From 534525e4cb6edafb402e46a090987aa6b7504ca8 Mon Sep 17 00:00:00 2001 From: Stefan Date: Mon, 17 Apr 2023 18:21:37 +0200 Subject: [PATCH 1/4] Changed Wireguard Routing setup; Default= Freifunk --- host_vars/vpn02/vars.yml | 5 +++++ hosts.yml | 2 +- roles/01-vpn-offloader-setup/tasks/main.yml | 16 ++++++++++++++- .../templates/netplan.j2 | 20 ++++++++++++++++++- roles/21-install-wireguard/files/postup.sh | 9 --------- roles/21-install-wireguard/tasks/main.yml | 10 ---------- .../21-install-wireguard/templates/wg.conf.j2 | 3 --- 7 files changed, 40 insertions(+), 25 deletions(-) delete mode 100644 roles/21-install-wireguard/files/postup.sh diff --git a/host_vars/vpn02/vars.yml b/host_vars/vpn02/vars.yml index d5044d9..45b646b 100644 --- a/host_vars/vpn02/vars.yml +++ b/host_vars/vpn02/vars.yml @@ -1,4 +1,9 @@ ansible_host: 5.9.220.115 +ansible_host_net: /29 +ansible_host_ipv6: 2a01:4f8:262:5112::102 +ansible_host_ipv6_net: /64 +ipv4_gateway: 5.9.220.112 +ipv6_gateway: 2a01:4f8:262:5112::3 ansible_port: 22 ansible_ssh_user: root ansible_python_interpreter: /usr/bin/python3 diff --git a/hosts.yml b/hosts.yml index 3a1510c..6221038 100644 --- a/hosts.yml +++ b/hosts.yml @@ -14,7 +14,7 @@ all: children: vpn_offloader_wireguard: hosts: - vpn01: + #vpn01: vpn02: freifunk_supernodes: hosts: diff --git a/roles/01-vpn-offloader-setup/tasks/main.yml b/roles/01-vpn-offloader-setup/tasks/main.yml index 4655d7a..89effeb 100644 --- a/roles/01-vpn-offloader-setup/tasks/main.yml +++ b/roles/01-vpn-offloader-setup/tasks/main.yml @@ -48,10 +48,24 @@ state: latest update_cache: yes +- name: Find all Netplan Files without of the freifunk file + find: + paths: /etc/netplan/ + file_type: file + excludes: + - "01-freifunk.yaml" + register: found_files + +- name: Delete files + file: + path: "{{ item.path }}" + state: absent + with_items: "{{ found_files['files'] }}" + - name: Copy Netplan Template for Internal Network ansible.builtin.template: src: netplan.j2 - dest: /etc/netplan/01-freifunk-internal.yaml + dest: /etc/netplan/01-freifunk.yaml owner: root group: root mode: 755 diff --git a/roles/01-vpn-offloader-setup/templates/netplan.j2 b/roles/01-vpn-offloader-setup/templates/netplan.j2 index 2195bf2..ace8cf8 100644 --- a/roles/01-vpn-offloader-setup/templates/netplan.j2 +++ b/roles/01-vpn-offloader-setup/templates/netplan.j2 @@ -1,5 +1,24 @@ network: ethernets: + ens18: + addresses: + - {{ ansible_host }}{{ ansible_host_net }} + - {{ ansible_host_ipv6 }}{{ ansible_host_ipv6_net }} + nameservers: + addresses: + - 1.1.1.1 + routes: + - to: default + via: {{ ipv4_gateway }} + table: 88 + - to: default + via: {{ ipv6_gateway }} + table: 88 + routing-policy: + - from: {{ ansible_host }} + table: 88 + - from: {{ ansible_host_ipv6 }} + table: 88 ens19: dhcp4: false addresses: @@ -10,5 +29,4 @@ network: routes: - to: default via: {{ core_router }} - table: 42 version: 2 \ No newline at end of file diff --git a/roles/21-install-wireguard/files/postup.sh b/roles/21-install-wireguard/files/postup.sh deleted file mode 100644 index 71d58cf..0000000 --- a/roles/21-install-wireguard/files/postup.