain ACCESS_RESTRICTION (0 references)
num  target     prot opt source               destination

Chain DNSFILTER_DOT (0 references)
num  target     prot opt source               destination

Chain FUPNP (0 references)
num  target     prot opt source               destination
1    ACCEPT     udp  --  anywhere             192.168.1.2          udp dpt:47999
2    ACCEPT     udp  --  anywhere             192.168.1.2          udp dpt:48010
3    ACCEPT     udp  --  anywhere             192.168.1.2          udp dpt:47998
4    ACCEPT     udp  --  anywhere             192.168.1.2          udp dpt:48000
5    ACCEPT     udp  --  anywhere             192.168.1.2          udp dpt:48002
6    ACCEPT     udp  --  anywhere             192.168.1.2          udp dpt:41641
7    ACCEPT     udp  --  anywhere             192.168.1.2          udp dpt:61751

Chain IControls (0 references)
num  target     prot opt source               destination

Chain INPUT_ICMP (1 references)
num  target     prot opt source               destination
1    RETURN     icmp --  anywhere             anywhere             icmp echo-request
2    RETURN     icmp --  anywhere             anywhere             icmp timestamp-request
3    ACCEPT     icmp --  anywhere             anywhere

Chain INPUT_PING (1 references)
num  target     prot opt source               destination
1    DROP       icmp --  anywhere             anywhere
2    DROP       icmp --  anywhere             anywhere

Chain IPSEC_DROP_SUBNET_ICMP (1 references)
num  target     prot opt source               destination

Chain IPSEC_STRONGSWAN (1 references)
num  target     prot opt source               destination

Chain OUTPUT_DNS (2 references)
num  target     prot opt source               destination
1    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|10706f697579747975696f706b6a666e6603636f6d00|" ALGO name bm TO 65535 ICASE
2    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0d72666a656a6e666a6e65666a6503636f6d00|" ALGO name bm TO 65535 ICASE
3    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|1131306166646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
4    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0f376d667364666173646d6b676d726b03636f6d00|" ALGO name bm TO 65535 ICASE
5    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0d386d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
6    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0f3966646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
7    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|1265666274686d6f6975796b6d6b6a6b6a677403636f6d00|" ALGO name bm TO 65535 ICASE
8    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|086861636b7563647403636f6d00|" ALGO name bm TO 65535 ICASE
9    logdrop_dns  all  --  anywhere             anywhere             STRING match  "|076c696e77756469056633333232036e657400|" ALGO name bm TO 65535 ICASE
10   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0f6c6b6a68676664736174727975696f03636f6d00|" ALGO name bm TO 65535 ICASE
11   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0b6d6e627663787a7a7a313203636f6d00|" ALGO name bm TO 65535 ICASE
12   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|077131313133333303746f7000|" ALGO name bm TO 65535 ICASE
13   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|057371353230056633333232036e657400|" ALGO name bm TO 65535 ICASE
14   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|077563746b6f6e6503636f6d00|" ALGO name bm TO 65535 ICASE
15   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0e7a786376626d6e6e666a6a66777103636f6d00|" ALGO name bm TO 65535 ICASE
16   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0a65756d6d6167766e627003636f6d00|" ALGO name bm TO 65535 ICASE
17   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0b726f75746572736173757303636f6d00|" ALGO name bm TO 65535 ICASE
18   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|037777770b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
19   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0377777709617375736c6f67696e03636f6d00|" ALGO name bm TO 65535 ICASE
20   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|0d72657065617461722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
21   logdrop_dns  all  --  anywhere             anywhere             STRING match  "|037777310b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE

Chain OUTPUT_IP (1 references)
num  target     prot opt source               destination
1    logdrop_ip  all  --  anywhere             193.201.224.0/24
2    logdrop_ip  all  --  anywhere             vriezekolk.org
3    logdrop_ip  all  --  anywhere             li1019-134.members.linode.com
4    logdrop_ip  all  --  anywhere             190.115.18.28
5    logdrop_ip  all  --  anywhere             51-159-52-250.rev.poneytelecom.eu
6    logdrop_ip  all  --  anywhere             190.115.18.86

Chain OVPNCF (1 references)
num  target     prot opt source               destination

