[sembrestels]

Context

The WiFi entrypoint checks whether the forwarding sysctl output is nonempty, so both 0 and 1 are reported as enabled. It also always adds a MASQUERADE rule, even when the exposed NAT setting is false.

This can start a hotspot without working IPv4 forwarding and prevents users from selecting routed mode.

Approach

• Compare ip_dynaddr and ip_forward explicitly with 1, enable them when necessary, and stop startup if required network configuration fails.
• Honor NAT=true|false, retaining the existing default. Reject invalid values before moving the wireless device.
• Make NAT setup idempotent. Routed mode removes exact copies of the existing WiFi rule, including legacy duplicates, while retaining other rules. Forwarding stays enabled in both modes.
• Share the actual forwarding/NAT helpers with isolated tests, copy the helper into the image, and document routed mode's return-route requirement. Constrain the wizard's NAT choice to the supported values.

Test instructions

Run the regression and configuration checks:

PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v
bash -n src/entrypoint.sh src/network.sh tests/network-namespace.sh
docker compose config --quiet

Build and test real sysctls/iptables in a disposable private network namespace. Do not use host networking for this test:

docker build -t wifi-forwarding-nat-test src
docker run --rm --privileged --network none --entrypoint bash \
  --mount type=bind,src="$PWD/tests/network-namespace.sh",dst=/network-test.sh,readonly \
  wifi-forwarding-nat-test /network-test.sh

For a physical-device smoke test, install the package on a staging Dappnode with NAT=true. Connect a phone/laptop to its hotspot with mobile data and VPN disabled, check that it receives a WiFi-subnet address, open http://my.dappnode, and browse an HTTPS website. Disconnect/reconnect and repeat.

A physical NAT=false test additionally needs return routes to the WiFi subnet before changing the setting. Confirm forwarding remains enabled and the matching MASQUERADE rule is absent; restore NAT=true afterward.

Validation

• All 14 regression tests pass, including disabled/enabled/mixed forwarding, missing/read-only sysctls, repeated NAT setup, both modes, mode transitions, legacy duplicates, unrelated-rule preservation, invalid settings and iptables failures.
• The amd64 source image builds. Its isolated namespace checks pass against real sysctls/iptables, including the packaged entrypoint rejecting invalid NAT before networking changes. Shell, dnsmasq and Compose checks pass.
• Updated scripts were deployed on an existing Dappnode WiFi runtime, retaining its radio/network binaries and configuration. The AP and DHCP daemons run, both forwarding values are 1, and exactly one expected NAT rule exists. The operator confirmed the hotspot and browsing/reconnection tests work.
• A physical laptop also passed a local routed-mode test: with the installed helper applied using NAT=false, its HTTP request reached a host test endpoint with the original 10.20.12.x source address. The WiFi MASQUERADE rule was absent and forwarding remained enabled. Normal NAT was restored and the temporary return route and test endpoint were removed afterward.
• Routed-mode Internet access, startup with a persisted NAT=false environment, and ARM64 image builds remain untested. The physical test changed the running rules without restarting the radio; the saved package environment remained NAT=true.
• Each exact unlabelled legacy WiFi rule is treated as package-owned; an independently created identical rule cannot be distinguished from it.