1
#!/bin/sh /etc/rc.common
2

3
#
4
# This script creates policy routing rules for ZeroTier to coexist with Tailscale.
5
# It prevents ZeroTier's traffic from being intercepted by Tailscale's high-priority rule.
6
# Version 3: Intelligently handles IPv4 and IPv6 addresses.
7
#
8

9
START=99
10
STOP=15
11

12
# --- CONFIGURATION ---
13
# The name of your ZeroTier virtual network interface. Find it with `ifconfig | grep zt`.
14
ZT_IFACE="ztypia4gba"
15

16
# The priority for the new routing rule. Must be lower (higher priority) than Tailscale's (usually 5270).
17
RULE_PRIO="5260"
18

19
# Tag for system log entries.
20
LOG_TAG="zerotier-policy-route"
21
# --- END CONFIGURATION ---
22

23
add_rules() {
24
    # Get all global/unique IP addresses (v4 and v6), excluding link-local (fe80::) addresses.
25
    IP_LIST=$(ip addr show dev "${ZT_IFACE}" | grep -E 'inet|inet6' | grep -v ' fe80::' | awk '{print $2}' | cut -d'/' -f1)
26

27
    if [ -z "${IP_LIST}" ]; then
28
        logger -t "${LOG_TAG}" "Warning: No usable IP addresses found on interface ${ZT_IFACE}."
29
        return
30
    fi
31

32
    for ip in ${IP_LIST}; do
33
        # Check if a rule for this IP already exists to avoid duplication.
34
        if ! ip rule | grep -q "from ${ip} lookup main"; then
35
            logger -t "${LOG_TAG}" "Adding rule for ${ip} with priority ${RULE_PRIO}."
36

37
            # CRITICAL FIX: Use the '-6' flag for IPv6 addresses.
38
            if echo "${ip}" | grep -q ":"; then
39
                ip -6 rule add from "${ip}" lookup main prio "${RULE_PRIO}"
40
            else
41
                ip rule add from "${ip}" lookup main prio "${RULE_PRIO}"
42
            fi
43
        else
44
            logger -t "${LOG_TAG}" "Rule for ${ip} already exists. Skipping."
45
        fi
46
    done
47
}
48

49
remove_rules() {
50
    IP_LIST=$(ip addr show dev "${ZT_IFACE}" | grep -E 'inet|inet6' | grep -v ' fe80::' | awk '{print $2}' | cut -d'/' -f1)
51
    if [ -z "${IP_LIST}" ]; then return; fi
52

53
    for ip in ${IP_LIST}; do
54
        if ip rule | grep -q "from ${ip} lookup main"; then
55
            logger -t "${LOG_TAG}" "Removing rule for ${ip}."
56

57
            # Use the '-6' flag for deletion of IPv6 rules as well.
58
            if echo "${ip}" | grep -q ":"; then
59
                ip -6 rule del from "${ip}" lookup main prio "${RULE_PRIO}"
60
            else
61
                ip rule del from "${ip}" lookup main prio "${RULE_PRIO}"
62
            fi
63
        fi
64
    done
65
}
66

67
start() {
68
    logger -t "${LOG_TAG}" "Service starting, applying rules..."
69
    add_rules
70
}
71

72
stop() {
73
    logger -t "${LOG_TAG}" "Service stopping, removing rules..."
74
    remove_rules
75
}
76

77
reload() {
78
    logger -t "${LOG_TAG}" "Service reloading..."
79
    stop
80
    start
81
}

1
0:      from all lookup local
2
...
3
5260:   from 172.27.72.251 lookup main
4
5260:   from fddd:ec77:... lookup main
5
5260:   from fce1:9571:... lookup main
6
5270:   from all lookup 52
7
...

1
#!/bin/bash
2

3
#
4
# This script creates policy routing rules for all ZeroTier interfaces
5
# to coexist with Tailscale on a Debian-based system.
6
#
7

8
set -e # Exit immediately if a command exits with a non-zero status.
9

10
# --- CONFIGURATION ---
11
# The priority for the new routing rule.
12
# This MUST be a lower number (higher priority) than Tailscale's rule (usually 5270).
13
RULE_PRIO="5260"
14
LOG_TAG="zerotier-policy-route"
15
# --- END CONFIGURATION ---
16

17
# Find all ZeroTier network interfaces (names starting with 'zt').
18
# We use `ip -o link show` for a stable, one-line-per-interface output.
19
ZT_INTERFACES=$(ip -o link show | awk -F': ' '{print $2}' | grep '^zt')
20

21
if [ -z "$ZT_INTERFACES" ]; then
22
    logger -t "$LOG_TAG" "No ZeroTier interfaces found. Exiting."
23
    exit 0
24
fi
25

26
# Function to add rules for all found interfaces
27
add_rules() {
28
    logger -t "$LOG_TAG" "Applying policy routing rules..."
29
    for iface in $ZT_INTERFACES; do
30
        # Get all global/unique IP addresses (v4 and v6), excluding link-local (fe80::)
31
        IP_LIST=$(ip addr show dev "$iface" | grep -E 'inet|inet6' | grep -v 'fe80::' | awk '{print $2}' | cut -d'/' -f1)
32

33
        if [ -z "$IP_LIST" ]; then
34
            logger -t "$LOG_TAG" "No usable IP addresses on interface $iface. Skipping."
35
            continue
36
        fi
37

38
        for ip in $IP_LIST; do
39
            # Only add the rule if it doesn't already exist.
40
            if ! ip rule | grep -q "from $ip lookup main"; then
41
                logger -t "$LOG_TAG" "Adding rule for $ip (on $iface) with priority $RULE_PRIO."
42
                # Use the '-6' flag for IPv6 addresses.
43
                if [[ "$ip" == *":"* ]]; then
44
                    ip -6 rule add from "$ip" lookup main prio "$RULE_PRIO"
45
                else
46
                    ip rule add from "$ip" lookup main prio "$RULE_PRIO"
47
                fi
48
            fi
49
        done
50
    done
51
}
52

53
# Function to remove rules for all found interfaces
54
remove_rules() {
55
    logger -t "$LOG_TAG" "Removing policy routing rules..."
56
    # We need to find all possible IPs that could have had rules.
57
    # It's safer to just try deleting any rule with our priority.
58
    # This is simpler and more robust than tracking IPs.
59
    while ip rule | grep -q "prio $RULE_PRIO"; do
60
        # Find the first rule with our priority and delete it. Loop until none are left.
61
        RULE_TO_DELETE=$(ip rule | grep "prio $RULE_PRIO" | head -n 1)
62
        logger -t "$LOG_TAG" "Deleting rule: $RULE_TO_DELETE"
63
        # Re-construct the delete command from the rule string.
64
        ip rule del ${RULE_TO_DELETE}
65
    done
66
}
67

68
# Main command logic
69
case "$1" in
70
    start)
71
        add_rules
72
        ;;
73
    stop)
74
        remove_rules
75
        ;;
76
    restart)
77
        remove_rules
78
        add_rules
79
        ;;
80
    *)
81
        echo "Usage: $0 {start|stop|restart}"
82
        exit 1
83
        ;;
84
esac
85

86
exit 0