Chain OVPNCI (1 references)
num  target     prot opt source               destination

Chain OVPNSF (1 references)
num  target     prot opt source               destination

Chain OVPNSI (1 references)
num  target     prot opt source               destination

Chain PControls (0 references)
num  target     prot opt source               destination

Chain PTCSRVLAN (1 references)
num  target     prot opt source               destination

Chain PTCSRVWAN (1 references)
num  target     prot opt source               destination

Chain SECURITY (0 references)
num  target     prot opt source               destination
1    RETURN     tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5
2    DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN
3    RETURN     tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5
4    DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/RST
5    RETURN     icmp --  anywhere             anywhere             icmp echo-request limit: avg 1/sec burst 5
6    DROP       icmp --  anywhere             anywhere             icmp echo-request
7    RETURN     all  --  anywhere             anywhere

Chain VPNCF (1 references)
num  target     prot opt source               destination

Chain VPNCI (0 references)
num  target     prot opt source               destination

Chain WGCF (1 references)
num  target     prot opt source               destination

Chain WGCI (1 references)
num  target     prot opt source               destination

Chain WGNPControls (0 references)
num  target     prot opt source               destination

Chain WGSF (1 references)
num  target     prot opt source               destination

Chain WGSI (1 references)
num  target     prot opt source               destination

Chain default_block (0 references)
num  target     prot opt source               destination

Chain logaccept (0 references)
num  target     prot opt source               destination
1    LOG        all  --  anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "ACCEPT "
2    ACCEPT     all  --  anywhere             anywhere

Chain logdrop (0 references)
num  target     prot opt source               destination
1    LOG        all  --  anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "DROP "
2    DROP       all  --  anywhere             anywhere

Chain logdrop_dns (21 references)
num  target     prot opt source               destination
1    LOG        all  --  anywhere             anywhere             LOG level warning tcp-sequence tcp-options ip-options prefix "DROP_DNS "
2    DROP       all  --  anywhere             anywhere

Chain logdrop_ip (6 references)
num  target     prot opt source               destination
1    LOG        all  --  anywhere             anywhere             LOG level warning tcp-sequence tcp-options ip-options prefix "DROP_IP "
2    DROP       all  --  anywhere             anywhere

I have refered to this SNB forums post upto the accept rule for setting up ZT one on my router.
https://www.snbforums.com/threads/a-guide-about-installing-zerotier-on-asus-ac68u-router.42648/

l0crian · November 10, 2023, 11:59pm

Can you rerun it with the -v flag? Also, can you also run one for the NAT table?:

iptables -L -v -n --line-numbers
iptables -L -v -n -t nat --line-numbers

bj.blazkowicz · November 11, 2023, 11:29am

here you go

iptables -L -v -n --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        1    98 ACCEPT     all  --  zt+    *       0.0.0.0/0            0.0.0.0/0
2     2556  510K ts-input   all  --  *      *       0.0.0.0/0            0.0.0.0/0
3        0     0 ACCEPT     2    --  eth0   *       0.0.0.0/0            0.0.0.0/0
4        1    60 INPUT_PING  icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
5     2234  467K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
6       46  4529 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
7     1113  213K PTCSRVWAN  all  --  !br0   *       0.0.0.0/0            0.0.0.0/0
8      906  162K PTCSRVLAN  all  --  br0    *       0.0.0.0/0            0.0.0.0/0
9        0     0 DROP       tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5152
10     906  162K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0            state NEW
11     999  197K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            state NEW
12       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
13       0     0 INPUT_ICMP  icmp --  *      *       0.0.0.0/0            0.0.0.0/0
14     114 16523 WGSI       all  --  *      *       0.0.0.0/0            0.0.0.0/0
15     114 16523 WGCI       all  --  *      *       0.0.0.0/0            0.0.0.0/0
16     114 16523 OVPNSI     all  --  *      *       0.0.0.0/0            0.0.0.0/0
17     114 16523 OVPNCI     all  --  *      *       0.0.0.0/0            0.0.0.0/0
18     114 16523 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     1042  259K ts-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2        0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            224.0.0.0/4
3     2108  636K IPSEC_DROP_SUBNET_ICMP  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4     2108  636K IPSEC_STRONGSWAN  all  --  *      *       0.0.0.0/0            0.0.0.0/0
5      222 12124 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU
6     1816  597K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
7      292 38979 WGSF       all  --  *      *       0.0.0.0/0            0.0.0.0/0
8      292 38979 OVPNSF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
9        5   260 DROP       all  --  !br0   ppp0    0.0.0.0/0            0.0.0.0/0
10       0     0 DROP       all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0
11       0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0
12       9   396 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
13       0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT
14     278 38323 WGCF       all  --  *      *       0.0.0.0/0            0.0.0.0/0
15     278 38323 OVPNCF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
16     278 38323 VPNCF      all  --  *      *       0.0.0.0/0            0.0.0.0/0
17     278 38323 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0
18       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 445 packets, 106K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      197 13739 OUTPUT_DNS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
2        0     0 OUTPUT_DNS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
3     5386 1200K OUTPUT_IP  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ACCESS_RESTRICTION (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain DNSFILTER_DOT (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain FUPNP (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:61751
2        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:41641

