Commit d566d6d

@@ -40,6 +40,10 @@
     ];
 
     nixos = {
+      pkgs,
+      lib,
+      ...
+    }: {
       boot.kernel.sysctl = {
         "net.ipv4.ip_forward" = 1;
         "net.ipv4.conf.all.send_redirects" = 0;
@@ -84,17 +88,27 @@
         };
       };
 
-      # NAT-PMP enables direct connections from the company network
-      # (192.168.100.x) to Tailscale clients behind this router.
+      # The WAN is behind the company NAT (192.168.100.x), so miniupnpd
+      # must allow a private external IP to serve NAT-PMP mappings.
       services.miniupnpd = {
         enable = true;
         externalInterface = "enP3p49s0";
         internalIPs = ["br-lan"];
         upnp = false;
         natpmp = true;
+        appendConfig = "ext_allow_private_ipv4=yes";
       };
 
-      systemd.services.miniupnpd.after = ["systemd-networkd.service"];
+      systemd.services.miniupnpd = {
+        after = ["systemd-networkd.service"];
+        serviceConfig = {
+          ExecStartPre = pkgs.writeShellScript "miniupnpd-check-wan" ''
+            ${lib.getExe' pkgs.iproute2 "ip"} -4 -o addr show dev enP3p49s0 scope global | ${lib.getExe' pkgs.gnugrep "grep"} -q .
+          '';
+          Restart = "on-failure";
+          RestartSec = 30;
+        };
+      };
     };
   };
 }