From ff4eb129eea3f3743f82e5f1f7858d43625dba3d Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Thu, 23 Jul 2026 00:42:43 +0200 Subject: Disable ipv6 completely and remove related code Co-Authored-By: Claude.ai --- group_vars/all.yml | Bin 203 -> 148 bytes group_vars/all.yml.example | 3 - host_vars/desktop.local.yml | Bin 1116 -> 1090 bytes host_vars/desktop.local.yml.example | 3 - host_vars/laptop.local.yml | Bin 1037 -> 1011 bytes host_vars/laptop.local.yml.example | 3 - host_vars/macbook.local.yml | Bin 1341 -> 1315 bytes host_vars/macbook.local.yml.example | 3 - host_vars/pve.local.yml | Bin 566 -> 540 bytes host_vars/pve.local.yml.example | 3 - host_vars/rpi5.local.yml | Bin 4118 -> 3910 bytes host_vars/rpi5.local.yml.example | 4 -- roles/gateway/README.md | 65 --------------------- roles/gateway/defaults/main.yml | 1 - roles/gateway/handlers/main.yml | 6 -- roles/gateway/meta/argument_specs.yml | 5 -- roles/gateway/tasks/main.yml | 37 ------------ roles/gateway/templates/99-gateway.conf.j2 | 3 - roles/gateway/templates/gateway-apply-rules.sh.j2 | 20 ------- roles/gateway/templates/radvd.conf.j2 | 12 ---- roles/hostname/tasks/main.yml | 3 - roles/network/defaults/main.yml | 2 - roles/network/meta/argument_specs.yml | 14 ----- roles/network/templates/NetworkManager.conf.j2 | 2 - roles/network/templates/bridge.nmconnection.j2 | 6 +- .../templates/eth0-connection.nmconnection.j2 | 8 --- roles/network/templates/gai.conf.j2 | 8 --- roles/network/templates/resolved.conf.j2 | 4 +- .../templates/wifi-connection.nmconnection.j2 | 8 --- roles/pihole/README.md | 46 --------------- roles/pihole/defaults/main.yml | 8 +-- roles/pihole/meta/argument_specs.yml | 8 +-- roles/pihole/tasks/main.yml | 6 +- roles/pve/templates/hosts.j2 | 3 - 34 files changed, 10 insertions(+), 284 deletions(-) delete mode 100644 roles/gateway/templates/radvd.conf.j2 diff --git a/group_vars/all.yml b/group_vars/all.yml index e505a7da..887caffb 100644 Binary files a/group_vars/all.yml and b/group_vars/all.yml differ diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example index 05ae6f47..90789e87 100644 --- a/group_vars/all.yml.example +++ b/group_vars/all.yml.example @@ -1,7 +1,4 @@ --- -network_ipv6_disabled: true -network_prefer_ipv4: true - user_public_keys: - "ssh-ed25519 AAAA...fMo" - "ssh-rsa AAAA...4I3" diff --git a/host_vars/desktop.local.yml b/host_vars/desktop.local.yml index f479690d..86ef7da7 100644 Binary files a/host_vars/desktop.local.yml and b/host_vars/desktop.local.yml differ diff --git a/host_vars/desktop.local.yml.example b/host_vars/desktop.local.yml.example index cbafb889..35890e53 100644 --- a/host_vars/desktop.local.yml.example +++ b/host_vars/desktop.local.yml.example @@ -3,9 +3,6 @@ network_ipv4_address: "10.0.0.201" network_ipv4_gateway: "10.0.0.254" network_ipv4_dns: "10.0.0.254" -network_prefer_ipv4: true -# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) -# network_ipv6_gateway: "fe80::0000:1111:2222:3333" go_versions: - "latest" diff --git a/host_vars/laptop.local.yml b/host_vars/laptop.local.yml index 4f4cd3f7..fbb83ac2 100644 Binary files a/host_vars/laptop.local.yml and b/host_vars/laptop.local.yml differ diff --git a/host_vars/laptop.local.yml.example b/host_vars/laptop.local.yml.example index 726fc4b1..e0b5e0d8 100644 --- a/host_vars/laptop.local.yml.example +++ b/host_vars/laptop.local.yml.example @@ -3,9 +3,6 @@ network_ipv4_address: "10.0.0.202" network_ipv4_gateway: "10.0.0.1" network_ipv4_dns: "10.0.0.1" -network_prefer_ipv4: true -# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) -# network_ipv6_gateway: "fe80::0000:1111:2222:3333" python_versions: - "3.13.7" diff --git a/host_vars/macbook.local.yml b/host_vars/macbook.local.yml index 1b12390d..2a5b3172 100644 Binary files a/host_vars/macbook.local.yml and b/host_vars/macbook.local.yml differ diff --git a/host_vars/macbook.local.yml.example b/host_vars/macbook.local.yml.example index 95b4f191..264446c5 100644 --- a/host_vars/macbook.local.yml.example +++ b/host_vars/macbook.local.yml.example @@ -3,9 +3,6 @@ network_ipv4_address: "10.0.0.203" network_ipv4_gateway: "10.0.0.254" network_ipv4_dns: "10.0.0.254" -network_prefer_ipv4: true -# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) -# network_ipv6_gateway: "fe80::0000:1111:2222:3333" go_versions: - "latest" diff --git a/host_vars/pve.local.yml b/host_vars/pve.local.yml index ae3a8293..214b6264 100644 Binary files a/host_vars/pve.local.yml and b/host_vars/pve.local.yml differ diff --git a/host_vars/pve.local.yml.example b/host_vars/pve.local.yml.example index 7bbaa914..cc872e67 100644 --- a/host_vars/pve.local.yml.example +++ b/host_vars/pve.local.yml.example @@ -5,10 +5,7 @@ network_wifi_pass: "" network_ipv4_address: "10.0.0.250" network_ipv4_gateway: "10.0.0.254" network_ipv4_dns: "10.0.0.254" -network_prefer_ipv4: true network_bridge_interface: "eth0" -# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) -# network_ipv6_gateway: "fe80::0000:1111:2222:3333" pve_admin_user: "admin" pve_admin_password: "changeme" diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml index b21a2b17..d2ecdb2f 100644 Binary files a/host_vars/rpi5.local.yml and b/host_vars/rpi5.local.yml differ diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index ecc3ca12..20d9d15e 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -2,9 +2,6 @@ network_interface: "eth0" network_ipv4_address: "10.0.0.254" network_ipv4_gateway: "10.0.0.1" -network_prefer_ipv4: false -# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) -# network_ipv6_gateway: "fe80::0000:1111:2222:3333" proxy_type: "caddy" @@ -52,7 +49,6 @@ wireguard_connections: gateway_enabled: true gateway_router_interface: "{{ network_interface }}" gateway_local_ipv4_subnet: "10.0.0.0/24" -gateway_local_ipv6_subnet: "fd00:0000:0000:0000::/64" prometheus_host: "localhost" prometheus_port: 9090 diff --git a/roles/gateway/README.md b/roles/gateway/README.md index 5340cc25..eda1b087 100644 --- a/roles/gateway/README.md +++ b/roles/gateway/README.md @@ -17,29 +17,6 @@ gateway_local_ipv4_subnet: "192.168.1.0/24" gateway_router_interface: "end0" ``` -### IPv6 Support (Optional) - -IPv6 gateway is enabled by setting `gateway_local_ipv6_subnet` to the ULA prefix advertised by radvd: - -```yaml -gateway_local_ipv6_subnet: "fd00:xxxx:xxxx:xxxx::/64" # ULA prefix (stable, router-independent) -``` - -When set, this role: -- Enables `net.ipv6.conf.all.forwarding=1` and `accept_ra=2` on `gateway_router_interface` -- Deploys radvd advertising the ULA prefix with `AdvDefaultPreference high` — Pi wins as IPv6 default router -- Adds ip6tables MASQUERADE/FORWARD rules so all client IPv6 traffic is forwarded through Pi -- Drops outbound ICMPv6 Redirect messages — prevents Pi from redirecting clients to bypass the gateway - -**ICMPv6 Redirect suppression is critical.