diff options
| -rw-r--r-- | host_vars/rpi5.local.yml | bin | 3281 -> 3654 bytes | |||
| -rw-r--r-- | host_vars/rpi5.local.yml.example | 3 | ||||
| -rw-r--r-- | roles/gateway/templates/gateway-apply-rules.sh.j2 | 2 | ||||
| -rw-r--r-- | roles/pihole/README.md | 21 |
4 files changed, 14 insertions, 12 deletions
diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml Binary files differindex 0df665c9..109b4ad5 100644 --- a/host_vars/rpi5.local.yml +++ b/host_vars/rpi5.local.yml diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index 9e310e50..f93bc08e 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -2,6 +2,8 @@ network_interface: "eth0" network_ipv4_address: "10.0.0.254" network_ipv4_gateway: "10.0.0.1" +network_ipv6_address: "2a02:0000:0000:0000::254/64" +network_ipv6_gateway: "fe00::0000:0000:0000:0001" pihole_hostname: "dns.home.arpa" wg_portal_hostname: "vpn.home.arpa" @@ -43,6 +45,7 @@ wireguard_connections: gateway_enabled: true gateway_router_interface: "{{ network_interface }}" gateway_local_ipv4_subnet: "10.0.0.0/24" +gateway_local_ipv6_subnet: "2a02:0000:0000:0000::/64" prometheus_host: "localhost" prometheus_port: 9090 diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2 index 2e6bfb70..715f6b34 100644 --- a/roles/gateway/templates/gateway-apply-rules.sh.j2 +++ b/roles/gateway/templates/gateway-apply-rules.sh.j2 @@ -57,7 +57,7 @@ apply_direct_rules() { iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j ACCEPT iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT if [ -n "$GATEWAY_SUBNET_V6" ]; then - ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j MASQUERADE + # No MASQUERADE for IPv6: LAN devices have public SLAAC addresses, native routing applies ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT diff --git a/roles/pihole/README.md b/roles/pihole/README.md index 225fa8f9..8324da0e 100644 --- a/roles/pihole/README.md +++ b/roles/pihole/README.md @@ -51,18 +51,17 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol > router. Pi can only act as IPv6 gateway for wired hosts with static `network_ipv6_gateway` config. > radvd is deployed by the `gateway` role when `network_ipv6_address` is defined on the Pi. +- Internet > Account Information > + - IPv6 > IPv6 Support > ✅ + - IPv6 > IPv6 Connectivity > Native IPv4 connection > Use IPv6 via landline connection oor Mobile network > ✅ + - IPv6 > Connection Settings > Use DHCPv6 Rapid Commit > ❌ + - IPv6 > Connection Settings > Require certain length of the LAN prefix > ❌ + - DNS Server > DNSv6 Server > Use Other DNSv6 Servers > {{ pihole_ipv6 }} + - Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 > - Router advertisement enable in the LAN > ❌ - DNSv6 Server in the Home Network > - - Also announce DNSv6 server via router advertisement (RFC5006) > ✅ - - Local DNSv6 server > {{ pihole_ipv6 }} + - Also announce DNSv6 server via router advertisement (RFC5006) > ❌ - DHCPv6 Server in the home network > - - Enable DHCPv6 server in the FRITZ!Box for the home network > ✅ - - Only assign DNS server > ✅ - -- Internet > Account Information > - - IPv6 > IPv6 Support > ✅ - - IPv6 > IPv6 Connectivity > Native IPv6 connection - - IPv6 > Connection Settings > Automatically negotiate a global address - - IPv6 > Connection Settings > Use DHCPv6 Rapid Commit > ✅ - - DNS Server > DNSv6 Server > Use Other DNSv6 Servers > {{ pihole_ipv6 }} + - Disable DHCPv6 server in the FRITZ!Box for the home network > ✅ + - There are no other DHCPv6 servers in the home network. > ✅ |