summaryrefslogtreecommitdiffstats
path: root/roles/gateway/README.md
diff options
context:
space:
mode:
authorAhmed AbdelHalim <[email protected]>2026-07-08 01:20:23 +0200
committerAhmed AbdelHalim <[email protected]>2026-07-08 01:20:23 +0200
commitd83303c627cdf632b0937277e7dede5eceea56a9 (patch)
tree548d6421659016173ba4c8d11146c17c66315fda /roles/gateway/README.md
parent28dad8e7184e131c434a935e70b40f400cece665 (diff)
Revert d3431c8 changes on gateway role
Diffstat (limited to 'roles/gateway/README.md')
-rw-r--r--roles/gateway/README.md21
1 files changed, 5 insertions, 16 deletions
diff --git a/roles/gateway/README.md b/roles/gateway/README.md
index d57ce6ff..cfbe49d3 100644
--- a/roles/gateway/README.md
+++ b/roles/gateway/README.md
@@ -23,28 +23,17 @@ IPv6 gateway is enabled by setting both `network_ipv6_address` and `gateway_loca
```yaml
network_ipv6_address: "2a02:xxxx:xxxx:xxxx::254/64" # Pi's IPv6 address
-gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet (advertised via radvd)
+gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet
```
-When `network_ipv6_address` is defined, the role:
-- Enables IPv6 forwarding (`net.ipv6.conf.all.forwarding=1`)
-- Sets `accept_ra=2` on `gateway_router_interface` so Pi keeps receiving RAs from the router while forwarding
-- Configures and starts `radvd` — Pi sends Router Advertisements to the LAN advertising itself as the IPv6 default gateway with `AdvDefaultPreference high`
-- Announces Pi-hole (Pi's IPv6) as RDNSS so all devices use it for DNS over IPv6
-
-This mirrors the IPv4 setup: all LAN devices (including phones) auto-configure Pi as their IPv6 gateway via SLAAC. No static configuration needed on clients.
-
-To disable IPv6 entirely, remove `network_ipv6_address` and `gateway_local_ipv6_subnet` from `host_vars`. The role will:
-- Omit `accept_ra` sysctl
-- Skip IPv6 iptables masquerade rules
-- Stop and disable radvd, remove its config
+To disable IPv6 entirely, remove both variables from `host_vars`. The role will:
+- Omit `accept_ra` sysctl (no IPv6 interface key written)
+- Skip IPv6 iptables masquerade rules (`gateway_local_ipv6_subnet` defaults to `""`)
- Leave `net.ipv6.conf.all.forwarding=0`
**Note:** `accept_ra` is set per-interface (`gateway_router_interface`) only when IPv6 is enabled.
This prevents rogue RA acceptance on WireGuard and LAN interfaces.
-**FritzBox:** Set RA priority to **Low** (Home Network → Network → IPv6 → Router advertisement → priority) so Pi's `high` priority RA wins. Pi becomes the sole IPv6 default gateway for all LAN devices.
-
## Network Architecture
```txt
@@ -81,7 +70,7 @@ Client Devices (192.168.1.0/24)
## Requirements
- **WireGuard Interfaces**: Must follow `wg*` naming pattern (`wg0`, `wg-us1`, etc.)
-- **Client Configuration**: IPv4 devices use Pi as gateway via Pi-hole DHCP; IPv6 devices auto-configure via radvd RAs
+- **Client Configuration**: Devices must use Pi as default gateway (192.168.1.254)
- **IP Forwarding**: Kernel IP forwarding must be enabled (`net.ipv4.ip_forward=1`)
- **WireGuard Config**: Use default routing (`Table=auto` or unset, NOT `Table=off`)