Chain IControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain INPUT_ICMP (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
2        0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 13
3        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0

Chain INPUT_PING (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       icmp --  ppp0   *       0.0.0.0/0            0.0.0.0/0
2        0     0 DROP       icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0

Chain IPSEC_DROP_SUBNET_ICMP (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain IPSEC_STRONGSWAN (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT_DNS (2 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|10706f697579747975696f706b6a666e6603636f6d00|" ALGO name bm TO 65535 ICASE
2        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d72666a656a6e666a6e65666a6503636f6d00|" ALGO name bm TO 65535 ICASE
3        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1131306166646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
4        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f376d667364666173646d6b676d726b03636f6d00|" ALGO name bm TO 65535 ICASE
5        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d386d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
6        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f3966646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
7        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1265666274686d6f6975796b6d6b6a6b6a677403636f6d00|" ALGO name bm TO 65535 ICASE
8        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|086861636b7563647403636f6d00|" ALGO name bm TO 65535 ICASE
9        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|076c696e77756469056633333232036e657400|" ALGO name bm TO 65535 ICASE
10       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f6c6b6a68676664736174727975696f03636f6d00|" ALGO name bm TO 65535 ICASE
11       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0b6d6e627663787a7a7a313203636f6d00|" ALGO name bm TO 65535 ICASE
12       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077131313133333303746f7000|" ALGO name bm TO 65535 ICASE
13       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|057371353230056633333232036e657400|" ALGO name bm TO 65535 ICASE
14       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077563746b6f6e6503636f6d00|" ALGO name bm TO 65535 ICASE
15       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0e7a786376626d6e6e666a6a66777103636f6d00|" ALGO name bm TO 65535 ICASE
16       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0a65756d6d6167766e627003636f6d00|" ALGO name bm TO 65535 ICASE
17       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0b726f75746572736173757303636f6d00|" ALGO name bm TO 65535 ICASE
18       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|037777770b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
19       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0377777709617375736c6f67696e03636f6d00|" ALGO name bm TO 65535 ICASE
20       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d72657065617461722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
21       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|037777310b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE

Chain OUTPUT_IP (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            193.201.224.0/24
2        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            51.15.120.245
3        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            45.33.73.134
4        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            190.115.18.28
5        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            51.159.52.250
6        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            190.115.18.86

Chain OVPNCF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OVPNCI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OVPNSF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OVPNSI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PTCSRVLAN (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PTCSRVWAN (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain SECURITY (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x02 limit: avg 1/sec burst 5
2        0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x02
3        0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x04 limit: avg 1/sec burst 5
4        0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x04
5        0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 limit: avg 1/sec burst 5
6        0     0 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
7        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain VPNCF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain VPNCI (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGCF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGCI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGNPControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGSF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGSI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain default_block (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain logaccept (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW LOG flags 7 level 4 prefix "ACCEPT "
2        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW LOG flags 7 level 4 prefix "DROP "
2        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop_dns (21 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_DNS "
2        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop_ip (6 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_IP "
2        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ts-forward (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 MARK       all  --  tailscale0 *       0.0.0.0/0            0.0.0.0/0            MARK xset 0x40000/0xff0000
2        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x40000/0xff0000
3        0     0 DROP       all  --  *      tailscale0  100.64.0.0/10        0.0.0.0/0
4        0     0 ACCEPT     all  --  *      tailscale0  0.0.0.0/0            0.0.0.0/0

