From b8f25e9d80c96f7170d51eb5abcd662a66d55317 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Wed, 8 Jul 2026 14:28:33 +0200 Subject: Route IPv6 through WireGuard VPN via radvd and static gateway MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add radvd to gateway role to advertise Pi as high-preference IPv6 default router using the stable ULA prefix (fd1e:.../64). With FritzBox also sending RAs, devices end up with ECMP between Pi and FritzBox. To solve this, add network_ipv6_gateway (Pi's link-local) as a static route with metric 100 to all managed hosts — beats RA metric 425, ensuring all IPv6 default traffic goes through Pi. Fix IPv6 MASQUERADE in gateway-apply-rules: - Direct mode: add MASQUERADE on end0 (LAN devices use ULA source addresses not known to FritzBox, so Pi must NAT them) - FORWARD rules: restrict to RELATED,ESTABLISHED only — previously the broad ACCEPT rule passed un-NAT'd packets alongside masqueraded copies, causing duplicate SYNs, conntrack corruption, and RSTs - MASQUERADE/clear rules: match by interface not by source subnet (devices may use any source address, not just the ULA prefix) - VPN mode return traffic: explicitly restrict to wg+→end0 direction Add network_ipv6_gateway var (optional) to network role NM templates (ethernet, wifi, bridge) — injects a static IPv6 default route at metric 100 when set. Add rpi5 static route to FritzBox link-local so Pi keeps IPv6 after FritzBox RA is disabled. Force SSH to IPv4 for *.local hosts (AddressFamily inet) — prevents Ansible from hanging on mDNS returning multiple IPv6 addresses. Update gateway and pihole READMEs with two-step IPv6 setup process. Co-Authored-By: Claude.ai --- host_vars/desktop.local.yml | Bin 818 -> 868 bytes host_vars/desktop.local.yml.example | 2 ++ host_vars/laptop.local.yml | Bin 849 -> 899 bytes host_vars/laptop.local.yml.example | 2 ++ host_vars/macbook.local.yml | Bin 853 -> 903 bytes host_vars/macbook.local.yml.example | 2 ++ host_vars/pve.local.yml | Bin 365 -> 517 bytes host_vars/pve.local.yml.example | 5 +++++ host_vars/rpi5.local.yml | Bin 3552 -> 3602 bytes host_vars/rpi5.local.yml.example | 2 ++ 10 files changed, 13 insertions(+) (limited to 'host_vars') diff --git a/host_vars/desktop.local.yml b/host_vars/desktop.local.yml index 9abcecf7..7670b16c 100644 Binary files a/host_vars/desktop.local.yml and b/host_vars/desktop.local.yml differ diff --git a/host_vars/desktop.local.yml.example b/host_vars/desktop.local.yml.example index 4f572cb9..7017c6de 100644 --- a/host_vars/desktop.local.yml.example +++ b/host_vars/desktop.local.yml.example @@ -3,6 +3,8 @@ network_ipv4_address: "10.0.0.201" network_ipv4_gateway: "10.0.0.254" network_ipv4_dns: "10.0.0.254" +# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) +# network_ipv6_gateway: "fe80::0000:1111:2222:3333" go_versions: - "latest" diff --git a/host_vars/laptop.local.yml b/host_vars/laptop.local.yml index 18eabeb7..d41000db 100644 Binary files a/host_vars/laptop.local.yml and b/host_vars/laptop.local.yml differ diff --git a/host_vars/laptop.local.yml.example b/host_vars/laptop.local.yml.example index 9cb955be..ea11d74e 100644 --- a/host_vars/laptop.local.yml.example +++ b/host_vars/laptop.local.yml.example @@ -3,6 +3,8 @@ network_ipv4_address: "10.0.0.202" network_ipv4_gateway: "10.0.0.1" network_ipv4_dns: "10.0.0.1" +# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) +# network_ipv6_gateway: "fe80::0000:1111:2222:3333" python_versions: - "3.13.7" diff --git a/host_vars/macbook.local.yml b/host_vars/macbook.local.yml index 0d1f1561..84de35b2 100644 Binary files a/host_vars/macbook.local.yml and b/host_vars/macbook.local.yml differ diff --git a/host_vars/macbook.local.yml.example b/host_vars/macbook.local.yml.example index daf29e30..8e2586ca 100644 --- a/host_vars/macbook.local.yml.example +++ b/host_vars/macbook.local.yml.example @@ -3,6 +3,8 @@ network_ipv4_address: "10.0.0.203" network_ipv4_gateway: "10.0.0.254" network_ipv4_dns: "10.0.0.254" +# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) +# network_ipv6_gateway: "fe80::0000:1111:2222:3333" go_versions: - "latest" diff --git a/host_vars/pve.local.yml b/host_vars/pve.local.yml index f9640566..cba94054 100644 Binary files a/host_vars/pve.local.yml and b/host_vars/pve.local.yml differ diff --git a/host_vars/pve.local.yml.example b/host_vars/pve.local.yml.example index 0a4a5ceb..88a60b5a 100644 --- a/host_vars/pve.local.yml.example +++ b/host_vars/pve.local.yml.example @@ -1,8 +1,13 @@ --- +# Disable wifi connection on PVE, it's connected with LAN +network_wifi_ssid: "" +network_wifi_pass: "" network_ipv4_address: "10.0.0.253" network_ipv4_gateway: "10.0.0.254" network_ipv4_dns: "10.0.0.254" network_bridge_interface: "eth0" +# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) +# network_ipv6_gateway: "fe80::0000:1111:2222:3333" pve_admin_user: "admin" pve_admin_password: "changeme" diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml index 69941ec8..27388c7d 100644 Binary files a/host_vars/rpi5.local.yml and b/host_vars/rpi5.local.yml differ diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index f68e1ff0..281bc3a3 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -2,6 +2,8 @@ network_interface: "eth0" network_ipv4_address: "10.0.0.254" network_ipv4_gateway: "10.0.0.1" +# Discover network_ipv6_gateway with: ip -6 route show default | grep ra (run on any device before disabling router RA) +# network_ipv6_gateway: "fe80::0000:1111:2222:3333" pihole_hostname: "dns.home.arpa" wg_portal_hostname: "vpn.home.arpa" -- cgit v1.2.3