From 17f10052bdbc4cf5bfd0e2fa335f13c0165284a5 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Mon, 1 Sep 2025 22:24:41 +0200 Subject: Fix networking issues when VPN isn't active --- host_vars/archlinux.local.yml | Bin 207 -> 288 bytes host_vars/archlinux.local.yml.example | 7 ++++++- host_vars/rpi5.local.yml | Bin 529 -> 610 bytes host_vars/rpi5.local.yml.example | 6 +++++- host_vars/ubuntu.local.yml.example | 5 +++++ roles/network/meta/argument_specs.yml | 6 ++++++ roles/network/tasks/main.yml | 14 ++++++++++++-- roles/network/templates/eth0-connection.nmconnection.j2 | 4 +++- roles/network/templates/resolved.conf.j2 | 10 +++++++++- roles/network/templates/wifi-connection.nmconnection.j2 | 4 +++- 10 files changed, 49 insertions(+), 7 deletions(-) diff --git a/host_vars/archlinux.local.yml b/host_vars/archlinux.local.yml index cae65971..66880995 100644 Binary files a/host_vars/archlinux.local.yml and b/host_vars/archlinux.local.yml differ diff --git a/host_vars/archlinux.local.yml.example b/host_vars/archlinux.local.yml.example index 0a727133..5e8c1e55 100644 --- a/host_vars/archlinux.local.yml.example +++ b/host_vars/archlinux.local.yml.example @@ -1,6 +1,11 @@ --- +# Using raspberry pi as gateway (VPN) and DNS sinkhole (pihole) network_ipv4_address: "10.0.0.201" -network_ipv4_gateway: "10.0.0.1" +network_ipv4_gateway: "10.0.0.200" +network_ipv4_dns: "10.0.0.200" +network_ipv6_address: "fd5c:fd8b:2b8c::201/64" +network_ipv6_gateway: "fd5c:fd8b:2b8c::200" +network_ipv6_dns: "fd5c:fd8b:2b8c::200" wireguard_connections: protonvpn-us-1: | diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml index e823df29..f5eccb3b 100644 Binary files a/host_vars/rpi5.local.yml and b/host_vars/rpi5.local.yml differ diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index af2e8dea..2b0e9dbb 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -1,6 +1,10 @@ --- -network_ipv4_address: "10.0.0.202" +network_ipv4_address: "10.0.0.200" network_ipv4_gateway: "10.0.0.1" +network_ipv4_dns: "10.0.0.200" +network_ipv6_address: "fd5c:fd8b:2b8c::200/64" +network_ipv6_gateway: "fd5c:fd8b:2b8c::1" +network_ipv6_dns: "fd5c:fd8b:2b8c::200" # TOTP generator: `openssl rand -base64 32 | head -c "20" | base32` pihole_totp_secret: "CHANGEME" diff --git a/host_vars/ubuntu.local.yml.example b/host_vars/ubuntu.local.yml.example index e552d7ea..1a1cb875 100644 --- a/host_vars/ubuntu.local.yml.example +++ b/host_vars/ubuntu.local.yml.example @@ -1,6 +1,11 @@ --- +# Not using raspberry pi as gateway or DNS sinkhole network_ipv4_address: "10.0.0.203" network_ipv4_gateway: "10.0.0.1" +network_ipv4_dns: "10.0.0.1" +network_ipv6_address: "fd5c:fd8b:2b8c::203/64" +network_ipv6_gateway: "fd5c:fd8b:2b8c::1" +network_ipv6_dns: "fd5c:fd8b:2b8c::1" wireguard_connections: protonvpn-us-1: | diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml index 7cb3f62d..86df33c6 100644 --- a/roles/network/meta/argument_specs.yml +++ b/roles/network/meta/argument_specs.yml @@ -18,9 +18,15 @@ argument_specs: network_ipv4_gateway: type: "str" description: "The network IP(4) gateway to configure when provided" + network_ipv4_dns: + type: "str" + description: "The network IP(4) gateway to configure when provided" network_ipv6_address: type: "str" description: "The network IP(6) address to configure when provided" network_ipv6_gateway: type: "str" description: "The network IP(6) gateway to configure