Chain ts-input (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     all  --  lo     *       100.84.124.23        0.0.0.0/0
2        0     0 RETURN     all  --  !tailscale0 *       100.115.92.0/23      0.0.0.0/0
3        0     0 DROP       all  --  !tailscale0 *       100.64.0.0/10        0.0.0.0/0

iptables -L -v -n -t nat --line-numbers
Chain PREROUTING (policy ACCEPT 158 packets, 16889 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            224.0.0.0/4
2       38  6510 GAME_VSERVER  all  --  *      *       0.0.0.0/0            172.19.54.63
3       38  6510 VSERVER    all  --  *      *       0.0.0.0/0            172.19.54.63
4        0     0 GAME_VSERVER  all  --  *      *       0.0.0.0/0            169.254.146.72
5        0     0 VSERVER    all  --  *      *       0.0.0.0/0            169.254.146.72

Chain INPUT (policy ACCEPT 29 packets, 3076 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 131 packets, 11570 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 128 packets, 11226 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      586 55046 ts-postrouting  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2      492 40515 PUPNP      all  --  *      ppp0    0.0.0.0/0            0.0.0.0/0
3      216 17520 MASQUERADE  all  --  *      ppp0   !172.19.54.63         0.0.0.0/0            mode: fullcone
4        0     0 MASQUERADE  all  --  *      eth0   !169.254.146.72       0.0.0.0/0            mode: fullcone
5      274 20493 MASQUERADE  all  --  *      br0     192.168.1.0/24       192.168.1.0/24

Chain DNSFILTER (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain GAME_VSERVER (2 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:43680:43690 to:192.168.1.3
2        0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:43680:43690 to:192.168.1.3

Chain LOCALSRV (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain MAPE (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PCREDIRECT (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PUPNP (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        8   884 MASQUERADE  udp  --  *      *       192.168.1.3          0.0.0.0/0            udp spt:61751 masq ports: 61751
2        0     0 MASQUERADE  udp  --  *      *       192.168.1.3          0.0.0.0/0            udp spt:41641 masq ports: 41641

Chain VSERVER (2 references)
num   pkts bytes target     prot opt in     out     source               destination
1       38  6510 VUPNP      all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain VUPNP (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:61751 to:192.168.1.3:61751
2        0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:41641 to:192.168.1.3:41641

Chain ts-postrouting (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x40000/0xff0000

l0crian · November 11, 2023, 6:27pm

Thank you for those, looks like you don’t have anything in your forwarding chain to allow the traffic through your router. It looks like your ZT interface name is zt+ and your WAN interface is ppp0. Assuming that’s correct, you can try adding the below (update interface names if what I assumed was incorrect):

sudo iptables -A FORWARD -i zt+ -o ppp0 -j ACCEPT

Line 6 in your forwarding chain should allow the return traffic after you create state with the initial traffic:

Give that a try, and report back. If it didn’t fix it, please provide a new output of “iptables -L -v -n --line-numbers”.

bj.blazkowicz · November 12, 2023, 4:06am

hi l0crian,
yes, ppp0 is the WAN interface, and br0 is the bridge interface as my connection is a PPPoE one.

I added the rule iptables -A FORWARD -i zt+ -o ppp0 -j ACCEPT.
below is the new iptables output