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/sh - -ip rule add fwmark 0x4 table 42 -iptables -t mangle -A PREROUTING -s 10.255.0.0/16 ! -d 10.0.0.0/8 -j MARK --set-mark 4 -routeExists=$(ip route show table 42 | grep '172.16.7.1') - -if [ -z "$routeExists" ]; then - ip route add default via 172.16.7.1 table 42 -fi diff --git a/roles/21-install-wireguard/tasks/main.yml b/roles/21-install-wireguard/tasks/main.yml index 3924653..ec668f9 100644 --- a/roles/21-install-wireguard/tasks/main.yml +++ b/roles/21-install-wireguard/tasks/main.yml @@ -84,16 +84,6 @@ notify: - reconfigure wireguard -- name: Copy PostUp Script - ansible.builtin.copy: - src: postup.sh - dest: /etc/wireguard/postup.sh - mode: 755 - tags: - - wg-config - notify: - - reconfigure wireguard - - name: Start and enable WireGuard service ansible.builtin.service: name: "wg-quick@vpn01" diff --git a/roles/21-install-wireguard/templates/wg.conf.j2 b/roles/21-install-wireguard/templates/wg.conf.j2 index 68e57e5..60bc852 100644 --- a/roles/21-install-wireguard/templates/wg.conf.j2 +++ b/roles/21-install-wireguard/templates/wg.conf.j2 @@ -9,9 +9,6 @@ PrivateKey = {{ wireguard_private_key }} ListenPort = {{ wireguard_port }} MTU = 1380 -PostUp = /etc/wireguard/postup.sh -PostDown = ip route del default via 172.16.7.1 table 42 - {% if wireguard_unmanaged_peers is defined %} # Peers not managed by Ansible from "wireguard_unmanaged_peers" variable From 460c5978ac00c8e2691e6f6281b178a507934ca7 Mon Sep 17 00:00:00 2001 From: Stefan Date: Mon, 17 Apr 2023 18:26:33 +0200 Subject: [PATCH 2/4] routing table 88 zu 42 --- roles/01-vpn-offloader-setup/templates/netplan.j2 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/01-vpn-offloader-setup/templates/netplan.j2 b/roles/01-vpn-offloader-setup/templates/netplan.j2 index ace8cf8..de5e2c8 100644 --- a/roles/01-vpn-offloader-setup/templates/netplan.j2 +++ b/roles/01-vpn-offloader-setup/templates/netplan.j2 @@ -10,15 +10,15 @@ network: routes: - to: default via: {{ ipv4_gateway }} - table: 88 + table: 42 - to: default via: {{ ipv6_gateway }} - table: 88 + table: 42 routing-policy: - from: {{ ansible_host }} - table: 88 + table: 42 - from: {{ ansible_host_ipv6 }} - table: 88 + table: 42 ens19: dhcp4: false addresses: From b2d61acaf7939306d89b3232bf2335145f33b390 Mon Sep 17 00:00:00 2001 From: Stefan Date: Mon, 17 Apr 2023 21:14:21 +0200 Subject: [PATCH 3/4] enable vpn01 --- hosts.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts.yml b/hosts.yml index 6221038..3a1510c 100644 --- a/hosts.yml +++ b/hosts.yml @@ -14,7 +14,7 @@ all: children: vpn_offloader_wireguard: hosts: - #vpn01: + vpn01: vpn02: freifunk_supernodes: hosts: From 1361b9320c80b137f9a410216cbe4ad643e34621 Mon Sep 17 00:00:00 2001 From: Stefan Date: Mon, 17 Apr 2023 21:15:40 +0200 Subject: [PATCH 4/4] Add new host_vars for vpn01 --- host_vars/vpn01/vars.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/host_vars/vpn01/vars.yml b/host_vars/vpn01/vars.yml index 78a86bc..b45c3b2 100644 --- a/host_vars/vpn01/vars.yml +++ b/host_vars/vpn01/vars.yml @@ -2,6 +2,11 @@ ### Ansible ### ansible_host: 5.9.220.114 +ansible_host_net: /29 +ansible_host_ipv6: 2a01:4f8:262:5112::101 +ansible_host_ipv6_net: /64 +ipv4_gateway: 5.9.220.112 +ipv6_gateway: 2a01:4f8:262:5112::3 ansible_port: 22 ansible_ssh_user: root ansible_python_interpreter: /usr/bin/python3