diff --git a/readme.md b/readme.md index e68915f..5fb9532 100644 --- a/readme.md +++ b/readme.md @@ -36,12 +36,14 @@ sudo dpkg -i e50-v2-v1.0.20211208-v1.0.20210914.deb ## Config ER-X configure ## Wireguard - set interfaces wireguard wg0 address 10.255.1.2/30 + set interfaces wireguard wg0 address 10.255.1.2/24 + set interfaces wireguard wg0 address fd80:3ea2:e399:203a::2/64 set interfaces wireguard wg0 listen-port 51821 set interfaces wireguard wg0 route-allowed-ips false set interfaces wireguard wg0 persistent-keepalive 25 set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= endpoint 7.fftdf.de:42001 set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips 0.0.0.0/0 + set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips ::0/0 set interfaces wireguard wg0 private-key /config/auth/wg.key ## Firewall for Wireguard set firewall name WAN_LOCAL rule 20 action accept @@ -50,22 +52,27 @@ sudo dpkg -i e50-v2-v1.0.20211208-v1.0.20210914.deb set firewall name WAN_LOCAL rule 20 destination port 51821 set firewall group network-group LAN-VPN description 'Networks on LAN destined to go out VPN by default' set firewall group network-group LAN-VPN network 10.1.0.0/16 + set firewall group ipv6-network-group IPv6-VPN ipv6-network 2a03:2260:121:7001::/64 set firewall group network-group RFC1918 network 10.0.0.0/8 set firewall group network-group RFC1918 network 172.16.0.0/12 set firewall group network-group RFC1918 network 192.168.0.0/16 set firewall group network-group RFC1918 network 169.254.0.0/16 set protocols static table 2 route 0.0.0.0/0 next-hop 10.255.1.1 + set protocols static table 2 route6 ::/0 next-hop fd80:3ea2:e399:203a::1 set firewall modify VPN_TDF7 rule 100 action modify set firewall modify VPN_TDF7 rule 100 description 'Route traffic from group LAN-VPN through VPN-TDF7 table' set firewall modify VPN_TDF7 rule 100 modify table 2 set firewall modify VPN_TDF7 rule 100 source group network-group LAN-VPN - set interfaces ethernet eth2 firewall in modify VPN_TDF7 - set interfaces swtich switch0 firewall in modify VPN_TDF7 + set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 action modify + set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 description 'Route traffic from group IPv6-VPN through IPv6-VPN-TDF7 table' + set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 modify table 2 + set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 source group ipv6-network-group IPv6-VPN + set interfaces switch switch0 firewall in modify VPN_TDF7 + set interfaces switch switch0 firewall in modify IPv6-VPN_TDF7 ## NAT einrichten set service nat rule 5010 description 'masquerade for VPN' set service nat rule 5010 outbound-interface wg0 set service nat rule 5010 type masquerade set service nat rule 5010 protocol all - ## Speichern commit ; save