diff options
| -rw-r--r-- | group_vars/all.yml | bin | 1605 -> 1601 bytes | |||
| -rw-r--r-- | host_vars/rpi5.local.yml | bin | 717 -> 718 bytes | |||
| -rw-r--r-- | host_vars/rpi5.local.yml.example | 2 | ||||
| -rw-r--r-- | host_vars/ubuntu.local.yml | bin | 528 -> 203 bytes | |||
| -rw-r--r-- | molecule/default/converge.yml | 2 | ||||
| -rw-r--r-- | roles/gateway/README.md (renamed from roles/wireguard_gateway/README.md) | 20 | ||||
| -rw-r--r-- | roles/gateway/defaults/main.yml | 2 | ||||
| -rw-r--r-- | roles/gateway/handlers/main.yml (renamed from roles/wireguard_gateway/handlers/main.yml) | 0 | ||||
| -rw-r--r-- | roles/gateway/meta/argument_specs.yml (renamed from roles/wireguard_gateway/meta/argument_specs.yml) | 4 | ||||
| -rw-r--r-- | roles/gateway/meta/main.yml (renamed from roles/wireguard_gateway/meta/main.yml) | 0 | ||||
| -rw-r--r-- | roles/gateway/tasks/main.yml (renamed from roles/wireguard_gateway/tasks/main.yml) | 16 | ||||
| -rw-r--r-- | roles/wireguard_gateway/defaults/main.yml | 2 | ||||
| -rw-r--r-- | site.yml | 2 |
13 files changed, 25 insertions, 25 deletions
diff --git a/group_vars/all.yml b/group_vars/all.yml Binary files differindex 9260503e..711e9028 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml Binary files differindex 80e6dc4d..4a1dcc5c 100644 --- a/host_vars/rpi5.local.yml +++ b/host_vars/rpi5.local.yml diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index 1fc19dd1..435307ca 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -16,7 +16,7 @@ pihole_dhcp_hosts: - "ff:ff:ff:ff:ff:fe, 10.0.0.252,TV" - "ff:ff:ff:ff:ff:ff, 10.0.0.253,Printer" -wireguard_gateway_enabled: true +gateway_enabled: true wireguard_autostart_connection: "protonvpn-us-1" wireguard_connections: protonvpn-us-1: | diff --git a/host_vars/ubuntu.local.yml b/host_vars/ubuntu.local.yml Binary files differindex 8fc0e6f0..4b3a00d2 100644 --- a/host_vars/ubuntu.local.yml +++ b/host_vars/ubuntu.local.yml diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index 039fc920..36eead7b 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -44,7 +44,7 @@ - role: "docker" - role: "podman" - role: "wireguard" - - role: "wireguard_gateway" + - role: "gateway" - role: "pihole" when: - lookup('ansible.builtin.env', 'MOLECULE_DISTRO') == 'ubuntu' or diff --git a/roles/wireguard_gateway/README.md b/roles/gateway/README.md index 06c3ceb7..54c45430 100644 --- a/roles/wireguard_gateway/README.md +++ b/roles/gateway/README.md @@ -1,22 +1,22 @@ -# Ansible Role: wireguard_gateway +# Ansible Role: gateway -This role configures a Linux host as a WireGuard VPN gateway, -routing all traffic from local network clients through the VPN connection. +This role configures a Linux host as a gateway, +routing all traffic from local network clients through. ## Role Variables -- `wireguard_gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`) +- `gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`) ## What This Role Does -When `wireguard_gateway_enabled` is `true`, the role: +When `gateway_enabled` is `true`, the role: - Sets `net.ipv4.ip_forward=1` and `net.ipv6.conf.all.forwarding=1` in `/etc/sysctl.conf` - Creates custom routing table (100) to route traffic through VPN - Routes IPv4 and IPv6 traffic from local subnet through VPN interface - Allows traffic forwarding and established connections -When `wireguard_gateway_enabled` is `false`, the role: +When `gateway_enabled` is `false`, the role: - Removes all routing rules and iptables configurations - Disables IP forwarding in sysctl configuration @@ -25,13 +25,13 @@ When `wireguard_gateway_enabled` is `false`, the role: ## Example Configuration ```yaml -# In host_vars/gateway.yml -wireguard_gateway_enabled: true -wireguard_autostart_connection: "protonvpn-us-1" +# In host_vars/rpi5.local.yml +gateway_enabled: true +wireguard_autostart_connection: "protonvpn-us1" # WireGuard connection configuration wireguard_connections: - protonvpn-us-1: | + protonvpn-us1: | [Interface] PrivateKey = your_private_key_here Address = 10.2.0.2/32 diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml