diff options
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/wireguard_gateway/tasks/main.yml | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml index bfd54886..f8cb1ed0 100644 --- a/roles/wireguard_gateway/tasks/main.yml +++ b/roles/wireguard_gateway/tasks/main.yml @@ -27,11 +27,11 @@ table: "nat" chain: "POSTROUTING" source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24" - out_interface: "{{ wireguard_autostart_connection }}" + out_interface: "{{ item }}" jump: "MASQUERADE" comment: "NAT local subnet traffic through VPN" state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - when: ansible_default_ipv4.address is defined + with_items: "{{ wireguard_connections }}" - name: "Add IPv4 FORWARD rule to accept traffic from local subnet" become: true @@ -41,7 +41,6 @@ jump: "ACCEPT" comment: "Allow forwarding from local subnet" state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - when: ansible_default_ipv4.address is defined - name: "Add IPv4 FORWARD rule to accept established connections" become: true @@ -52,7 +51,6 @@ jump: "ACCEPT" comment: "Allow established connections" state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - when: ansible_default_ipv4.address is defined # IPv6 iptables rules - name: "Add IPv6 NAT masquerading for traffic through VPN" @@ -61,12 +59,12 @@ table: "nat" chain: "POSTROUTING" source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}" - out_interface: "{{ wireguard_autostart_connection }}" + out_interface: "{{ item }}" jump: "MASQUERADE" comment: "NAT IPv6 local subnet traffic through VPN" ip_version: "ipv6" state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - when: ansible_default_ipv6.address is defined + with_items: "{{ wireguard_connections }}" - name: "Add IPv6 FORWARD rule to accept traffic from local subnet" become: true @@ -77,7 +75,6 @@ comment: "Allow IPv6 forwarding from local subnet" ip_version: "ipv6" state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - when: ansible_default_ipv6.address is defined - name: "Add IPv6 FORWARD rule to accept established connections" become: true @@ -89,4 +86,3 @@ comment: "Allow IPv6 established connections" ip_version: "ipv6" state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - when: ansible_default_ipv6.address is defined |