diff options
| -rw-r--r-- | roles/gateway/defaults/main.yml | 1 | ||||
| -rw-r--r-- | roles/gateway/meta/argument_specs.yml | 5 | ||||
| -rw-r--r-- | roles/gateway/templates/gateway-apply-rules.sh.j2 | 34 |
3 files changed, 33 insertions, 7 deletions
diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml index ebe33a12..dad64685 100644 --- a/roles/gateway/defaults/main.yml +++ b/roles/gateway/defaults/main.yml @@ -1,3 +1,4 @@ --- gateway_enabled: false gateway_router_interface: "eth0" +gateway_local_ipv6_subnet: "" diff --git a/roles/gateway/meta/argument_specs.yml b/roles/gateway/meta/argument_specs.yml index e5d14e35..4ee6ddb6 100644 --- a/roles/gateway/meta/argument_specs.yml +++ b/roles/gateway/meta/argument_specs.yml @@ -13,6 +13,11 @@ argument_specs: description: "Local subnet CIDR for NAT and routing rules (e.g., '192.168.178.0/24')" type: "str" required: true + gateway_local_ipv6_subnet: + description: "Local IPv6 subnet CIDR for NAT and routing rules (e.g., '2a02:3102:4ced:ec00::/64')" + type: "str" + required: false + default: "" gateway_router_interface: description: "Default route interface for direct routing mode" type: "str" diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2 index d79f2279..2e6bfb70 100644 --- a/roles/gateway/templates/gateway-apply-rules.sh.j2 +++ b/roles/gateway/templates/gateway-apply-rules.sh.j2 @@ -6,7 +6,8 @@ SCRIPT_NAME="gateway-apply-rules" LOG_FACILITY="local0.info" # Ansible template variables - configured at deployment time -GATEWAY_SUBNET="{{ gateway_local_ipv4_subnet }}" +GATEWAY_SUBNET_V4="{{ gateway_local_ipv4_subnet }}" +GATEWAY_SUBNET_V6="{{ gateway_local_ipv6_subnet }}" GATEWAY_INTERFACE="{{ gateway_router_interface }}" log_message() { echo "[$SCRIPT_NAME] $1" | logger -t "$SCRIPT_NAME" -p "$LOG_FACILITY" @@ -20,28 +21,47 @@ detect_vpn_interfaces() { clear_rules() { log_message "Clearing existing gateway rules" iptables -F FORWARD 2>/dev/null || true - iptables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET" -o wg+ -j MASQUERADE 2>/dev/null || true - iptables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET" -o "$GATEWAY_INTERFACE" -j MASQUERADE 2>/dev/null || true + iptables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET_V4" -o wg+ -j MASQUERADE 2>/dev/null || true + iptables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j MASQUERADE 2>/dev/null || true iptables -D OUTPUT -o wg+ -j ACCEPT 2>/dev/null || true iptables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true + if [ -n "$GATEWAY_SUBNET_V6" ]; then + ip6tables -F FORWARD 2>/dev/null || true + ip6tables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET_V6" -o wg+ -j MASQUERADE 2>/dev/null || true + ip6tables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j MASQUERADE 2>/dev/null || true + ip6tables -D OUTPUT -o wg+ -j ACCEPT 2>/dev/null || true + ip6tables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true + fi } apply_vpn_mode() { local vpn_interfaces="$1" log_message "Applying VPN mode rules for interfaces: $vpn_interfaces" - iptables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET" -o wg+ -j MASQUERADE + iptables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V4" -o wg+ -j MASQUERADE iptables -A OUTPUT -o wg+ -j ACCEPT - iptables -A FORWARD -s "$GATEWAY_SUBNET" -o wg+ -j ACCEPT + iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o wg+ -j ACCEPT iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + if [ -n "$GATEWAY_SUBNET_V6" ]; then + ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o wg+ -j MASQUERADE + ip6tables -A OUTPUT -o wg+ -j ACCEPT + ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o wg+ -j ACCEPT + ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + fi log_message "VPN mode rules applied - traffic routed through VPN" } apply_direct_rules() { log_message "Applying direct mode rules" - iptables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET" -o "$GATEWAY_INTERFACE" -j MASQUERADE + iptables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j MASQUERADE iptables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT - iptables -A FORWARD -s "$GATEWAY_SUBNET" -o "$GATEWAY_INTERFACE" -j ACCEPT + iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j ACCEPT iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + if [ -n "$GATEWAY_SUBNET_V6" ]; then + ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j MASQUERADE + ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT + ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j ACCEPT + ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + fi log_message "Direct mode rules applied - normal routing active" } |