From 90f8483dbbfa422eced5076ae13ca3299c256676 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Wed, 1 Jul 2026 12:21:48 +0200 Subject: Update the README for gateway and pihole setup with details about ipv6 --- roles/gateway/README.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'roles/gateway') diff --git a/roles/gateway/README.md b/roles/gateway/README.md index ee6488c4..cfbe49d3 100644 --- a/roles/gateway/README.md +++ b/roles/gateway/README.md @@ -17,6 +17,23 @@ gateway_local_ipv4_subnet: "192.168.1.0/24" gateway_router_interface: "end0" ``` +### IPv6 Support (Optional) + +IPv6 gateway is enabled by setting both `network_ipv6_address` and `gateway_local_ipv6_subnet`: + +```yaml +network_ipv6_address: "2a02:xxxx:xxxx:xxxx::254/64" # Pi's IPv6 address +gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet +``` + +To disable IPv6 entirely, remove both variables from `host_vars`. The role will: +- Omit `accept_ra` sysctl (no IPv6 interface key written) +- Skip IPv6 iptables masquerade rules (`gateway_local_ipv6_subnet` defaults to `""`) +- Leave `net.ipv6.conf.all.forwarding=0` + +**Note:** `accept_ra` is set per-interface (`gateway_router_interface`) only when IPv6 is enabled. +This prevents rogue RA acceptance on WireGuard and LAN interfaces. + ## Network Architecture ```txt -- cgit v1.2.3