** Pi, the ISP router (FritzBox), and LAN clients share the same L2 -segment. When Pi forwards a packet to an external destination and the kernel determines the ISP router is a -"better" next-hop on the same link, it sends an ICMPv6 Redirect to the client. The client then sends -subsequent connections directly to the ISP router — bypassing Pi's masquerade and content filtering entirely. -The first connection attempt fails (Pi forwarded nothing, just redirected), giving the symptom of "first -request fails every ~30-60s." Dropping Redirect messages in ip6tables OUTPUT fixes this. - -To disable IPv6, leave `gateway_local_ipv6_subnet: ""` (default). The role skips all ip6tables rules and disables radvd. - ## Network Architecture ```txt @@ -65,40 +42,10 @@ Client Devices (192.168.1.0/24) - All traffic NAT'd through `wg+` interfaces - Pi and client traffic both use VPN exit IP -- Most VPN providers handle IPv4/IPv6 protocol routing automatically **Direct Mode Characteristics:** - IPv4 traffic NAT'd through router interface (`end0`) -- IPv6 traffic masqueraded through router interface — clients appear as Pi's GUA to the ISP router, - preventing ISP-router-level content filtering from applying per-device rules -- ICMPv6 Redirects suppressed so clients always route through Pi - -## IPv6 Architecture Notes - -### Why masquerade IPv6 in direct mode? - -Clients have globally routable GUA addresses (assigned by ISP router SLAAC). Without masquerade, the ISP -router sees each client's real GUA and can apply per-device content filtering. With masquerade, all client -traffic appears to originate from Pi's GUA — bypassing per-device filtering consistently. - -### Why suppress ICMPv6 Redirects? - -When Pi, the ISP router, and clients share the same L2 segment (single broadcast domain), the Linux kernel -sends ICMPv6 Redirect messages when it detects a "better" next-hop for a destination on the same link. For -external GUA destinations reachable via the ISP router directly, Linux redirects clients from Pi to the ISP -router. This causes: -1. First SYN from client arrives at Pi — Pi sends Redirect, does NOT forward the packet -2. Client receives Redirect, caches ISP router as next-hop for that destination -3. Subsequent connections go directly to ISP router — masquerade and filtering bypassed - -Dropping `icmpv6-type redirect` in ip6tables OUTPUT prevents this entirely. - -### Why radvd with `AdvDefaultPreference high`? - -The ISP router (FritzBox) also sends RAs with default preference `medium` (or `low` if configured). -Pi's radvd sends `AdvDefaultPreference high`, so clients prefer Pi as their IPv6 default router. -Without this, clients split or prefer the ISP router depending on RA timing. ## Requirements @@ -135,18 +82,6 @@ journalctl -u gateway-direct-mode.service -f sudo iptables -L -n -v sudo iptables -t nat -L -n -v -# Verify ip6tables rules (redirect DROP must be first in OUTPUT) -sudo ip6tables -L OUTPUT -n -v --line-numbers -sudo ip6tables -t nat -L -n -v - -# Confirm no ICMPv6 Redirects being sent -sudo tcpdump -i end0 -n 'icmp6 and ip6[40] == 137' - -# Verify clients route through Pi (not ISP router) -# On client: ip -6 route show default -# On Pi: sudo tcpdump -i end0 -n -e ip6 and host - # Test traffic routing curl -4 ifconfig.co # Should show VPN IP when VPN active -curl -6 ifconfig.co # Should show Pi's GUA in direct mode, VPN IPv6 in VPN mode ``` diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml index dad64685..ebe33a12 100644 --- a/roles/gateway/defaults/main.yml +++ b/roles/gateway/defaults/main.yml @@ -1,4 +1,3 @@ --- gateway_enabled: false gateway_router_interface: "eth0" -gateway_local_ipv6_subnet: "" diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml index 19088c82..12f901c0 100644 --- a/roles/gateway/handlers/main.yml +++ b/roles/gateway/handlers/main.yml @@ -15,9 +15,3 @@ ansible.builtin.command: cmd: "udevadm control --reload-rules" changed_when: false - -- name: "Restart radvd" - become: true - ansible.builtin.systemd_service: - name: "radvd.service" - state: "restarted" diff --git a/roles/gateway/meta/argument_specs.yml b/roles/gateway/meta/argument_specs.yml index b8efa0b3..d24251e3 100644 --- a/roles/gateway/meta/argument_specs.yml +++ b/roles/gateway/meta/argument_specs.yml @@ -11,11 +11,6 @@ argument_specs: description: "Local subnet CIDR for NAT and routing rules (e.g., '192.168.178.0/24')" type: "str" required: true - gateway_local_ipv6_subnet: - description: "Local IPv6 subnet CIDR for NAT and routing rules (e.g., '2a02:3102:4ced:ec00::/64')" - type: "str" - required: false - default: "" gateway_router_interface: description: "Default route interface for direct routing mode" type: "str" diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml index 71484725..661630f7 100644 --- a/roles/gateway/tasks/main.yml +++ b/roles/gateway/tasks/main.yml @@ -6,7 +6,6 @@ - "iptables" - "iproute2" - "udev" - - "radvd" state: "present" - name: "Configure IP forwarding" @@ -68,39 +67,3 @@ name: "gateway-init.service" enabled: "{{ gateway_enabled }}" daemon_reload: true - -- name: "Configure radvd for IPv6 RA" - become: true - when: gateway_enabled and gateway_local_ipv6_subnet != "" - block: - - name: "Deploy radvd config" - ansible.builtin.template: - src: "radvd.conf.j2" - dest: "/etc/radvd.conf" - owner: "root" - group: "root" - mode: "0644" - notify: "Restart radvd" - - - name: "Enable radvd service" - ansible.builtin.systemd_service: - name: "radvd.service" - enabled: true - state: "started" - daemon_reload: true - -- name: "Disable radvd when no IPv6 subnet configured" - become: true - when: not gateway_enabled or gateway_local_ipv6_subnet == "" - block: - - name: "Stop and disable radvd" - ansible.builtin.systemd_service: - name: "radvd.service" - enabled: false - state: "stopped" - failed_when: false - - - name: "Remove radvd config" - ansible.builtin.file: - path: "/etc/radvd.conf" - state: "absent" diff --git a/roles/gateway/templates/99-gateway.conf.j2 b/roles/gateway/templates/99-gateway.conf.j2 index b0f99dd4..6f8a3fbd 100644 --- a/roles/gateway/templates/99-gateway.conf.j2 +++ b/roles/gateway/templates/99-gateway.conf.j2 @@ -1,8 +1,5 @@ {% if gateway_enabled %} net.ipv4.ip_forward=1 -net.ipv6.conf.all.forwarding=1 -net.ipv6.conf.{{ gateway_router_interface }}.accept_ra=2 {% else %} net.ipv4.ip_forward=0 -net.ipv6.conf.all.forwarding=0 {% endif %} diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2 index 59a960cf..785d595b 100644 --- a/roles/gateway/templates/gateway-apply-rules.sh.j2 +++ b/roles/gateway/templates/gateway-apply-rules.sh.j2 @@ -7,7 +7,6 @@ LOG_FACILITY="local0.info" # Ansible template variables - configured at deployment time GATEWAY_SUBNET_V4="{{ gateway_local_ipv4_subnet }}" -GATEWAY_SUBNET_V6="{{ gateway_local_ipv6_subnet }}" GATEWAY_INTERFACE="{{ gateway_router_interface }}" log_message() { echo "[$SCRIPT_NAME] $1" | logger -t "$SCRIPT_NAME" -p "$LOG_FACILITY" @@ -25,11 +24,6 @@ clear_rules() { iptables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j MASQUERADE 2>/dev/null || true iptables -D OUTPUT -o wg+ -j ACCEPT 2>/dev/null || true iptables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true - if [ -n "$GATEWAY_SUBNET_V6" ]; then - ip6tables -F FORWARD 2>/dev/null || true - ip6tables -F OUTPUT 2>/dev/null || true - ip6tables -t nat -F POSTROUTING 2>/dev/null || true - fi } apply_vpn_mode() { @@ -39,13 +33,6 @@ apply_vpn_mode() { iptables -A OUTPUT -o wg+ -j ACCEPT iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o wg+ -j ACCEPT iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - if [ -n "$GATEWAY_SUBNET_V6" ]; then - ip6tables -t nat -A POSTROUTING -o wg+ -j