Pineapple Pager

#!/bin/sh /etc/rc.common

# https://github.com/openwrt/packages/blob/master/net/tailscale/files/tailscale.init

# Copyright 2020 Google LLC.
# Copyright (C) 2021 CZ.NIC z.s.p.o. (https://www.nic.cz/)
# SPDX-License-Identifier: Apache-2.0

USE_PROCD=1
START=80

export TS_NO_LOGS_NO_SUPPORT=true

start_service() {
    local state_file
    local port
    local std_err std_out

    config_load tailscale
    config_get_bool std_out "settings" log_stdout 1
    config_get_bool std_err "settings" log_stderr 1
    config_get port "settings" port 41641
    # Point to the Pager's MMC partition under /root
    config_get state_file "settings" state_file /root/tailscale/tailscaled.state
    config_get fw_mode "settings" fw_mode nftables

    /usr/sbin/tailscaled --cleanup

    procd_open_instance
    procd_set_param command /usr/sbin/tailscaled

    # Starting with v1.48.1 ENV variable is required to enable use of iptables / nftables.
    # Use nftables by default - can be changed to 'iptables' in tailscale config
    procd_set_param env TS_DEBUG_FIREWALL_MODE="$fw_mode"

    # Disable logging to log.tailscale.com
    procd_append_param env TS_NO_LOGS_NO_SUPPORT=true

    # Set the port to listen on for incoming VPN packets.
    # Remote nodes will automatically be informed about the new port number,
    # but you might want to configure this in order to set external firewall
    # settings.
    procd_append_param command --port "$port"
    procd_append_param command --state "$state_file"

    procd_set_param respawn
    procd_set_param stdout "$std_out"
    procd_set_param stderr "$std_err"

    procd_close_instance
}

stop_service() {
    /usr/sbin/tailscaled --cleanup
}

# https://github.com/openwrt/packages/blob/master/net/tailscale/files/tailscale.conf
config settings 'settings'
    option log_stderr '1'
    option log_stdout '1'
    option port '41641'
    # Point to the Pager's MMC partition under /root
    option state_file '/root/tailscale/tailscaled.state'
    # default to using nftables - change below to 'iptables' if still using iptables
    option fw_mode 'nftables'

#!/bin/bash

nft delete table bridge ifdetect

nft add table bridge ifdetect
nft add chain bridge ifdetect prerouting_mangle '{type filter hook prerouting priority -150; }'

nft add rule bridge ifdetect prerouting_mangle iifname "eth0" counter meta mark set 0x1
nft add rule bridge ifdetect prerouting_mangle iifname "wlan0mgmt" counter meta mark set 0x3

# group arbitrary external "client" interfaces together
nft add rule bridge ifdetect prerouting_mangle iifname "wlan0cli" counter meta mark set 0x4
nft add rule bridge ifdetect prerouting_mangle iifname "wwan*" counter meta mark set 0x4
nft add rule bridge ifdetect prerouting_mangle iifname "eth1" counter meta mark set 0x4
nft add rule bridge ifdetect prerouting_mangle iifname "tailscale0" counter meta mark set 0x5

nft delete table ip ifdetect
nft add table ip ifdetect
nft add chain ip ifdetect prerouting_mangle '{type filter hook prerouting priority -150; }'
nft add rule ip ifdetect prerouting_mangle iifname "eth0" counter meta mark set 0x1
nft add rule ip ifdetect prerouting_mangle iifname "wlan0mgmt" counter meta mark set 0x3

nft add rule ip ifdetect prerouting_mangle iifname "wlan0cli" counter meta mark set 0x4
nft add rule ip ifdetect prerouting_mangle iifname "wwan*" counter meta mark set 0x4
nft add rule ip ifdetect prerouting_mangle iifname "eth1" counter meta mark set 0x4
nft add rule ip ifdetect prerouting_mangle iifname "tailscale0" counter meta mark set 0x5

config rule
        option name             'Allow-Admin-Tailscale'
        option src              'wan'
        option mark             '0x5'
        option proto            'tcp'
        option dest_port        '1471'
        option target           'ACCEPT'

config rule
        option name             'Allow-SSH-Tailscale'
        option src              'wan'
        option mark             '0x5'
        option proto            'tcp'
        option dest_port        '22'
        option target           'ACCEPT'