[f-hollow]

This is a follow-up PR to #386:

• Added the full-tunnel routing section
• Fixed all issues mentioned in Add full-tunnel (0.0.0.0/0) routing to the unsafe routes guide #401
• Fixed terminology inconsistency in one place

Closes #401

[f-hollow]

@jasikpark I have a couple of notes:

• From Add full-tunnel (0.0.0.0/0) routing to the unsafe routes guide #401, should I do anything regarding the ufw before.rules block runs -F POSTROUTING ...?
• As per listen.so_mark: 0.0.0.0/0 example omits use_system_route_table / install: false #387 (comment), documented the scenario of using an unsafe_routes entry for 0.0.0.0/0 with install: false

PTAL

[jasikpark]

Thanks for picking this back up! I ran the Linux recipe in a lab (nebula v1.12.0) and the client side works as written. A few things before merge:

1. iptables/nftables return rule. The forward rules come in pairs, and the reply rule matches -s 192.168.1.0/24 (ip saddr in nftables). For full-tunnel, replies come from any address, so that match has to go too. With FORWARD policy DROP and only the first rule edited, requests leave and replies are dropped.
2. Link-local addresses. With the destination restriction removed, overlay hosts can reach 169.254.0.0/16 through the gateway. On most cloud VMs that includes the instance metadata endpoint at 169.254.169.254. Could the warning cover this and suggest a drop rule, e.g. iptables -I FORWARD 1 -i nebula1 -d 169.254.0.0/16 -j DROP? The same applies to any private network the gateway can reach.
3. Table 4242 wording. It's described as a table "for internal overlay network traffic". It holds the default route for everything except Nebula's own underlay traffic.
4. IPv6. The section only covers 0.0.0.0/0. A short note that IPv6 traffic isn't routed through the gateway by this setup would save dual-stack readers a surprise.

On your questions: the install: false approach is good. The ufw -F POSTROUTING flush is a separate problem, so let's leave it out of this PR; I'll open an issue.

— Caleb + Cache

[f-hollow]

@jasikpark Thank you for your detailed review and for your patience. I was in a hurry and didn't double-check the forwarding rules.

I implemented all the comments and learned a great deal along the way.

Not sure why the main branch was merged into my feature branch. Wouldn't it be better if we rebase my commits on main and squash them before merge? Please let me know if I should rebase my branch, or if anything else should be done.