new file mode 100644 index 00000000..8cddb272 --- /dev/null +++ b/roles/gateway/defaults/main.yml @@ -0,0 +1,2 @@ +--- +gateway_enabled: false diff --git a/roles/wireguard_gateway/handlers/main.yml b/roles/gateway/handlers/main.yml index 4b7cb2f2..4b7cb2f2 100644 --- a/roles/wireguard_gateway/handlers/main.yml +++ b/roles/gateway/handlers/main.yml diff --git a/roles/wireguard_gateway/meta/argument_specs.yml b/roles/gateway/meta/argument_specs.yml index 23f755b9..d6520641 100644 --- a/roles/wireguard_gateway/meta/argument_specs.yml +++ b/roles/gateway/meta/argument_specs.yml @@ -1,10 +1,10 @@ --- argument_specs: main: - description: "Configure WireGuard VPN as a network gateway" + description: "Configure the PI as a network gateway forcing all traffic through it (or through active VPN on it)" author: "a14m" options: - wireguard_gateway_enabled: + gateway_enabled: description: "Toggle flag for enabling/disabling network gateway configurations" type: "bool" default: false diff --git a/roles/wireguard_gateway/meta/main.yml b/roles/gateway/meta/main.yml index 36df4aad..36df4aad 100644 --- a/roles/wireguard_gateway/meta/main.yml +++ b/roles/gateway/meta/main.yml diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/gateway/tasks/main.yml index c33a49bf..f9ccd4cb 100644 --- a/roles/wireguard_gateway/tasks/main.yml +++ b/roles/gateway/tasks/main.yml @@ -9,10 +9,10 @@ become: true ansible.builtin.blockinfile: path: "/etc/sysctl.conf" - state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" + state: "{{ 'present' if gateway_enabled else 'absent' }}" prepend_newline: true append_newline: true - marker: "# ==== {mark} ANSIBLE WIREGUARD GATEWAY CONFIG" + marker: "# ==== {mark} ANSIBLE GATEWAY CONFIG" create: true mode: "0644" block: | @@ -41,7 +41,7 @@ out_interface: "{{ item }}" jump: "MASQUERADE" comment: "NAT local subnet traffic through VPN" - state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" + state: "{{ 'present' if gateway_enabled else 'absent' }}" with_items: "{{ wireguard_connections }}" - name: "Add IPv4 FORWARD rule to accept traffic from local subnet" @@ -51,7 +51,7 @@ source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24" jump: "ACCEPT" comment: "Allow forwarding from local subnet" - state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" + state: "{{ 'present' if gateway_enabled else 'absent' }}" - name: "Add IPv4 FORWARD rule to accept established connections" become: true @@ -61,7 +61,7 @@ ctstate: "RELATED,ESTABLISHED" jump: "ACCEPT" comment: "Allow established connections" - state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" + state: "{{ 'present' if gateway_enabled else 'absent' }}" # IPv6 iptables rules - name: "Add IPv6 NAT masquerading for traffic through internet" @@ -87,7 +87,7 @@ jump: "MASQUERADE" comment: "NAT IPv6 local subnet traffic through VPN" ip_version: "ipv6" - state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" + state: "{{ 'present' if gateway_enabled else 'absent' }}" with_items: "{{ wireguard_connections }}" - name: "Add IPv6 FORWARD rule to accept traffic from local subnet" @@ -98,7 +98,7 @@ jump: "ACCEPT" comment: "Allow IPv6 forwarding from local subnet" ip_version: "ipv6" - state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" + state: "{{ 'present' if gateway_enabled else 'absent' }}" - name: "Add IPv6 FORWARD rule to accept established connections" become: true @@ -109,4 +109,4 @@ jump: "ACCEPT" comment: "Allow IPv6 established connections" ip_version: "ipv6" - state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" + state: "{{ 'present' if gateway_enabled else 'absent' }}" diff --git a/roles/wireguard_gateway/defaults/main.yml b/roles/wireguard_gateway/defaults/main.yml deleted file mode 100644 index 0086e118..00000000 --- a/roles/wireguard_gateway/defaults/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -wireguard_gateway_enabled: false @@ -45,5 +45,5 @@ - role: "locales" - role: "timezone" - role: "wireguard" - - role: "wireguard_gateway" + - role: "gateway" - role: "pihole" |