From cc1c891400aa130f28f3071b6694e016f9c2be64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=B8=96=E7=95=8C?= <i@sekai.icu>
Date: Tue, 4 Aug 2026 22:17:04 +0800
Subject: [PATCH] tailscale: Fix preferred_by matching all addresses with exit
 node

Exit node peers carry default routes (0.0.0.0/0, ::/0) in their allowed
IPs, so including them in routePrefixes made PreferredAddress report
every address as preferred.
---
 protocol/tailscale/endpoint.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/protocol/tailscale/endpoint.go b/protocol/tailscale/endpoint.go
index eb22f678..32c00d47 100644
--- a/protocol/tailscale/endpoint.go
+++ b/protocol/tailscale/endpoint.go
@@ -834,6 +834,9 @@ func (t *Endpoint) onReconfig(cfg *wgcfg.Config, routerCfg *router.Config, dnsCf
 	var builder netipx.IPSetBuilder
 	for _, peer := range cfg.Peers {
 		for _, allowedIP := range peer.AllowedIPs {
+			if allowedIP.Bits() == 0 {
+				continue
+			}
 			builder.AddPrefix(allowedIP)
 		}
 	}