From bb0abab8308256c028c29e3732e53ef211cad613 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Wed, 8 Jul 2026 03:15:11 +0200
Subject: Implement a working ipv6 on gateway

---
 roles/gateway/handlers/main.yml                   |  6 ++++
 roles/gateway/tasks/main.yml                      | 37 +++++++++++++++++++++++
 roles/gateway/templates/gateway-apply-rules.sh.j2 |  6 ++--
 roles/gateway/templates/radvd.conf.j2             | 12 ++++++++
 4 files changed, 58 insertions(+), 3 deletions(-)
 create mode 100644 roles/gateway/templates/radvd.conf.j2

diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml
index 35cc489c..2220f965 100644
--- a/roles/gateway/handlers/main.yml
+++ b/roles/gateway/handlers/main.yml
@@ -15,3 +15,9 @@
   ansible.builtin.command:
     cmd: "udevadm control --reload-rules"
   changed_when: false
+
+- name: "Restart radvd"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "radvd.service"
+    state: "restarted"
diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml
index 661630f7..71484725 100644
--- a/roles/gateway/tasks/main.yml
+++ b/roles/gateway/tasks/main.yml
@@ -6,6 +6,7 @@
       - "iptables"
       - "iproute2"
       - "udev"
+      - "radvd"
     state: "present"
 
 - name: "Configure IP forwarding"
@@ -67,3 +68,39 @@
     name: "gateway-init.service"
     enabled: "{{ gateway_enabled }}"
     daemon_reload: true
+
+- name: "Configure radvd for IPv6 RA"
+  become: true
+  when: gateway_enabled and gateway_local_ipv6_subnet != ""
+  block:
+    - name: "Deploy radvd config"
+      ansible.builtin.template:
+        src: "radvd.conf.j2"
+        dest: "/etc/radvd.conf"
+        owner: "root"
+        group: "root"
+        mode: "0644"
+      notify: "Restart radvd"
+
+    - name: "Enable radvd service"
+      ansible.builtin.systemd_service:
+        name: "radvd.service"
+        enabled: true
+        state: "started"
+        daemon_reload: true
+
+- name: "Disable radvd when no IPv6 subnet configured"
+  become: true
+  when: not gateway_enabled or gateway_local_ipv6_subnet == ""
+  block:
+    - name: "Stop and disable radvd"
+      ansible.builtin.systemd_service:
+        name: "radvd.service"
+        enabled: false
+        state: "stopped"
+      failed_when: false
+
+    - name: "Remove radvd config"
+      ansible.builtin.file:
+        path: "/etc/radvd.conf"
+        state: "absent"
diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2
index 715f6b34..0ce9f740 100644
--- a/roles/gateway/templates/gateway-apply-rules.sh.j2
+++ b/roles/gateway/templates/gateway-apply-rules.sh.j2
@@ -42,9 +42,9 @@ apply_vpn_mode() {
     iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o wg+ -j ACCEPT
     iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     if [ -n "$GATEWAY_SUBNET_V6" ]; then
-        ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o wg+ -j MASQUERADE
+        ip6tables -t nat -A POSTROUTING -o wg+ -j MASQUERADE
         ip6tables -A OUTPUT -o wg+ -j ACCEPT
-        ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o wg+ -j ACCEPT
+        ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o wg+ -j ACCEPT
         ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     fi
     log_message "VPN mode rules applied - traffic routed through VPN"
@@ -59,7 +59,7 @@ apply_direct_rules() {
     if [ -n "$GATEWAY_SUBNET_V6" ]; then
         # No MASQUERADE for IPv6: LAN devices have public SLAAC addresses, native routing applies
         ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT
-        ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j ACCEPT
+        ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -j ACCEPT
         ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     fi
     log_message "Direct mode rules applied - normal routing active"
diff --git a/roles/gateway/templates/radvd.conf.j2 b/roles/gateway/templates/radvd.conf.j2
new file mode 100644
index 00000000..49b3047d
--- /dev/null
+++ b/roles/gateway/templates/radvd.conf.j2
@@ -0,0 +1,12 @@
+interface {{ gateway_router_interface }} {
+    AdvSendAdvert on;
+    AdvManagedFlag off;
+    AdvOtherConfigFlag on;
+    AdvDefaultPreference high;
+
+    prefix {{ gateway_local_ipv6_subnet }} {
+        AdvOnLink on;
+        AdvAutonomous on;
+        AdvRouterAddr on;
+    };
+};
-- 
cgit v1.2.3