Freifunk-Troisdorf/ansible.fftdf.supernode

Go to file

Stefan 8fa6933c15 Changed gitignore to config files		2023-03-24 19:31:28 +01:00
edgerouter_configs	Added config for Edge Router	2023-03-12 21:40:59 +01:00
host_vars	Added config for Edge Router	2023-03-12 21:40:59 +01:00
roles	Changed MTU	2023-03-12 21:58:53 +01:00
.DS_Store	Toller Commit	2023-02-06 23:13:32 +01:00
.gitignore	Changed gitignore to config files	2023-03-24 19:31:28 +01:00
conf.conf	Keine ahnung	2023-03-04 14:56:15 +01:00
definition.md	NEtwork definition	2023-03-04 11:52:46 +01:00
edge1.md	Added config for Edge Router	2023-03-12 21:40:59 +01:00
er-test.yml	Added config for Edge Router	2023-03-12 21:40:59 +01:00
hosts.yml	Added config for Edge Router	2023-03-12 21:40:59 +01:00
readme.md	Toller Commit	2023-02-06 23:13:32 +01:00
system-setup.yml	bugfixing indent	2023-02-26 10:52:43 +01:00
update_wg.yml	IPv6 config	2023-03-02 20:25:22 +01:00
vpn01.md	Toller Commit	2023-02-06 23:13:32 +01:00
vpn02.md	Toller Commit	2023-02-06 23:13:32 +01:00
vpn03.md	Toller Commit	2023-02-06 23:13:32 +01:00
vyos_config.yml	vyos config	2023-03-05 22:15:59 +01:00

readme.md

Supernode mit direkter VPN Ausleitung

Ausleitung über das FFRL Backbone. Supernode Config:

GRE-Tunnel zum FFRL Backbone
VPN per Wireguard
NAT auf VPN Routern

Adressbereiche:

Supernode: 10.255.1.1/32

VPN01: 10.255.1.2/32, Client: 10.1.0.0/16 VPN02: 10.255.1.3/32, Client: 10.2.0.0/16 VPN03: 10.255.1.4/32, Client: 10.3.0.0/16 etc.

ER-X Stock Firmware Config:

Vor der Installation:

eth0 als DHCP Client

eth1-4 auf den Switch

Switch mit DHCP Server einrichten. Adressbereich aus Tabelle beachten!

Install Wireguard

cd /tmp curl -OL https://github.com/WireGuard/wireguard-vyatta-ubnt/releases/download/1.0.20211208-1/e50-v2-v1.0.20211208-v1.0.20210914.deb sudo dpkg -i e50-v2-v1.0.20211208-v1.0.20210914.deb

Generate Keys

cd /config/auth
wg genkey | tee /config/auth/wg.key | wg pubkey >  wg.public
cat wg.public
cat wg.key

Config ER-X

configure

Wireguard

set interfaces wireguard wg0 address 10.255.1.2/24
set interfaces wireguard wg0 address fd80:3ea2:e399:203a::2/64
set interfaces wireguard wg0 listen-port 51821
set interfaces wireguard wg0 route-allowed-ips false
set interfaces wireguard wg0 persistent-keepalive 25
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= endpoint 7.fftdf.de:42001
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips 0.0.0.0/0
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips ::0/0
set interfaces wireguard wg0 private-key /config/auth/wg.key

Firewall for Wireguard

set firewall name WAN_LOCAL rule 20 action accept
set firewall name WAN_LOCAL rule 20 protocol udp
set firewall name WAN_LOCAL rule 20 description 'WireGuard'
set firewall name WAN_LOCAL rule 20 destination port 51821
set firewall group network-group LAN-VPN description 'Networks on LAN destined to go out VPN by default'
set firewall group network-group LAN-VPN network 10.1.0.0/16
set firewall group network-group RFC1918 network 10.0.0.0/8
set firewall group network-group RFC1918 network 172.16.0.0/12
set firewall group network-group RFC1918 network 192.168.0.0/16
set firewall group network-group RFC1918 network 169.254.0.0/16
set protocols static table 2 route 0.0.0.0/0 next-hop 10.255.1.1
set firewall modify VPN_TDF7 rule 100 action modify
set firewall modify VPN_TDF7 rule 100 description 'Route traffic from group LAN-VPN through VPN-TDF7 table'
set firewall modify VPN_TDF7 rule 100 modify table 2
set firewall modify VPN_TDF7 rule 100 source group network-group LAN-VPN
set interfaces switch switch0 firewall in modify VPN_TDF7

NAT einrichten

set service nat rule 5010 description 'masquerade for VPN'
set service nat rule 5010 outbound-interface wg0
set service nat rule 5010 type masquerade
set service nat rule 5010 protocol all

Speichern

commit ; save