MASQUERADE - ip6tables -I OUTPUT 1 -p ipv6-icmp --icmpv6-type redirect -j DROP - ip6tables -A OUTPUT -o wg+ -j ACCEPT - ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o wg+ -j ACCEPT - ip6tables -A FORWARD -i wg+ -o "$GATEWAY_INTERFACE" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - fi log_message "VPN mode rules applied - traffic routed through VPN" } @@ -55,13 +42,6 @@ apply_direct_rules() { iptables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j ACCEPT iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - if [ -n "$GATEWAY_SUBNET_V6" ]; then - ip6tables -t nat -A POSTROUTING -o "$GATEWAY_INTERFACE" -j MASQUERADE - ip6tables -I OUTPUT 1 -p ipv6-icmp --icmpv6-type redirect -j DROP - ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT - ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -j ACCEPT - ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - fi log_message "Direct mode rules applied - normal routing active" } diff --git a/roles/gateway/templates/radvd.conf.j2 b/roles/gateway/templates/radvd.conf.j2 deleted file mode 100644 index 49b3047d..00000000 --- a/roles/gateway/templates/radvd.conf.j2 +++ /dev/null @@ -1,12 +0,0 @@ -interface {{ gateway_router_interface }} { - AdvSendAdvert on; - AdvManagedFlag off; - AdvOtherConfigFlag on; - AdvDefaultPreference high; - - prefix {{ gateway_local_ipv6_subnet }} { - AdvOnLink on; - AdvAutonomous on; - AdvRouterAddr on; - }; -}; diff --git a/roles/hostname/tasks/main.yml b/roles/hostname/tasks/main.yml index b6dc2cc1..5b502ec0 100644 --- a/roles/hostname/tasks/main.yml +++ b/roles/hostname/tasks/main.yml @@ -16,7 +16,4 @@ content: | 127.0.0.1 localhost 127.0.1.1 {{ hostname }} - ::1 localhost ip6-localhost ip6-loopback - ff02::1 ip6-allnodes - ff02::2 ip6-allrouters when: hostname is defined diff --git a/roles/network/defaults/main.yml b/roles/network/defaults/main.yml index 20776341..5e1076a7 100644 --- a/roles/network/defaults/main.yml +++ b/roles/network/defaults/main.yml @@ -1,5 +1,3 @@ --- network_wifi_ssid: "" network_wifi_pass: "" -network_prefer_ipv4: false -network_ipv6_disabled: false diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml index b6c521fe..5f74b45c 100644 --- a/roles/network/meta/argument_specs.yml +++ b/roles/network/meta/argument_specs.yml @@ -21,20 +21,6 @@ argument_specs: network_ipv4_dns: type: "str" description: "The network IP(4) gateway to configure when provided" - network_ipv6_gateway: - type: "str" - description: "Static IPv6 default route via router link-local — set when router RA is disabled" - required: false - network_prefer_ipv4: - type: "bool" - description: "Prefer IPv4 over IPv6 for address resolution" - required: false - default: false - network_ipv6_disabled: - type: "bool" - description: "Disable IPv6 on all network connections" - required: false - default: false network_bridge_interface: type: "str" description: "Physical NIC to enslave as vmbr0 bridge port" diff --git a/roles/network/templates/NetworkManager.conf.j2 b/roles/network/templates/NetworkManager.conf.j2 index a67d2e27..43baa2f6 100644 --- a/roles/network/templates/NetworkManager.conf.j2 +++ b/roles/network/templates/NetworkManager.conf.j2 @@ -16,8 +16,6 @@ ethernet.cloned-mac-address=random wifi.cloned-mac-address=stable [connection] -ipv6.ip6-privacy=2 -ipv6.dhcp-duid=stable-uuid wifi.powersave=2 connection.mdns=2 diff --git a/roles/network/templates/bridge.nmconnection.j2 b/roles/network/templates/bridge.nmconnection.j2 index 47f723d8..8ac4c6fe 100644 --- a/roles/network/templates/bridge.nmconnection.j2 +++ b/roles/network/templates/bridge.nmconnection.j2 @@ -16,8 +16,4 @@ dns={{ network_ipv4_dns }} {% endif %} [ipv6] -addr-gen-mode=default -method=auto -{% if network_ipv6_gateway is defined %} -routes=::/0,{{ network_ipv6_gateway }},100 -{% endif %} +method=disabled diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2 index 032b18a3..f5856bce 100644 --- a/roles/network/templates/eth0-connection.nmconnection.j2 +++ b/roles/network/templates/eth0-connection.nmconnection.j2 @@ -27,14 +27,6 @@ method=auto {% endif %} [ipv6] -addr-gen-mode=default -{% if network_bridge_interface is defined or network_ipv6_disabled %} method=disabled -{% elif network_ipv6_gateway is defined %} -method=auto -routes=::/0,{{ network_ipv6_gateway }},100 -{% else %} -method=auto -{% endif %} [proxy] diff --git a/roles/network/templates/gai.conf.j2 b/roles/network/templates/gai.conf.j2 index 21c17332..8f8e29c2 100644 --- a/roles/network/templates/gai.conf.j2 +++ b/roles/network/templates/gai.conf.j2 @@ -1,10 +1,2 @@ # Managed by Ansible — controls getaddrinfo address family preference -{% if network_prefer_ipv4 %} precedence ::ffff:0:0/96 100 -{% else %} -precedence ::1/128 50 -precedence ::/0 40 -precedence 2002::/16 30 -precedence ::/96 20 -precedence ::ffff:0:0/96 10 -{% endif %} diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2 index 0354feeb..58336756 100644 --- a/roles/network/templates/resolved.conf.j2 +++ b/roles/network/templates/resolved.conf.j2 @@ -1,6 +1,6 @@ [Resolve] -DNS={{ network_ipv4_dns | default('1.1.1.1 2606:4700:4700::1111') }} -FallbackDNS=8.8.8.8 2001:4860:4860::8888 +DNS={{ network_ipv4_dns | default('1.1.1.1') }} +FallbackDNS=8.8.8.8 DNSOverTLS={{ 'no' if network_ipv4_dns is defined else 'yes' }} DNSSEC={{ 'no' if network_ipv4_dns is defined else 'yes' }} # use interface-specific DNS when available but fall back to global (required for VPN DNS to work) diff --git a/roles/network/templates/wifi-connection.nmconnection.j2 b/roles/network/templates/wifi-connection.nmconnection.j2 index 01dff2eb..b5280a30 100644 --- a/roles/network/templates/wifi-connection.nmconnection.j2 +++ b/roles/network/templates/wifi-connection.nmconnection.j2 @@ -26,14 +26,6 @@ method=auto {% endif %} [ipv6] -addr-gen-mode=default -{% if network_ipv6_disabled %} method=disabled -{% elif network_ipv6_gateway is defined %} -method=auto -routes=::/0,{{ network_ipv6_gateway }},100 -{% else %} -method=auto -{% endif %} [proxy] diff --git a/roles/pihole/README.md b/roles/pihole/README.md index e7e0bb20..2f2383ab 100644 --- a/roles/pihole/README.md +++ b/roles/pihole/README.md @@ -37,54 +37,8 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol - Internet > Account Information > DNS Server > DNSv4 Server > Use Other DNSv4 Servers > {{ pihole_ipv4 }} -#### No IPv6 Support (default) - - Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 > - Router advertisement enable in the LAN > ❌ - DNSv6 Server in the Home Network > Also announce DNSv6 server via router advertisement (RFC5006) > ❌ - Internet > Account Information > IPv6 > IPv6 Support > ❌ - -#### With IPv6 Support - -Setup is a two-step process: first enable FritzBox RA to get the Pi's stable ULA address, -then disable FritzBox RA so Pi becomes the sole IPv6 default router. - -**Step 1 — Enable FritzBox RA temporarily to get Pi's ULA address:** - -- Internet > Account Information > - - IPv6 > IPv6 Support > ✅ - - IPv6 > IPv6 Connectivity > Native IPv4 connection > Use IPv6 via landline connection or Mobile network > ✅ - - IPv6 > Connection Settings > Use DHCPv6 Rapid Commit > ❌ - - IPv6 > Connection Settings > Require certain length of the LAN prefix > ❌ - -- Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 > - - Router advertisement enable in the LAN > ✅ - - Always assign ULA addresses > ✅ - - Set ULA prefix > https://www.unique-local-ipv6.com/ example: `fd00:1234:5678::` > ✅ - - This FRITZ!Box provides the standard internet connection > Low - - DNSv6 Server in the Home Network > - - Also announce DNSv6 server via router advertisement (RFC5006) > ✅ - - Local DNSv6 Server > {{ pihole_ipv6 `ip address | grep "inet6 fd"`}} - - DHCPv6 Server in the home network > - - Disable DHCPv6 server in the FRITZ!Box for the home network > ✅ - - There are no other DHCPv6 servers in the home network. > ✅ - -- Internet > Account Information > Internet DNS Server > DNSv6 Server > Use Other DNSv6 Servers > {{ pihole_ipv6 }} - -On the Pi, get the ULA address and the FritzBox link-local default route: -```bash -ip address | grep "inet6 fd" # use the mngtmpaddr address as pihole_ipv6 -ip -6 route show default | grep ra # use the nexthop as network_ipv6_gateway in rpi5 host_vars -``` - -Set `network_ipv6_gateway` in `host_vars/rpi5.local.yml` and run the playbook to deploy the static IPv6 route on Pi. - -**Step 2 — Disable FritzBox RA so Pi becomes sole IPv6 default router:** - -- Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 > - - Router advertisement enable in the LAN > ❌ - -NOTE: Pi's radvd (deployed by the `gateway` role) takes over sending RAs with `AdvDefaultPreference high`. -All LAN devices use Pi as their IPv6 default router → traffic routes VPN or direct mode. -Pi keeps IPv6 connectivity via the static route to FritzBox set in Step 1. diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml index d980c67c..e9d72266 100644 --- a/roles/pihole/defaults/main.yml +++ b/roles/pihole/defaults/main.yml @@ -2,12 +2,8 @@ pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}" pihole_totp_secret: "CHANGEME" pihole_dns: - # Cloudflare - - "1.1.1.1" - - "2606:4700:4700::1111" - # Google - - "8.8.8.8" - - "2001:4860:4860:0:0:0:0:8888" + - "1.1.1.1" # Cloudflare + - "8.8.8.8" # Google pihole_interface: "eth0" pihole_dns_blocking_enabled: true pihole_dhcp_enabled: false diff --git a/roles/pihole/meta/argument_specs.yml b/roles/pihole/meta/argument_specs.yml index 40662436..c86fd5a0 100644 --- a/roles/pihole/meta/argument_specs.yml +++ b/roles/pihole/meta/argument_specs.yml @@ -15,12 +15,8 @@ argument_specs: description: "The list of DNS servers to use as upstreams" elements: "str" default: - # Cloudflare - - "1.1.1.1" - - "2606:4700:4700::1111" - # Google - - "8.8.8.8" - - "2001:4860:4860:0:0:0:0:8888" + - "1.1.1.1" # Cloudflare + - "8.8.8.8" # Google pihole_interface: type: "str" description: "The interface to bind the pi-hole on" diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml index ccd4bd9f..63e034d8 100644 --- a/roles/pihole/tasks/main.yml +++ b/roles/pihole/tasks/main.yml @@ -1,8 +1,8 @@ --- -- name: "Validate network_ipv*_dns params" +- name: "Validate network_ipv4_dns param" ansible.builtin.fail: - msg: "Pihole role cannot work when network_ipv4_dns or network_ipv6_dns are defined" - when: network_ipv4_dns is defined or network_ipv6_dns is defined + msg: "Pihole role cannot work when network_ipv4_dns is defined" + when: network_ipv4_dns is defined - name: "Validate pihole_dhcp_* params" ansible.builtin.assert: diff --git a/roles/pve/templates/hosts.j2 b/roles/pve/templates/hosts.j2 index 5cebad3c..b5ef4bc3 100644 --- a/roles/pve/templates/hosts.j2 +++ b/roles/pve/templates/hosts.j2 @@ -1,5 +1,2 @@ 127.0.0.1 localhost {{ network_ipv4_address }} {{ ansible_facts['hostname'] }} -::1 localhost ip6-localhost ip6-loopback -ff02::1 ip6-allnodes -ff02::2 ip6-allrouters -- cgit v1.2.3