when provided" + network_ipv6_dns: + type: "str" + description: "The network IP(4) gateway to configure when provided" diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml index c8c48268..5c733a48 100644 --- a/roles/network/tasks/main.yml +++ b/roles/network/tasks/main.yml @@ -10,8 +10,18 @@ that: - network_ipv4_address is defined - network_ipv4_gateway is defined - fail_msg: "network_ipv4_address and network_ipv4_gateway are required together" - when: network_ipv4_address is defined or network_ipv4_gateway is defined + - network_ipv4_dns is defined + fail_msg: "network_ipv4_address, network_ipv4_gateway, and network_ipv4_dns are required together" + when: network_ipv4_address is defined or network_ipv4_gateway is defined or network_ipv4_dns is defined + +- name: "Validate network_ipv6_* params" + ansible.builtin.assert: + that: + - network_ipv6_address is defined + - network_ipv6_gateway is defined + - network_ipv6_dns is defined + fail_msg: "network_ipv6_address, network_ipv6_gateway, and network_ipv6_dns are required together" + when: network_ipv6_address is defined or network_ipv6_gateway is defined or network_ipv6_dns is defined - name: "Ensure network enabled services are enabled" become: true diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2 index b981489a..dab5a6de 100644 --- a/roles/network/templates/eth0-connection.nmconnection.j2 +++ b/roles/network/templates/eth0-connection.nmconnection.j2 @@ -9,7 +9,8 @@ autoconnect=true {% if network_ipv4_address is defined %} method=manual addresses={{ network_ipv4_address }} -gateway={{ network_ipv4_gateway }} +gateway={{ network_ipv4_gateway }} +dns={{ network_ipv4_dns }} {% else %} method=auto {% endif %} @@ -20,6 +21,7 @@ addr-gen-mode=default method=manual addresses={{ network_ipv6_address }} gateway={{ network_ipv6_gateway }} +dns={{ network_ipv6_dns }} {% else %} method=auto {% endif %} diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2 index cccffff1..5d70fb96 100644 --- a/roles/network/templates/resolved.conf.j2 +++ b/roles/network/templates/resolved.conf.j2 @@ -1,10 +1,18 @@ [Resolve] +{% if not (network_ipv4_dns is defined or network_ipv6_dns is defined) %} +# Only set global DNS (and DoT) if not using Pi-hole # cloudflare-dns.com DNS=1.1.1.1 2606:4700:4700::1111 # dns.google FallbackDNS=8.8.8.8 2001:4860:4860::8888 -DNSSEC=yes DNSOverTLS=yes +DNSSEC=yes +{% else %} +# NetworkManager will provide DNS via Pi-hole, no global DNS needed +# Pi-hole doesn't support DoT/DNSSEC +DNSOverTLS=no +DNSSEC=no +{% endif %} # use interface-specific DNS when available but fall back to global (required for VPN DNS to work) Domains=~. diff --git a/roles/network/templates/wifi-connection.nmconnection.j2 b/roles/network/templates/wifi-connection.nmconnection.j2 index 52cf2d19..c04077c0 100644 --- a/roles/network/templates/wifi-connection.nmconnection.j2 +++ b/roles/network/templates/wifi-connection.nmconnection.j2 @@ -17,7 +17,8 @@ psk={{ network_wifi_pass }} {% if network_ipv4_address is defined %} method=manual addresses={{ network_ipv4_address }} -gateway={{ network_ipv4_gateway }} +gateway={{ network_ipv4_gateway }} +dns={{ network_ipv4_dns }} {% else %} method=auto {% endif %} @@ -28,6 +29,7 @@ addr-gen-mode=default method=manual addresses={{ network_ipv6_address }} gateway={{ network_ipv6_gateway }} +dns={{ network_ipv6_dns }} {% else %} method=auto {% endif %} -- cgit v1.2.3