| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
This is refactoring the PoC for deploying cgit on pve, to now move to a
more standard deployment with dedicated agnonstic proxy role/container
|
|
Root cause: Pi, the ISP router (FritzBox), and LAN clients share the same
L2 segment. When Pi forwards a client's IPv6 packet to an external GUA
destination, the Linux kernel detects that the ISP router is a "better"
next-hop on the same link and sends an ICMPv6 Redirect (type 137) to the
client. The client obeys the redirect and sends its first SYN to the ISP
router directly — Pi never forwards the original packet. The ISP router
applies per-device content filtering to the unmasqueraded client GUA and
issues a RST. This produced the symptom of the first IPv6 request failing
with "Connection reset by peer" every ~30-60 seconds (matching the FritzBox
RA interval, after which clients re-resolve their default gateway).
Diagnosis method: tcpdump with MAC addresses (-e flag) on Pi's end0 caught
the ICMPv6 Redirect being sent immediately after the first SYN arrived.
Inserting a DROP rule for icmpv6-type redirect at position 1 in ip6tables
OUTPUT confirmed the fix — 0 failures across extended testing.
Fix:
- Drop ICMPv6 Redirect (type 137) in ip6tables OUTPUT as the first rule,
before the ACCEPT rule, in both direct and VPN modes
- Flush ip6tables OUTPUT chain on clear_rules() instead of per-rule -D
deletion, which was fragile and left stale rules accumulating across
mode switches (previously caused duplicate/conflicting OUTPUT rules)
- Flush ip6tables nat POSTROUTING table instead of per-rule -D deletion
for the same reason
Also documents the ICMPv6 Redirect issue and IPv6 masquerade rationale
in roles/gateway/README.md for future reference.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
|
|
|
|
|
|
This is to allow the ansible-distro-install to safely call the bootstrap
playbook without getting validation errors about the other configure
roles (especially if they are not configured yet, or if running on CI)
|
|
|
|
This also improves the dependency management, making the roles less
repeating when not needing to execute multiple times
|
|
|
|
|
|
|
|
This reverts commit fdd0b5b58f0ebd39ad05e2dcb17faa6603145f97.
|
|
As the role now functions as a gateway and not just a wireguard gateway
it's better name for clarity
|
|
|
|
|
|
|
|
The pihole lookup DNS queries when the VPN connection is up was slow.
One of the culprits was the quad9 servers were taking long time when
using VPN
The other issue was the previous routing tables that used to work with
the fritzbox (with DHCP) which wasn't fully working was conflicting with
the VPN route tables and causing loops and delays.
Now most of the VPN queries are working fast but some requests are
taking some time, probably due to the VPN trying to check/block ads and
malware!
Also minor fixing to the pre tasks and documentation
|
|
|
|
|
|
The conflict was due to resolvconf was removing the systemd-resolved
configuration and that was causing the network to go down and the
fallback on the statically managed resolv.conf (which wasn't able to
resolve the DNS) due to how network manager requiring the DNS resolution
to happen through systemd-resolved
|
|
The testing was failing because the use of the example files with the
same domain names, resulted in the files and the molecule variable were
being merged and therefore running tasks that would fail on test
(example, setting a fake VPN connection that wouldn't start).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Instead of optimizing for task execution for boot, it's simpler and
almost as equally safe (if not even more) to require the role for boot
instead of requiring each of it's needed tasks.
This will also prevent having internal bugs because a set fact wasn't
required for boot and didn't add the info
(similar to the fix in commit: 9f72c58)
|
|
|
|
|
|
|
|
|