iptables -L -v -n --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     all  --  zt+    *       0.0.0.0/0            0.0.0.0/0
2     196K   40M ts-input   all  --  *      *       0.0.0.0/0            0.0.0.0/0
3        0     0 ACCEPT     2    --  eth0   *       0.0.0.0/0            0.0.0.0/0
4        1    60 INPUT_PING  icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
5     118K   24M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
6       77  3991 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
7    51455 9690K PTCSRVWAN  all  --  !br0   *       0.0.0.0/0            0.0.0.0/0
8    28930 6656K PTCSRVLAN  all  --  br0    *       0.0.0.0/0            0.0.0.0/0
9        0     0 DROP       tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5152
10   28930 6656K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0            state NEW
11   51443 9688K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            state NEW
12       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
13       0     0 INPUT_ICMP  icmp --  *      *       0.0.0.0/0            0.0.0.0/0
14      12  2105 WGSI       all  --  *      *       0.0.0.0/0            0.0.0.0/0
15      12  2105 WGCI       all  --  *      *       0.0.0.0/0            0.0.0.0/0
16      12  2105 OVPNSI     all  --  *      *       0.0.0.0/0            0.0.0.0/0
17      12  2105 OVPNCI     all  --  *      *       0.0.0.0/0            0.0.0.0/0
18      12  2105 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     255K   90M ts-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2        0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            224.0.0.0/4
3     257K   91M IPSEC_DROP_SUBNET_ICMP  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4     257K   91M IPSEC_STRONGSWAN  all  --  *      *       0.0.0.0/0            0.0.0.0/0
5    23895 1384K TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU
6     240K   88M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
7    17250 2946K WGSF       all  --  *      *       0.0.0.0/0            0.0.0.0/0
8    17250 2946K OVPNSF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
9        0     0 DROP       all  --  !br0   ppp0    0.0.0.0/0            0.0.0.0/0
10       0     0 DROP       all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0
11       0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0
12     807 42954 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
13       0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT
14   16443 2903K WGCF       all  --  *      *       0.0.0.0/0            0.0.0.0/0
15   16443 2903K OVPNCF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
16   16443 2903K VPNCF      all  --  *      *       0.0.0.0/0            0.0.0.0/0
17   16443 2903K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0
18       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0
19       0     0 ACCEPT     all  --  zt+    ppp0    0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 358 packets, 62712 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     7737  543K OUTPUT_DNS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
2        0     0 OUTPUT_DNS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
3     348K   91M OUTPUT_IP  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ACCESS_RESTRICTION (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain DNSFILTER_DOT (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain FUPNP (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.219        udp dpt:41641
2        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:47999
3        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:48010
4        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:47998
5        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:48000
6        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:48002
7        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:61751
8        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.117        udp dpt:44168
9        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:47999
10       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:48010
11       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:47998
12       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:48000
13       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:48002
14       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.3          udp dpt:61751

Chain IControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain INPUT_ICMP (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
2        0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 13
3        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0

Chain INPUT_PING (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       icmp --  ppp0   *       0.0.0.0/0            0.0.0.0/0
2        0     0 DROP       icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0

Chain IPSEC_DROP_SUBNET_ICMP (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain IPSEC_STRONGSWAN (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT_DNS (2 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|10706f697579747975696f706b6a666e6603636f6d00|" ALGO name bm TO 65535 ICASE
2        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d72666a656a6e666a6e65666a6503636f6d00|" ALGO name bm TO 65535 ICASE
3        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1131306166646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
4        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f376d667364666173646d6b676d726b03636f6d00|" ALGO name bm TO 65535 ICASE
5        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d386d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
6        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f3966646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
7        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1265666274686d6f6975796b6d6b6a6b6a677403636f6d00|" ALGO name bm TO 65535 ICASE
8        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|086861636b7563647403636f6d00|" ALGO name bm TO 65535 ICASE
9        0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|076c696e77756469056633333232036e657400|" ALGO name bm TO 65535 ICASE
10       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f6c6b6a68676664736174727975696f03636f6d00|" ALGO name bm TO 65535 ICASE
11       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0b6d6e627663787a7a7a313203636f6d00|" ALGO name bm TO 65535 ICASE
12       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077131313133333303746f7000|" ALGO name bm TO 65535 ICASE
13       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|057371353230056633333232036e657400|" ALGO name bm TO 65535 ICASE
14       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077563746b6f6e6503636f6d00|" ALGO name bm TO 65535 ICASE
15       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0e7a786376626d6e6e666a6a66777103636f6d00|" ALGO name bm TO 65535 ICASE
16       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0a65756d6d6167766e627003636f6d00|" ALGO name bm TO 65535 ICASE
17       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0b726f75746572736173757303636f6d00|" ALGO name bm TO 65535 ICASE
18       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|037777770b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
19       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0377777709617375736c6f67696e03636f6d00|" ALGO name bm TO 65535 ICASE
20       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d72657065617461722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
21       0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|037777310b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE

