host_firewall: no_hairpin_ifaces drops forwarding back out of the interface it came in on

2026-11-06 08:33:42 +00:00
parent 252c703afd
commit 79943e0389
2 changed files with 9 additions and 1 deletions
@@ -116,6 +116,10 @@ firewall:
  # of any host, and ones holding an address of the host are left out
  # (/etc/nft-host-scanners.allowlist). Refreshed daily by nft-host-scanners.
  scanners: true
+  # Bridges and uplinks whose forwarded traffic may not leave through the interface it came in on (iifname X oifname X
+  # drop). The datacenter gateway routes packets for foreign addresses of the subnet to the host; with ip_forward they
+  # would be forwarded back out and masqueraded with the host address. Not for a bridge that carries guests.
+  no_hairpin_ifaces: {}
  # Reject outbound TCP 25; the mail group turns it off.
  block_smtp_out: true
  # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo