From 4f5dda602622419713a240f8c25414f483830b37 Mon Sep 17 00:00:00 2001
From: RootHost-Stormwind <RootHost-Stormwind@ze.mawtrixx.net>
Date: Sun, 25 Oct 2026 21:26:30 +0100
Subject: [PATCH] feat: allow established replies through crusader DMZ rule

---
 incus.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/incus.nix b/incus.nix
index c63dde3..214ef9a 100644
--- a/incus.nix
+++ b/incus.nix
@@ -10,6 +10,9 @@
         chain fwd_pre {
           type filter hook forward priority -200; policy accept;
 
+          # Antworten auf vom LAN aufgebaute Verbindungen erlauben (Tailscale-Hairpin)
+          ct state established,related accept
+
           # Crusader-Netz darf NICHT ins LAN
           iifname "incusbr1" ip daddr 192.168.0.0/16 drop
         }