From b8f25e9d80c96f7170d51eb5abcd662a66d55317 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Wed, 8 Jul 2026 14:28:33 +0200 Subject: Route IPv6 through WireGuard VPN via radvd and static gateway MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add radvd to gateway role to advertise Pi as high-preference IPv6 default router using the stable ULA prefix (fd1e:.../64). With FritzBox also sending RAs, devices end up with ECMP between Pi and FritzBox. To solve this, add network_ipv6_gateway (Pi's link-local) as a static route with metric 100 to all managed hosts — beats RA metric 425, ensuring all IPv6 default traffic goes through Pi. Fix IPv6 MASQUERADE in gateway-apply-rules: - Direct mode: add MASQUERADE on end0 (LAN devices use ULA source addresses not known to FritzBox, so Pi must NAT them) - FORWARD rules: restrict to RELATED,ESTABLISHED only — previously the broad ACCEPT rule passed un-NAT'd packets alongside masqueraded copies, causing duplicate SYNs, conntrack corruption, and RSTs - MASQUERADE/clear rules: match by interface not by source subnet (devices may use any source address, not just the ULA prefix) - VPN mode return traffic: explicitly restrict to wg+→end0 direction Add network_ipv6_gateway var (optional) to network role NM templates (ethernet, wifi, bridge) — injects a static IPv6 default route at metric 100 when set. Add rpi5 static route to FritzBox link-local so Pi keeps IPv6 after FritzBox RA is disabled. Force SSH to IPv4 for *.local hosts (AddressFamily inet) — prevents Ansible from hanging on mDNS returning multiple IPv6 addresses. Update gateway and pihole READMEs with two-step IPv6 setup process. Co-Authored-By: Claude.ai --- roles/network/meta/argument_specs.yml | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'roles/network/meta') diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml index 5f74b45c..c501d8bb 100644 --- a/roles/network/meta/argument_specs.yml +++ b/roles/network/meta/argument_specs.yml @@ -21,6 +21,10 @@ argument_specs: network_ipv4_dns: type: "str" description: "The network IP(4) gateway to configure when provided" + network_ipv6_gateway: + type: "str" + description: "Static IPv6 default route via router link-local (e.g. fe80::1/end0) — set when router RA is disabled" + required: false network_bridge_interface: type: "str" description: "Physical NIC to enslave as vmbr0 bridge port" -- cgit v1.2.3