tailscale forwarding is working

hosts/nixos/vaniville/configuration.nix

@@ -20,7 +20,12 @@ in
   ];
 
   system = {
-    tailscale.enable = true;
+    tailscale.enable = false;
+  };
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "server";
   };
 
 
@@ -35,6 +40,9 @@ in
         forceInstall = true;
       };
     };
+    kernel.sysctl = {
+      "net.ipv4.ip_forward" = 1;
+    };
   };
 
  
@@ -64,7 +72,6 @@ in
     interfaces.eth0.useDHCP = true;
     #networkmanager.enable = true;  # Easiest to use and most distros use this by default.
 
-
     nat = {
       enable = true;
       externalInterface = "eth0";          # your PUBLIC_IF
@@ -92,8 +99,19 @@ in
       # tailscale will also need its UDP port open:
       allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
       trustedInterfaces = [ "tailscale0" ];
-    };
+      extraCommands = ''
+        # Clear any previous rules if you are iterating
+        iptables -t nat -F
     
+        # DNAT: internet -> homelab over tailscale
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 \
+          -j DNAT --to-destination 10.10.0.10:25777
+    
+        # SNAT: ensure replies go back through VPS tailscale IP
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 \
+          -d 10.10.0.10/32 -j SNAT --to-source 100.100.1.10
+      '';
+    };
   };
 
   # Open ports in the firewall, the wrong way