Route IPv6 through WireGuard VPN via radvd and static gateway

Add radvd to gateway role to advertise Pi as high-preference IPv6
default router using the stable ULA prefix (fd1e:.../64). With
FritzBox also sending RAs, devices end up with ECMP between Pi and
FritzBox. To solve this, add network_ipv6_gateway (Pi's link-local)
as a static route with metric 100 to all managed hosts — beats RA
metric 425, ensuring all IPv6 default traffic goes through Pi.

Fix IPv6 MASQUERADE in gateway-apply-rules:
- Direct mode: add MASQUERADE on end0 (LAN devices use ULA source
  addresses not known to FritzBox, so Pi must NAT them)
- FORWARD rules: restrict to RELATED,ESTABLISHED only — previously
  the broad ACCEPT rule passed un-NAT'd packets alongside masqueraded
  copies, causing duplicate SYNs, conntrack corruption, and RSTs
- MASQUERADE/clear rules: match by interface not by source subnet
  (devices may use any source address, not just the ULA prefix)
- VPN mode return traffic: explicitly restrict to wg+→end0 direction

Add network_ipv6_gateway var (optional) to network role NM templates
(ethernet, wifi, bridge) — injects a static IPv6 default route at
metric 100 when set. Add rpi5 static route to FritzBox link-local so
Pi keeps IPv6 after FritzBox RA is disabled.

Force SSH to IPv4 for *.local hosts (AddressFamily inet) — prevents
Ansible from hanging on mDNS returning multiple IPv6 addresses.

Update gateway and pihole READMEs with two-step IPv6 setup process.

Co-Authored-By: Claude.ai

10 files changed, 13 insertions, 0 deletions

diff --git a/host_vars/desktop.local.yml b/host_vars/desktop.local.yml
index 9abcecf7..7670b16c 100644
--- a/host_vars/desktop.local.yml
+++ b/host_vars/desktop.local.yml
diff --git a/host_vars/desktop.local.yml.example b/host_vars/desktop.local.yml.example
index 4f572cb9..7017c6de 100644
--- a/host_vars/desktop.local.yml.example
+++ b/host_vars/desktop.local.yml.example
@@ -3,6 +3,8 @@
 network_ipv4_address: "10.0.0.201"
 network_ipv4_gateway: "10.0.0.254"
 network_ipv4_dns: "10.0.0.254"
+# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA)
+# network_ipv6_gateway: "fe80::0000:1111:2222:3333"
 
 go_versions:
   - "latest"
diff --git a/host_vars/laptop.local.yml b/host_vars/laptop.local.yml
index 18eabeb7..d41000db 100644
--- a/host_vars/laptop.local.yml
+++ b/host_vars/laptop.local.yml
diff --git a/host_vars/laptop.local.yml.example b/host_vars/laptop.local.yml.example
index 9cb955be..ea11d74e 100644
--- a/host_vars/laptop.local.yml.example
+++ b/host_vars/laptop.local.yml.example
@@ -3,6 +3,8 @@
 network_ipv4_address: "10.0.0.202"
 network_ipv4_gateway: "10.0.0.1"
 network_ipv4_dns: "10.0.0.1"
+# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA)
+# network_ipv6_gateway: "fe80::0000:1111:2222:3333"
 
 python_versions:
   - "3.13.7"
diff --git a/host_vars/macbook.local.yml b/host_vars/macbook.local.yml
index 0d1f1561..84de35b2 100644
--- a/host_vars/macbook.local.yml
+++ b/host_vars/macbook.local.yml
diff --git a/host_vars/macbook.local.yml.example b/host_vars/macbook.local.yml.example
index daf29e30..8e2586ca 100644
--- a/host_vars/macbook.local.yml.example
+++ b/host_vars/macbook.local.yml.example
@@ -3,6 +3,8 @@
 network_ipv4_address: "10.0.0.203"
 network_ipv4_gateway: "10.0.0.254"
 network_ipv4_dns: "10.0.0.254"
+# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA)
+# network_ipv6_gateway: "fe80::0000:1111:2222:3333"
 
 go_versions:
   - "latest"
diff --git a/host_vars/pve.local.yml b/host_vars/pve.local.yml
index f9640566..cba94054 100644
--- a/host_vars/pve.local.yml
+++ b/host_vars/pve.local.yml
diff --git a/host_vars/pve.local.yml.example b/host_vars/pve.local.yml.example
index 0a4a5ceb..88a60b5a 100644
--- a/host_vars/pve.local.yml.example
+++ b/host_vars/pve.local.yml.example
@@ -1,8 +1,13 @@
 ---
+# Disable wifi connection on PVE, it's connected with LAN
+network_wifi_ssid: ""
+network_wifi_pass: ""
 network_ipv4_address: "10.0.0.253"
 network_ipv4_gateway: "10.0.0.254"
 network_ipv4_dns: "10.0.0.254"
 network_bridge_interface: "eth0"
+# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA)
+# network_ipv6_gateway: "fe80::0000:1111:2222:3333"
 
 pve_admin_user: "admin"
 pve_admin_password: "changeme"
diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml
index 69941ec8..27388c7d 100644
--- a/host_vars/rpi5.local.yml
+++ b/host_vars/rpi5.local.yml
diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index f68e1ff0..281bc3a3 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -2,6 +2,8 @@
 network_interface: "eth0"
 network_ipv4_address: "10.0.0.254"
 network_ipv4_gateway: "10.0.0.1"
+# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA)
+# network_ipv6_gateway: "fe80::0000:1111:2222:3333"
 
 pihole_hostname: "dns.home.arpa"
 wg_portal_hostname: "vpn.home.arpa"