From 6ddc1505a11c74ffb0c8c65498f5eef5086e62d1 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Wed, 10 Sep 2025 18:09:52 +0200
Subject: Remove wireguard_gateway

This implementation doesn't work properly after testing.
The iptable configuration didn't allow for changing the VPN state
without running into networking issues.

Either have to change the VPN by running the role, which is inconvenient
or reimplement the role differently to allow for control over
network/interfaces
---
 roles/wireguard_gateway/tasks/main.yml | 97 ----------------------------------
 1 file changed, 97 deletions(-)
 delete mode 100644 roles/wireguard_gateway/tasks/main.yml

(limited to 'roles/wireguard_gateway/tasks')

diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml
deleted file mode 100644
index 1c2887dc..00000000
--- a/roles/wireguard_gateway/tasks/main.yml
+++ /dev/null
@@ -1,97 +0,0 @@
----
-- name: "Ensure iptables are installed"
-  become: true
-  ansible.builtin.package:
-    name: "iptables"
-    state: "present"
-
-- name: "Configure IP forwarding"
-  become: true
-  ansible.builtin.blockinfile:
-    path: "/etc/sysctl.conf"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-    prepend_newline: true
-    append_newline: true
-    marker: "# ==== {mark} ANSIBLE WIREGUARD GATEWAY CONFIG"
-    create: true
-    mode: "0644"
-    block: |
-      net.ipv4.ip_forward=1
-      net.ipv6.conf.all.forwarding=1
-  notify: "Reload sysctl"
-
-# IPv4 iptables rules
-- name: "Add IPv4 NAT masquerading for traffic through VPN"
-  become: true
-  ansible.builtin.iptables:
-    table: "nat"
-    chain: "POSTROUTING"
-    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
-    out_interface: "{{ item }}"
-    jump: "MASQUERADE"
-    comment: "NAT local subnet traffic through VPN"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  with_items: "{{ wireguard_connections }}"
-
-- name: "Add IPv4 FORWARD rule to accept traffic from local subnet"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
-    jump: "ACCEPT"
-    comment: "Allow forwarding from local subnet"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-
-- name: "Add IPv4 FORWARD rule to accept established connections"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    match: "conntrack"
-    ctstate: "RELATED,ESTABLISHED"
-    jump: "ACCEPT"
-    comment: "Allow established connections"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-
-# IPv6 iptables rules
-- name: "Add IPv6 NAT masquerading for traffic through VPN"
-  become: true
-  ansible.builtin.iptables:
-    table: "nat"
-    chain: "POSTROUTING"
-    source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}"
-    out_interface: "{{ item }}"
-    jump: "MASQUERADE"
-    comment: "NAT IPv6 local subnet traffic through VPN"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  with_items: "{{ wireguard_connections }}"
-  failed_when: false
-  # NOTE: on github the 'IPv6 default: {}' and that makes the task fails
-  tags:
-    - molecule-idempotence-notest
-
-- name: "Add IPv6 FORWARD rule to accept traffic from local subnet"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}"
-    jump: "ACCEPT"
-    comment: "Allow IPv6 forwarding from local subnet"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  failed_when: false
-  # NOTE: on github the 'IPv6 default: {}' and that makes the task fails
-  tags:
-    - molecule-idempotence-notest
-
-- name: "Add IPv6 FORWARD rule to accept established connections"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    match: "conntrack"
-    ctstate: "RELATED,ESTABLISHED"
-    jump: "ACCEPT"
-    comment: "Allow IPv6 established connections"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  failed_when: false
-- 
cgit v1.2.3