vpn/netstate: clean up PowerShell invocation and diagnose missing WinNAT

On Windows Home the MSFT_NetNat WMI class does not exist, so every
*-NetNat cmdlet fails with WBEM_E_INVALID_CLASS (0x80041010) and the UI showed a raw multi-line PowerShell dump with mojibake. Detect the HRESULT (the message text is localized) and return an actionable error instead; document the condition in README's Troubleshooting.

Also fix two runPowerShell defects visible in the same flow: the console window of powershell.exe popped up over the GUI (hidden via
CREATE_NO_WINDOW), and localized error text was mangled to '?' in logs (fixed by forcing UTF-8 output encoding).

Author: pymq

README.md

@@ -327,6 +327,7 @@ The privacy exposure — your IP appearing as the source of another device's tra
 - **A "what's my IP" site still shows your own IP after enabling.** Check the gateway status (the **VPN Gateway** card, or `awl cli gateway status`): if it's not connected, awl can't reach the exit node, so nothing is being tunnelled.
 - **A site works over IPv6 but not through the gateway.** Expected — IPv6 isn't tunnelled (see the note above). Dual-stack hosts fall back to IPv4 automatically; anything IPv6-only won't work while the gateway is on.
 - **Turning on *Serve as VPN Gateway* fails on Windows.** Windows effectively allows one NAT instance per host, and it may already be taken by Docker (Windows containers), WSL2 or Internet Connection Sharing — the error message lists the current holders. Free it up, or share this device over SOCKS5 instead: the SOCKS5 exit node doesn't need NAT.
+- **Turning on *Serve as VPN Gateway* on Windows fails with "WinNAT is not available" (HRESULT 0x80041010).** awl's exit-node NAT is built on Windows' own WinNAT, and on this installation the `MSFT_NetNat` WMI class doesn't exist. Windows **Home** editions don't ship WinNAT at all — there is no way to enable it there. On Pro/Enterprise/Server it can also be missing when neither Hyper-V nor RAS components are enabled (turning on the Hyper-V feature registers it) or when the WMI repository is corrupted. If you can't get WinNAT on your machine, share this device over SOCKS5 instead — the SOCKS5 exit node doesn't need it.
 - **No IPv6 connectivity after awl crashed (Linux).** If awl is killed (not shut down) with the gateway client on, its IPv6 block stays behind. It is removed automatically on the next awl start (and stop).
 - **Devices are reachable only via relay from a Windows machine with multiple network interfaces.** awl on Windows pins its peer-to-peer traffic to the interface that holds the default route, so peers reachable only through a secondary network card may fall back to relayed connections.
 

vpn/netstate/nat_windows.go

@@ -12,6 +12,7 @@ import (
 	"os/exec"
 	"slices"
 	"strings"
+	"syscall"
 	"time"
 
 	"github.com/tailscale/wf"
@@ -96,6 +97,11 @@ func (m *Manager) setupNAT(awlSubnet, tunIfName string) (*natState, error) {
 	// NetNat behind (WFP leftovers are impossible — dynamic session). Remove
 	// it so New-NetNat below gets a clean slate.
 	cleaned, err := cleanupStaleWinNAT()
+	if winNATUnavailable(err) {
+		// Not a cleanup problem: WinNAT does not exist on this host at all,
+		// and the "pre-clean" framing would only obscure that.
+		return nil, err
+	}
 	if err != nil {
 		return nil, fmt.Errorf("pre-clean stale WinNAT: %w", err)
 	}
@@ -417,13 +423,43 @@ const powerShellTimeout = time.Minute
 func runPowerShell(command string) ([]byte, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), powerShellTimeout)
 	defer cancel()
-	out, err := exec.CommandContext(ctx, "powershell.exe", "-NoProfile", "-NonInteractive", "-Command", command).CombinedOutput()
+	// The OutputEncoding prefix forces UTF-8 on the redirected pipes: without
+	// it PowerShell encodes its (localized) error text in the console
+	// codepage, which mangles non-ASCII into '?' by the time it reaches logs.
+	cmd := exec.CommandContext(ctx, "powershell.exe", "-NoProfile", "-NonInteractive", "-Command",
+		"[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; "+command)
+	// awl runs as a GUI process with no console of its own, so a bare
+	// powershell.exe would get a fresh visible console window.
+	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: windows.CREATE_NO_WINDOW}
+	out, err := cmd.CombinedOutput()
 	if err != nil {
 		return out, fmt.Errorf("powershell %q: %w (output: %s)", command, err, strings.TrimSpace(string(out)))
 	}
 	return out, nil
 }
 
