diff options
| -rw-r--r-- | roles/gateway/README.md | 21 | ||||
| -rw-r--r-- | roles/gateway/handlers/main.yml | 6 | ||||
| -rw-r--r-- | roles/gateway/tasks/main.yml | 38 | ||||
| -rw-r--r-- | roles/gateway/templates/radvd.conf.j2 | 15 | ||||
| -rw-r--r-- | roles/pihole/README.md | 8 |
5 files changed, 76 insertions, 12 deletions
diff --git a/roles/gateway/README.md b/roles/gateway/README.md index cfbe49d3..d57ce6ff 100644 --- a/roles/gateway/README.md +++ b/roles/gateway/README.md @@ -23,17 +23,28 @@ IPv6 gateway is enabled by setting both `network_ipv6_address` and `gateway_loca ```yaml network_ipv6_address: "2a02:xxxx:xxxx:xxxx::254/64" # Pi's IPv6 address -gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet +gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet (advertised via radvd) ``` -To disable IPv6 entirely, remove both variables from `host_vars`. The role will: -- Omit `accept_ra` sysctl (no IPv6 interface key written) -- Skip IPv6 iptables masquerade rules (`gateway_local_ipv6_subnet` defaults to `""`) +When `network_ipv6_address` is defined, the role: +- Enables IPv6 forwarding (`net.ipv6.conf.all.forwarding=1`) +- Sets `accept_ra=2` on `gateway_router_interface` so Pi keeps receiving RAs from the router while forwarding +- Configures and starts `radvd` — Pi sends Router Advertisements to the LAN advertising itself as the IPv6 default gateway with `AdvDefaultPreference high` +- Announces Pi-hole (Pi's IPv6) as RDNSS so all devices use it for DNS over IPv6 + +This mirrors the IPv4 setup: all LAN devices (including phones) auto-configure Pi as their IPv6 gateway via SLAAC. No static configuration needed on clients. + +To disable IPv6 entirely, remove `network_ipv6_address` and `gateway_local_ipv6_subnet` from `host_vars`. The role will: +- Omit `accept_ra` sysctl +- Skip IPv6 iptables masquerade rules +- Stop and disable radvd, remove its config - Leave `net.ipv6.conf.all.forwarding=0` **Note:** `accept_ra` is set per-interface (`gateway_router_interface`) only when IPv6 is enabled. This prevents rogue RA acceptance on WireGuard and LAN interfaces. +**FritzBox:** Set RA priority to **Low** (Home Network → Network → IPv6 → Router advertisement → priority) so Pi's `high` priority RA wins. Pi becomes the sole IPv6 default gateway for all LAN devices. + ## Network Architecture ```txt @@ -70,7 +81,7 @@ Client Devices (192.168.1.0/24) ## Requirements - **WireGuard Interfaces**: Must follow `wg*` naming pattern (`wg0`, `wg-us1`, etc.) -- **Client Configuration**: Devices must use Pi as default gateway (192.168.1.254) +- **Client Configuration**: IPv4 devices use Pi as gateway via Pi-hole DHCP; IPv6 devices auto-configure via radvd RAs - **IP Forwarding**: Kernel IP forwarding must be enabled (`net.ipv4.ip_forward=1`) - **WireGuard Config**: Use default routing (`Table=auto` or unset, NOT `Table=off`) diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml index 35cc489c..2220f965 100644 --- a/roles/gateway/handlers/main.yml +++ b/roles/gateway/handlers/main.yml @@ -15,3 +15,9 @@ ansible.builtin.command: cmd: "udevadm control --reload-rules" changed_when: false + +- name: "Restart radvd" + become: true + ansible.builtin.systemd_service: + name: "radvd.service" + state: "restarted" diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml index f4826a72..6684bb9a 100644 --- a/roles/gateway/tasks/main.yml +++ b/roles/gateway/tasks/main.yml @@ -1,11 +1,12 @@ --- -- name: "Ensure iptables and iproute2 are installed" +- name: "Ensure gateway packages are installed" become: true ansible.builtin.package: name: - "iptables" - "iproute2" - "udev" + - "radvd" state: "present" - name: "Configure IP forwarding" @@ -67,3 +68,38 @@ name: "gateway-init.service" enabled: "{{ gateway_enabled }}" daemon_reload: true + +- name: "Configure radvd for IPv6 gateway" + become: true + when: network_ipv6_address is defined + block: + - name: "Configure radvd" + ansible.builtin.template: + src: "radvd.conf.j2" + dest: "/etc/radvd.conf" + owner: "root" + group: "root" + mode: "0644" + notify: "Restart radvd" + + - name: "Enable radvd service" + ansible.builtin.systemd_service: + name: "radvd.service" + enabled: true + state: "started" + daemon_reload: true + +- name: "Disable radvd (no IPv6)" + become: true + when: network_ipv6_address is not defined + block: + - name: "Disable radvd service" + ansible.builtin.systemd_service: + name: "radvd.service" + enabled: false + state: "stopped" + + - name: "Remove radvd config" + ansible.builtin.file: + path: "/etc/radvd.conf" + state: "absent" diff --git a/roles/gateway/templates/radvd.conf.j2 b/roles/gateway/templates/radvd.conf.j2 new file mode 100644 index 00000000..9aac075d --- /dev/null +++ b/roles/gateway/templates/radvd.conf.j2 @@ -0,0 +1,15 @@ +interface {{ gateway_router_interface }} { + AdvSendAdvert on; + AdvManagedFlag off; + AdvOtherConfigFlag on; + AdvDefaultPreference high; + + prefix {{ gateway_local_ipv6_subnet }} { + AdvOnLink on; + AdvAutonomous on; + AdvRouterAddr on; + }; + + RDNSS {{ network_ipv6_address.split('/')[0] }} { + }; +}; diff --git a/roles/pihole/README.md b/roles/pihole/README.md index 319424a7..26ce2d4e 100644 --- a/roles/pihole/README.md +++ b/roles/pihole/README.md @@ -17,7 +17,7 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol ### [FRITZ!Box](https://docs.pi-hole.net/routers/fritzbox/) - Home Network > Network > Network Settings > Change Advanced Network Settings > IPv4 > - - Home network > + - Home network > - IPv4 address > {{ router_ipv4 }} - Subnet mask > {{ router_subnet_mask }} - DHCP > Enable DHCP server > ❌ @@ -48,11 +48,7 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol #### With IPv6 Support - Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 > - - Router advertisement enable in the LAN > ✅ - - Always assign unique local addresses (ULA) > ❌ - - Allow IPv6 prefixes announced by other IPv6 routers in the home network > ❌ - - This FRITZ!Box provides the standard internet connection > ✅ - - Set the priority of the router advertisement > High + - Router advertisement enable in the LAN > ❌ - DNSv6 Server in the Home Network > - Also announce DNSv6 server via router advertisement (RFC5006) > ✅ - Local DNSv6 server > {{ pihole_ipv6 }} |