1
#!/bin/sh /etc/rc.common
2

3
#
4
# This script creates policy routing rules for ZeroTier to coexist with Tailscale.
5
# It prevents ZeroTier's traffic from being intercepted by Tailscale's high-priority rule.
6
# Version 3: Intelligently handles IPv4 and IPv6 addresses.
7
#
8

9
START=99
10
STOP=15
11

12
# --- CONFIGURATION ---
13
# The name of your ZeroTier virtual network interface. Find it with `ifconfig | grep zt`.
14
ZT_IFACE="ztypia4gba"
15

16
# The priority for the new routing rule. Must be lower (higher priority) than Tailscale's (usually 5270).
17
RULE_PRIO="5260"
18

19
# Tag for system log entries.
20
LOG_TAG="zerotier-policy-route"
21
# --- END CONFIGURATION ---
22

23
add_rules() {
24
    # Get all global/unique IP addresses (v4 and v6), excluding link-local (fe80::) addresses.
25
    IP_LIST=$(ip addr show dev "${ZT_IFACE}" | grep -E 'inet|inet6' | grep -v ' fe80::' | awk '{print $2}' | cut -d'/' -f1)
26

27
    if [ -z "${IP_LIST}" ]; then
28
        logger -t "${LOG_TAG}" "Warning: No usable IP addresses found on interface ${ZT_IFACE}."
29
        return
30
    fi
31

32
    for ip in ${IP_LIST}; do
33
        # Check if a rule for this IP already exists to avoid duplication.
34
        if ! ip rule | grep -q "from ${ip} lookup main"; then
35
            logger -t "${LOG_TAG}" "Adding rule for ${ip} with priority ${RULE_PRIO}."
36

37
            # CRITICAL FIX: Use the '-6' flag for IPv6 addresses.
38
            if echo "${ip}" | grep -q ":"; then
39
                ip -6 rule add from "${ip}" lookup main prio "${RULE_PRIO}"
40
            else
41
                ip rule add from "${ip}" lookup main prio "${RULE_PRIO}"
42
            fi
43
        else
44
            logger -t "${LOG_TAG}" "Rule for ${ip} already exists. Skipping."
45
        fi
46
    done
47
}
48

49
remove_rules() {
50
    IP_LIST=$(ip addr show dev "${ZT_IFACE}" | grep -E 'inet|inet6' | grep -v ' fe80::' | awk '{print $2}' | cut -d'/' -f1)
51
    if [ -z "${IP_LIST}" ]; then return; fi
52

53
    for ip in ${IP_LIST}; do
54
        if ip rule | grep -q "from ${ip} lookup main"; then
55
            logger -t "${LOG_TAG}" "Removing rule for ${ip}."
56

57
            # Use the '-6' flag for deletion of IPv6 rules as well.
58
            if echo "${ip}" | grep -q ":"; then
59
                ip -6 rule del from "${ip}" lookup main prio "${RULE_PRIO}"
60
            else
61
                ip rule del from "${ip}" lookup main prio "${RULE_PRIO}"
62
            fi
63
        fi
64
    done
65
}
66

67
start() {
68
    logger -t "${LOG_TAG}" "Service starting, applying rules..."
69
    add_rules
70
}
71

72
stop() {
73
    logger -t "${LOG_TAG}" "Service stopping, removing rules..."
74
    remove_rules
75
}
76

77
reload() {
78
    logger -t "${LOG_TAG}" "Service reloading..."
79
    stop
80
    start
81
}

1
0:      from all lookup local
2
...
3
5260:   from 172.27.72.251 lookup main
4
5260:   from fddd:ec77:... lookup main
5
5260:   from fce1:9571:... lookup main
6
5270:   from all lookup 52
7
...

1
#!/bin/bash
2

3
#
4
# This script creates policy routing rules for all ZeroTier interfaces
5
# to coexist with Tailscale on a standard Linux system.
6
#
7

8
set -e # Exit immediately if a command exits with a non-zero status.
9

10
# --- CONFIGURATION ---
11
# The priority for the new routing rule.
12
# This MUST be a lower number (higher priority) than Tailscale's rule (usually 5270).
13
RULE_PRIO="5260"
14
LOG_TAG="zerotier-policy-route"
15
# --- END CONFIGURATION ---
16

17
# Find all ZeroTier network interfaces (names starting with 'zt').
18
ZT_INTERFACES=$(ip -o link show | awk -F': ' '{print $2}' | grep '^zt')
19

20
if [ -z "$ZT_INTERFACES" ]; then
21
    logger -t "$LOG_TAG" "No ZeroTier interfaces found. Exiting."
22
    exit 0
23
fi
24

25
# Function to add rules for all found interfaces
26
add_rules() {
27
    logger -t "$LOG_TAG" "Applying policy routing rules..."
28
    for iface in $ZT_INTERFACES; do
29
        # Get all global/unique IP addresses (v4 and v6), excluding link-local (fe80::)
30
        IP_LIST=$(ip addr show dev "$iface" | grep -E 'inet|inet6' | grep -v 'fe80::' | awk '{print $2}' | cut -d'/' -f1)
31

32
        if [ -z "$IP_LIST" ]; then
33
            logger -t "$LOG_TAG" "No usable IP addresses on interface $iface. Skipping."
34
            continue
35
        fi
36

37
        for ip in $IP_LIST; do
38
            if ! ip rule | grep -q "from $ip lookup main"; then
39
                logger -t "$LOG_TAG" "Adding rule for $ip (on $iface) with priority $RULE_PRIO."
40
                if [[ "$ip" == *":"* ]]; then
41
                    ip -6 rule add from "$ip" lookup main prio "$RULE_PRIO"
42
                else
43
                    ip rule add from "$ip" lookup main prio "$RULE_PRIO"
44
                fi
45
            fi
46
        done
47
    done
48
}
49

50
# Function to remove rules
51
remove_rules() {
52
    logger -t "$LOG_TAG" "Removing policy routing rules..."
53
    while ip rule | grep -q "prio $RULE_PRIO"; do
54
        RULE_TO_DELETE=$(ip rule | grep "prio $RULE_PRIO" | head -n 1)
55
        logger -t "$LOG_TAG" "Deleting rule: $RULE_TO_DELETE"
56
        # We need to parse the rule string to delete it correctly
57
        ip rule del $(echo ${RULE_TO_DELETE} | sed 's/[0-9]*:\s*//')
58
    done
59
}
60

61
case "$1" in
62
    start)
63
        add_rules
64
        ;;
65
    stop)
66
        remove_rules
67
        ;;
68
    restart)
69
        remove_rules
70
        add_rules
71
        ;;
72
    *)
73
        echo "Usage: $0 {start|stop|restart}"
74
        exit 1
75
        ;;
76
esac
77

78
exit 0

1
[Unit]
2
Description=ZeroTier Policy Routing Fix for Tailscale Coexistence
3
After=network-online.target
4
Wants=network-online.target
5
After=zerotier-one.service tailscaled.service
6

7
[Service]
8
Type=oneshot
9
RemainAfterExit=yes
10
ExecStart=/usr/local/sbin/zerotier-policy-route.sh start
11
ExecStop=/usr/local/sbin/zerotier-policy-route.sh stop
12

13
[Install]
14
WantedBy=multi-user.target

1
0:      from all lookup local
2
5210:   from all fwmark 0x80000/0xff0000 lookup main
3
...
4
5260:   from 172.27.72.101 lookup main  <-- Fixed
5
5260:   from 172.27.62.101 lookup main  <-- Fixed
6
5270:   from all lookup 52
7
...