+// winNATUnavailable reports whether err is WMI's WBEM_E_INVALID_CLASS from a
+// *-NetNat cmdlet: the MSFT_NetNat class does not exist on this installation
+// at all. Windows Home editions do not ship WinNAT, and on other editions the
+// class can be missing when neither Hyper-V nor RAS components are enabled or
+// the WMI repository is corrupted. Matched by HRESULT, not message text — the
+// text is localized.
+func winNATUnavailable(err error) bool {
+	return err != nil && strings.Contains(err.Error(), "0x80041010")
+}
+
+// winNATUnavailableError replaces the raw multi-line PowerShell dump with an
+// actionable message for the winNATUnavailable case. The original error is
+// deliberately not wrapped: the HRESULT is the whole story, and this text is
+// shown verbatim in the UI.
+func winNATUnavailableError() error {
+	return errors.New("WinNAT is not available on this Windows installation " +
+		"(WMI class MSFT_NetNat does not exist, HRESULT 0x80041010). " +
+		"It is missing on Windows Home editions; on other editions it requires Hyper-V or RAS " +
+		"components. VPN gateway server mode cannot work without it — " +
+		"see the Troubleshooting section in the README; the SOCKS5 exit node works without WinNAT")
+}
+
 // netNATEntry is one WinNAT instance as reported by
 // `Get-NetNat | ConvertTo-Json`.
 type netNATEntry struct {
@@ -466,6 +502,9 @@ func findNetNAT(entries []netNATEntry, name string) (netNATEntry, bool) {
 // listNetNAT returns the current WinNAT instances.
 func listNetNAT() ([]netNATEntry, error) {
 	out, err := runPowerShell("Get-NetNat | Select-Object Name,InternalIPInterfaceAddressPrefix | ConvertTo-Json -Compress")
+	if winNATUnavailable(err) {
+		return nil, winNATUnavailableError()
+	}
 	if err != nil {
 		return nil, err
 	}
@@ -500,6 +539,9 @@ func createWinNAT(awlSubnet string) error {
 	if err == nil {
 		return nil
 	}
+	if winNATUnavailable(err) {
+		return winNATUnavailableError()
+	}
 
 	existing := "unavailable"
 	if entries, listErr := listNetNAT(); listErr == nil {

vpn/netstate/nat_windows_test.go

@@ -111,6 +111,22 @@ func TestResyncForwarding(t *testing.T) {
 	}
 }
 
+// winNATUnavailable must recognize WBEM_E_INVALID_CLASS by HRESULT alone:
+// the surrounding message is localized (the sample below is from a Russian
+// Windows 11 Home), so text matching is not an option.
+func TestWinNATUnavailable(t *testing.T) {
+	realError := errors.New(`powershell "Get-NetNat | Select-Object Name,InternalIPInterfaceAddressPrefix | ConvertTo-Json -Compress": exit status 1 (output: Get-NetNat : Недопустимый класс
+At line:1 char:1
++ Get-NetNat | Select-Object Name,InternalIPInterfaceAddressPrefix | Co ...
++ ~~~~~~~~~~
+    + CategoryInfo          : MetadataError: (MSFT_NetNat:root/StandardCimv2/MSFT_NetNat) [Get-NetNat], CimException
+    + FullyQualifiedErrorId : HRESULT 0x80041010,Get-NetNat)`)
+	require.True(t, winNATUnavailable(realError))
+
+	require.False(t, winNATUnavailable(nil))
+	require.False(t, winNATUnavailable(errors.New(`powershell "New-NetNat": exit status 1 (output: some other failure)`)))
+}
+
 // PowerShell's ConvertTo-Json emits three shapes depending on result count:
 // nothing at all, a bare object, or an array. parseNetNATJSON must handle all.
 func TestParseNetNATJSON(t *testing.T) {