From 16dce63ea4027390b152e7064b8b4e6bf1a18518 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Mon, 1 Sep 2025 02:16:40 +0200 Subject: Fix wireguard_gateway role being slow The pihole lookup DNS queries when the VPN connection is up was slow. One of the culprits was the quad9 servers were taking long time when using VPN The other issue was the previous routing tables that used to work with the fritzbox (with DHCP) which wasn't fully working was conflicting with the VPN route tables and causing loops and delays. Now most of the VPN queries are working fast but some requests are taking some time, probably due to the VPN trying to check/block ads and malware! Also minor fixing to the pre tasks and documentation --- host_vars/rpi5.local.yml | Bin 491 -> 529 bytes host_vars/rpi5.local.yml.example | 1 + roles/network/templates/resolved.conf.j2 | 6 ++++-- roles/pihole/defaults/main.yml | 9 ++++++--- roles/pihole/meta/argument_specs.yml | 13 ++++++++----- roles/wireguard_gateway/tasks/main.yml | 23 ----------------------- site.yml | 2 +- 7 files changed, 20 insertions(+), 34 deletions(-) diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml index 41ce15f2..e823df29 100644 Binary files a/host_vars/rpi5.local.yml and b/host_vars/rpi5.local.yml differ diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index f8515fbd..af2e8dea 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -6,6 +6,7 @@ network_ipv4_gateway: "10.0.0.1" pihole_totp_secret: "CHANGEME" pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}" +wireguard_gateway_enabled: true wireguard_autostart_connection: "protonvpn-us-1" wireguard_connections: protonvpn-us-1: | diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2 index c083a214..cccffff1 100644 --- a/roles/network/templates/resolved.conf.j2 +++ b/roles/network/templates/resolved.conf.j2 @@ -1,6 +1,8 @@ [Resolve] -DNS=9.9.9.9 2620:fe::fe#quad9.net -FallbackDNS=1.1.1.1 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8 2001:4860:4860::8888#dns.google +# cloudflare-dns.com +DNS=1.1.1.1 2606:4700:4700::1111 +# dns.google +FallbackDNS=8.8.8.8 2001:4860:4860::8888 DNSSEC=yes DNSOverTLS=yes # use interface-specific DNS when available but fall back to global (required for VPN DNS to work) diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml index 44744d98..7be113a4 100644 --- a/roles/pihole/defaults/main.yml +++ b/roles/pihole/defaults/main.yml @@ -2,9 +2,12 @@ pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}" pihole_totp_secret: "CHANGEME" pihole_dns: - - "9.9.9.9" # Quad9 - - "1.1.1.1" # Cloudflare - - "8.8.8.8" # Google + # Cloudflare + - "1.1.1.1" + - "2606:4700:4700::1111" + # Google + - "8.8.8.8" + - "2001:4860:4860:0:0:0:0:8888" pihole_interface: "{{ ansible_default_ipv4.interface }}" pihole_dns_blocking_enabled: true pihole_dhcp_enabled: false diff --git a/roles/pihole/meta/argument_specs.yml b/roles/pihole/meta/argument_specs.yml index e7cf04e7..9af61251 100644 --- a/roles/pihole/meta/argument_specs.yml +++ b/roles/pihole/meta/argument_specs.yml @@ -15,9 +15,12 @@ argument_specs: description: "The list of DNS servers to use as upstreams" elements: "str" default: - - "9.9.9.9" # Quad9 - - "1.1.1.1" # Cloudflare - - "8.8.8.8" # Google + # Cloudflare + - "1.1.1.1" + - "2606:4700:4700::1111" + # Google + - "8.8.8.8" + - "2001:4860:4860:0:0:0:0:8888" pihole_interface: type: "str" description: "The interface to bind the pi-hole on" @@ -38,9 +41,9 @@ argument_specs: type: "str" description: "The dhcp end address" default: "{{ ansible_default_ipv4.network }}.199" - pihole_dhcp_address: + pihole_dhcp_router: type: "str" - description: "The dhcp server address (local pihole address)" + description: "The dhcp server router (gateway) address" default: "{{ ansible_default_ipv4.address }}" pihole_dhcp_lease_time: type: "int" diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml index 2b82ff66..a4fb43d8 100644 --- a/roles/wireguard_gateway/tasks/main.yml +++ b/roles/wireguard_gateway/tasks/main.yml @@ -20,29 +20,6 @@ net.ipv6.conf.all.forwarding=1 notify: "Reload sysctl" -- name: "Configure VPN gateway routing" - become: true - ansible.builtin.shell: | - {% if wireguard_gateway_enabled %} - # Add routes to custom table - ip route add default dev {{ wireguard_autostart_connection }} table 100 || true - ip -6 route add default dev {{ wireguard_autostart_connection }} table 100 || true - # Remove any incorrect policy routing rules first - ip -6 rule del iif {{ ansible_default_ipv6.interface }} table 100 || true - # Add correct policy routing rules - ip rule add iif {{ ansible_default_ipv4.interface }} table 100 priority 200 || true - ip -6 rule add iif {{ ansible_default_ipv4.interface }} table 100 priority 200 || true - {% else %} - # Remove policy routing rules - ip rule del iif {{ ansible_default_ipv4.interface }} table 100 || true - ip -6 rule del iif {{ ansible_default_ipv4.interface }} table 100 || true - # Remove routes from custom table - ip route del default dev {{ wireguard_autostart_connection }} table 100 || true - ip -6 route del default dev {{ wireguard_autostart_connection }} table 100 || true - {% endif %} - failed_when: false - changed_when: false - # IPv4 iptables rules - name: "Add IPv4 NAT masquerading for traffic through VPN" become: true diff --git a/site.yml b/site.yml index 67f09f70..c3543ba9 100644 --- a/site.yml +++ b/site.yml @@ -17,7 +17,7 @@ become: true ansible.builtin.package: update_cache: true - async: 300 + async: 60 poll: 5 failed_when: false -- cgit v1.2.3