If anyone wants help with disabling snat in tailscale for whatever your reason, I’ll try to help and hope this helps in small way to somebody. tcpdump was extremely useful to figure out what was happening.
My self-imposed headache simply started with wanting to see tailscale client IPs in my DNS (adguard home) logs instead of the router / NAT / exit node IPs. Tailscale allows you to disable masquerading with --snat-subnets-route=false. If only that were the beginning and end of it.
This sort of thing is 100x easier with HTTP/HTTPS and using header info http_x_forwarded_for but useless at the lower layers that strip it.
routing:
At least his is expected, you need to advertise the return path/route for your LAN. Today I learned it can be advertised via DHCP Option 121 - very cool. Alternatively you can throw a route into your router / firewall but you run the risk of masquerading again.
ip forwarding:
Pretty straightforward, make sure you have net.ipv4.ip_forward = 1 which the tailscale doc tells you to do.
nightmare:
nftables. Despite my best efforts to… flatten? my lan and tailscale network so that there is no masquerading, ultimately I needed to SNAT. I’m using archlinux and so the guide Internet sharing - ArchWiki got me 90% there, just had to additionally add the reverse of nft add rule inet filter forward iifname ens18 oifname tailscale0 accept to allow traffic from “outside” > in. The cherry on top is now that your LAN is plainly seeing the tailscale client IPs (100.x), if they too have tailscale installed it will of course try to reply using the tailscale interface instead of the LAN. Of course tailscale allows you can set routes to manual and resolve this by manually entering routes - but that quickly becomes cumbersome as you add / remove clients etc… so ultimately I just killed the tailscale clients on my LAN besides my subnet router.
Anywho.. as much of a PITA as this was I learned from it. What’s funny is I had pretty much the same issue prior because adguard was inside a container, solved via iptables / prerouting.
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER
For those who don’t want to expose their entire LAN to their tailscale network, ACLS (which you should technically already be using).