diff options
| author | Ahmed Abdelhalim <[email protected]> | 2026-07-09 15:38:15 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2026-07-09 15:38:15 +0200 |
| commit | d295dd0edcd61e094b7bd7ffe8ca3187d0a6da00 (patch) | |
| tree | cd51c94d0e2e99dd1442551d7d308ad89dc13ea2 | |
| parent | b8f25e9d80c96f7170d51eb5abcd662a66d55317 (diff) | |
Fix IPv6 direct mode routing for LAN clients
- Remove static network_ipv6_gateway from LAN hosts so they pick up
Pi's radvd RA (pref high) instead of FritzBox (pref low)
- Add missing ip6tables FORWARD ACCEPT rule for new connections in
direct mode (only ESTABLISHED was present, blocking new flows)
- Flush ip6tables nat POSTROUTING table on clear instead of fragile
per-rule -D deletion to prevent stale rule accumulation
| -rw-r--r-- | host_vars/desktop.local.yml | bin | 868 -> 818 bytes | |||
| -rw-r--r-- | host_vars/laptop.local.yml | bin | 899 -> 849 bytes | |||
| -rw-r--r-- | host_vars/macbook.local.yml | bin | 903 -> 853 bytes | |||
| -rw-r--r-- | host_vars/pve.local.yml | bin | 517 -> 467 bytes | |||
| -rw-r--r-- | roles/gateway/templates/gateway-apply-rules.sh.j2 | 4 |
5 files changed, 2 insertions, 2 deletions
diff --git a/host_vars/desktop.local.yml b/host_vars/desktop.local.yml Binary files differindex 7670b16c..9abcecf7 100644 --- a/host_vars/desktop.local.yml +++ b/host_vars/desktop.local.yml diff --git a/host_vars/laptop.local.yml b/host_vars/laptop.local.yml Binary files differindex d41000db..18eabeb7 100644 --- a/host_vars/laptop.local.yml +++ b/host_vars/laptop.local.yml diff --git a/host_vars/macbook.local.yml b/host_vars/macbook.local.yml Binary files differindex 84de35b2..0d1f1561 100644 --- a/host_vars/macbook.local.yml +++ b/host_vars/macbook.local.yml diff --git a/host_vars/pve.local.yml b/host_vars/pve.local.yml Binary files differindex cba94054..6b2e4ba1 100644 --- a/host_vars/pve.local.yml +++ b/host_vars/pve.local.yml diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2 index daddb180..0cbdd67a 100644 --- a/roles/gateway/templates/gateway-apply-rules.sh.j2 +++ b/roles/gateway/templates/gateway-apply-rules.sh.j2 @@ -27,8 +27,7 @@ clear_rules() { iptables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true if [ -n "$GATEWAY_SUBNET_V6" ]; then ip6tables -F FORWARD 2>/dev/null || true - ip6tables -t nat -D POSTROUTING -o wg+ -j MASQUERADE 2>/dev/null || true - ip6tables -t nat -D POSTROUTING -o "$GATEWAY_INTERFACE" -j MASQUERADE 2>/dev/null || true + ip6tables -t nat -F POSTROUTING 2>/dev/null || true ip6tables -D OUTPUT -o wg+ -j ACCEPT 2>/dev/null || true ip6tables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true fi @@ -59,6 +58,7 @@ apply_direct_rules() { if [ -n "$GATEWAY_SUBNET_V6" ]; then ip6tables -t nat -A POSTROUTING -o "$GATEWAY_INTERFACE" -j MASQUERADE ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT + ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT fi log_message "Direct mode rules applied - normal routing active" |