Change:
I really appreciate this message, but also would like to be able to disable it. Most of my Tailscale machines are not exit nodes, nor do they act as subnet routers, hence I would prefer to leave strict filtering enabled and also not have these warnings. It seems like a small thing, but these warnings tend to make me blind to other new, more relevant warnings. I'm hacking on something here:
Thanks for raising this, have been ignoring this issue for ages and meaning to try to do something about it but never got around to it :sweat_smile:
Hah now I'm going to ask you for feedback - how does sound for the option name? It's wordy but I can't think of anything much better. ? but then that hits the issue where it removes the chance for users to see / opt-out of future warnings.
sounds fine, not aware of any existing convention for options to silence warnings.

Discussion:
to match upstream. </para> </listitem> <ins> <listitem> <para> The new option <literal>services.tailscale.useRoutingFeatures</literal> controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to <literal>server</literal>, otherwise if you wish to use an exit node you can set this setting to <literal>client</literal>. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting. </para> </listitem> </ins> </itemizedlist> </section> </section>

- The `services.fwupd` module now allows arbitrary daemon settings to be configured in a structured manner ([`services.fwupd.daemonSettings`](#opt-services.fwupd.daemonSettings)). - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream. <ins> - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting. </ins>

let cfg = config.services.tailscale; <del> firewallOn = config.networking.firewall.enable; rpfMode = config.networking.firewall.checkReversePath; </del> isNetworkd = config.networking.useNetworkd; <del> rpfIsStrict = rpfMode == true || rpfMode == "strict"; </del> in { meta.maintainers = with maintainers; [ danderson mbaillie twitchyliquid64 ];

defaultText = literalExpression "pkgs.tailscale"; description = lib.mdDoc "The package to use for tailscale"; }; <ins> useRoutingFeatures = mkOption { type = types.enum [ "none" "client" "server" "both" ]; default = "none"; example = "server"; description = lib.mdDoc '' Enables settings required for Tailscale's routing features like subnet routers and exit nodes. To use these these features, you will still need to call `sudo tailscale up` with the relevant flags like `--advertise-exit-node` and `--exit-node`. When set to `client` or `both`, reverse path filtering will be set to loose instead of strict. When set to `server` or `both`, IP forwarding will be enabled. ''; }; </ins> }; config = mkIf cfg.enable { <del> warnings = optional (firewallOn && rpfIsStrict) '' Strict reverse path filtering breaks Tailscale exit node use and some subnet routing setups. Consider setting: networking.firewall.checkReversePath = "loose"; ''; </del> environment.systemPackages = [ cfg.package ]; # for the CLI systemd.packages = [ cfg.package ]; systemd.services.tailscaled = {

stopIfChanged = false; }; <ins> boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") { "net.ipv4.conf.all.forwarding" = mkDefault true; "net.ipv6.conf.all.forwarding" = mkDefault true; }; networking.firewall.checkReversePath = mkIf (cfg.useRoutingFeatures == "client" || cfg.useRoutingFeatures == "both") "loose"; </ins> networking.dhcpcd.denyInterfaces = [ cfg.interfaceName ]; systemd.network.networks."50-tailscale" = mkIf isNetworkd {