Chain OUTPUT_IP (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            193.201.224.0/24
2        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            51.15.120.245
3        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            45.33.73.134
4        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            190.115.18.28
5        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            51.159.52.250
6        0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            190.115.18.86

Chain OVPNCF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OVPNCI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OVPNSF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain OVPNSI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PTCSRVLAN (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PTCSRVWAN (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain SECURITY (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x02 limit: avg 1/sec burst 5
2        0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x02
3        0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x04 limit: avg 1/sec burst 5
4        0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x04
5        0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 limit: avg 1/sec burst 5
6        0     0 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
7        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain VPNCF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain VPNCI (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGCF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGCI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGNPControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGSF (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain WGSI (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain default_block (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain logaccept (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW LOG flags 7 level 4 prefix "ACCEPT "
2        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW LOG flags 7 level 4 prefix "DROP "
2        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop_dns (21 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_DNS "
2        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop_ip (6 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_IP "
2        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ts-forward (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1      180  183K MARK       all  --  tailscale0 *       0.0.0.0/0            0.0.0.0/0            MARK xset 0x40000/0xff0000
2      180  183K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x40000/0xff0000
3        0     0 DROP       all  --  *      tailscale0  100.64.0.0/10        0.0.0.0/0
4      192 86533 ACCEPT     all  --  *      tailscale0  0.0.0.0/0            0.0.0.0/0

Chain ts-input (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     all  --  lo     *       100.84.124.23        0.0.0.0/0
2        0     0 RETURN     all  --  !tailscale0 *       100.115.92.0/23      0.0.0.0/0
3        0     0 DROP       all  --  !tailscale0 *       100.64.0.0/10        0.0.0.0/0

thanks for all your support on this

l0crian · November 12, 2023, 4:31am

I needed to have you insert and not add, my apologies. We need to delete the rule you just created and then add it back earlier:

iptables -D FORWARD 19
iptables -I FORWARD 9 -i zt+ -o ppp0 -j ACCEPT

bj.blazkowicz · November 12, 2023, 4:57am

no worries at all.
I’ve made the edits now. here’s the new extract of the forward table

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1    33621   11M ts-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2        0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            224.0.0.0/4
3     306K  107M IPSEC_DROP_SUBNET_ICMP  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4     306K  107M IPSEC_STRONGSWAN  all  --  *      *       0.0.0.0/0            0.0.0.0/0
5    29935 1734K TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU
6     282K  103M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
7    23187 4062K WGSF       all  --  *      *       0.0.0.0/0            0.0.0.0/0
8    23187 4062K OVPNSF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
9        2   104 ACCEPT     all  --  zt+    ppp0    0.0.0.0/0            0.0.0.0/0
10    2064  286K DROP       all  --  !br0   ppp0    0.0.0.0/0            0.0.0.0/0
11       0     0 DROP       all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0
12       0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0
13     978 51318 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
14       0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT
15   20143 3725K WGCF       all  --  *      *       0.0.0.0/0            0.0.0.0/0
16   20143 3725K OVPNCF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
17   20143 3725K VPNCF      all  --  *      *       0.0.0.0/0            0.0.0.0/0
18   19987 3717K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0
19     156  8160 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

this worked !!!
my remote device’s IPv4 address is now same as my home router’s one. this is what I wanted.
thanks a lot l0crian. this was really helpful to me !!!
appreciate all the support on this one !

l0crian · November 12, 2023, 5:17am

No problem, glad you got it working!

One thing to add:

If you want to be able to access non-ZT devices on your LAN, you’ll need to add one more rule allowing zt+ to br0. You can add it right after the rule you just created (or before).

bj.blazkowicz · November 12, 2023, 5:25am

so something like this you mean ?

iptables -I FORWARD 10 -i zt+ -o br0 -j ACCEPT

l0crian · November 12, 2023, 5:30am

Yep, that should do it.