From bb0abab8308256c028c29e3732e53ef211cad613 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Wed, 8 Jul 2026 03:15:11 +0200
Subject: Implement a working ipv6 on gateway

---
 roles/gateway/templates/gateway-apply-rules.sh.j2 |  6 +++---
 roles/gateway/templates/radvd.conf.j2             | 12 ++++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 roles/gateway/templates/radvd.conf.j2

(limited to 'roles/gateway/templates')

diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2
index 715f6b34..0ce9f740 100644
--- a/roles/gateway/templates/gateway-apply-rules.sh.j2
+++ b/roles/gateway/templates/gateway-apply-rules.sh.j2
@@ -42,9 +42,9 @@ apply_vpn_mode() {
     iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o wg+ -j ACCEPT
     iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     if [ -n "$GATEWAY_SUBNET_V6" ]; then
-        ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o wg+ -j MASQUERADE
+        ip6tables -t nat -A POSTROUTING -o wg+ -j MASQUERADE
         ip6tables -A OUTPUT -o wg+ -j ACCEPT
-        ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o wg+ -j ACCEPT
+        ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o wg+ -j ACCEPT
         ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     fi
     log_message "VPN mode rules applied - traffic routed through VPN"
@@ -59,7 +59,7 @@ apply_direct_rules() {
     if [ -n "$GATEWAY_SUBNET_V6" ]; then
         # No MASQUERADE for IPv6: LAN devices have public SLAAC addresses, native routing applies
         ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT
-        ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j ACCEPT
+        ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -j ACCEPT
         ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     fi
     log_message "Direct mode rules applied - normal routing active"
diff --git a/roles/gateway/templates/radvd.conf.j2 b/roles/gateway/templates/radvd.conf.j2
new file mode 100644
index 00000000..49b3047d
--- /dev/null
+++ b/roles/gateway/templates/radvd.conf.j2
@@ -0,0 +1,12 @@
+interface {{ gateway_router_interface }} {
+    AdvSendAdvert on;
+    AdvManagedFlag off;
+    AdvOtherConfigFlag on;
+    AdvDefaultPreference high;
+
+    prefix {{ gateway_local_ipv6_subnet }} {
+        AdvOnLink on;
+        AdvAutonomous on;
+        AdvRouterAddr on;
+    };
+};
-- 
cgit v1.2.3