From 18277fc1ec921dfcfa61c0b2f0b40fb62cfa070f Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Fri, 22 May 2026 14:28:17 +0100 Subject: fix(net): keep waydroid0 out of bond0, allow it through nftables systemd-networkd's Type=ether matcher was enslaving waydroid0 into bond0 the moment 'waydroid session start' ran, taking down the host's default route. Mirror the libvirt/docker negation pattern. Also mirror the existing virbr0 forward accepts for waydroid0 so the Android container can actually reach the internet through MASQUERADE. --- etc/nftables.conf | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'etc/nftables.conf') diff --git a/etc/nftables.conf b/etc/nftables.conf index f22150e..dd5e09c 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -38,5 +38,11 @@ table inet filter { # load before libvirtd has created virbr0 at boot. iifname "virbr0" accept comment "libvirt: guest egress" oifname "virbr0" ct state established,related accept comment "libvirt: guest return" + + # Waydroid's NAT bridge: same pattern as libvirt. Waydroid configures its + # own MASQUERADE in nat/POSTROUTING but does NOT add forward accepts, so + # without these the Android container has no outbound network. + iifname "waydroid0" accept comment "waydroid: guest egress" + oifname "waydroid0" ct state established,related accept comment "waydroid: guest return" } } -- cgit v1.3.1