Fix wireguard_gateway role being slow

The pihole lookup DNS queries when the VPN connection is up was slow.
One of the culprits was the quad9 servers were taking long time when
using VPN
The other issue was the previous routing tables that used to work with
the fritzbox (with DHCP) which wasn't fully working was conflicting with
the VPN route tables and causing loops and delays.

Now most of the VPN queries are working fast but some requests are
taking some time, probably due to the VPN trying to check/block ads and
malware!

Also minor fixing to the pre tasks and documentation

4 files changed, 18 insertions, 33 deletions

diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2
index c083a214..cccffff1 100644
--- a/roles/network/templates/resolved.conf.j2
+++ b/roles/network/templates/resolved.conf.j2
@@ -1,6 +1,8 @@
 [Resolve]
-DNS=9.9.9.9 2620:fe::fe#quad9.net
-FallbackDNS=1.1.1.1 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8 2001:4860:4860::8888#dns.google
+# cloudflare-dns.com
+DNS=1.1.1.1 2606:4700:4700::1111
+# dns.google
+FallbackDNS=8.8.8.8 2001:4860:4860::8888
 DNSSEC=yes
 DNSOverTLS=yes
 # use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml
index 44744d98..7be113a4 100644
--- a/roles/pihole/defaults/main.yml
+++ b/roles/pihole/defaults/main.yml
@@ -2,9 +2,12 @@
 pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
 pihole_totp_secret: "CHANGEME"
 pihole_dns:
-  - "9.9.9.9"   # Quad9
-  - "1.1.1.1"   # Cloudflare
-  - "8.8.8.8"   # Google
+  # Cloudflare
+  - "1.1.1.1"
+  - "2606:4700:4700::1111"
+  # Google
+  - "8.8.8.8"
+  - "2001:4860:4860:0:0:0:0:8888"
 pihole_interface: "{{ ansible_default_ipv4.interface }}"
 pihole_dns_blocking_enabled: true
 pihole_dhcp_enabled: false
diff --git a/roles/pihole/meta/argument_specs.yml b/roles/pihole/meta/argument_specs.yml
index e7cf04e7..9af61251 100644
--- a/roles/pihole/meta/argument_specs.yml
+++ b/roles/pihole/meta/argument_specs.yml
@@ -15,9 +15,12 @@ argument_specs:
         description: "The list of DNS servers to use as upstreams"
         elements: "str"
         default:
-          - "9.9.9.9"   # Quad9
-          - "1.1.1.1"   # Cloudflare
-          - "8.8.8.8"   # Google
+          # Cloudflare
+          - "1.1.1.1"
+          - "2606:4700:4700::1111"
+          # Google
+          - "8.8.8.8"
+          - "2001:4860:4860:0:0:0:0:8888"
       pihole_interface:
         type: "str"
         description: "The interface to bind the pi-hole on"
@@ -38,9 +41,9 @@ argument_specs:
         type: "str"
         description: "The dhcp end address"
         default: "{{ ansible_default_ipv4.network }}.199"
-      pihole_dhcp_address:
+      pihole_dhcp_router:
         type: "str"
-        description: "The dhcp server address (local pihole address)"
+        description: "The dhcp server router (gateway) address"
         default: "{{ ansible_default_ipv4.address }}"
       pihole_dhcp_lease_time:
         type: "int"
diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml
index 2b82ff66..a4fb43d8 100644
--- a/roles/wireguard_gateway/tasks/main.yml
+++ b/roles/wireguard_gateway/tasks/main.yml
@@ -20,29 +20,6 @@
       net.ipv6.conf.all.forwarding=1
   notify: "Reload sysctl"
 
-- name: "Configure VPN gateway routing"
-  become: true
-  ansible.builtin.shell: |
-    {% if wireguard_gateway_enabled %}
-    # Add routes to custom table
-    ip route add default dev {{ wireguard_autostart_connection }} table 100 || true
-    ip -6 route add default dev {{ wireguard_autostart_connection }} table 100 || true
-    # Remove any incorrect policy routing rules first
-    ip -6 rule del iif {{ ansible_default_ipv6.interface }} table 100 || true
-    # Add correct policy routing rules
-    ip rule add iif {{ ansible_default_ipv4.interface }} table 100 priority 200 || true
-    ip -6 rule add iif {{ ansible_default_ipv4.interface }} table 100 priority 200 || true
-    {% else %}
-    # Remove policy routing rules
-    ip rule del iif {{ ansible_default_ipv4.interface }} table 100 || true
-    ip -6 rule del iif {{ ansible_default_ipv4.interface }} table 100 || true
-    # Remove routes from custom table
-    ip route del default dev {{ wireguard_autostart_connection }} table 100 || true
-    ip -6 route del default dev {{ wireguard_autostart_connection }} table 100 || true
-    {% endif %}
-  failed_when: false
-  changed_when: false
-
 # IPv4 iptables rules
 - name: "Add IPv4 NAT masquerading for traffic through VPN"
   become: true