From 3880136d2d13973825be77934468fed51d01624b Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Tue, 7 Jul 2026 12:28:16 +0200
Subject: Enable ipv6 on the rpi

---
 roles/gateway/templates/gateway-apply-rules.sh.j2 |  2 +-
 roles/pihole/README.md                            | 21 ++++++++++-----------
 2 files changed, 11 insertions(+), 12 deletions(-)

(limited to 'roles')

diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2
index 2e6bfb70..715f6b34 100644
--- a/roles/gateway/templates/gateway-apply-rules.sh.j2
+++ b/roles/gateway/templates/gateway-apply-rules.sh.j2
@@ -57,7 +57,7 @@ apply_direct_rules() {
     iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j ACCEPT
     iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     if [ -n "$GATEWAY_SUBNET_V6" ]; then
-        ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j MASQUERADE
+        # No MASQUERADE for IPv6: LAN devices have public SLAAC addresses, native routing applies
         ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT
         ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j ACCEPT
         ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
diff --git a/roles/pihole/README.md b/roles/pihole/README.md
index 225fa8f9..8324da0e 100644
--- a/roles/pihole/README.md
+++ b/roles/pihole/README.md
@@ -51,18 +51,17 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol
 > router. Pi can only act as IPv6 gateway for wired hosts with static `network_ipv6_gateway` config.
 > radvd is deployed by the `gateway` role when `network_ipv6_address` is defined on the Pi.
 
+- Internet > Account Information >
+  - IPv6 > IPv6 Support > ✅
+  - IPv6 > IPv6 Connectivity > Native IPv4 connection > Use IPv6 via landline connection oor Mobile network > ✅
+  - IPv6 > Connection Settings > Use DHCPv6 Rapid Commit > ❌
+  - IPv6 > Connection Settings > Require certain length of the LAN prefix > ❌
+  - DNS Server > DNSv6 Server > Use Other DNSv6 Servers > {{ pihole_ipv6 }}
+
 - Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 >
   - Router advertisement enable in the LAN > ❌
   - DNSv6 Server in the Home Network >
-    - Also announce DNSv6 server via router advertisement (RFC5006) > ✅
-    - Local DNSv6 server > {{ pihole_ipv6 }}
+    - Also announce DNSv6 server via router advertisement (RFC5006) > ❌
   - DHCPv6 Server in the home network >
-    - Enable DHCPv6 server in the FRITZ!Box for the home network > ✅
-      - Only assign DNS server > ✅
-
-- Internet > Account Information >
-  - IPv6 > IPv6 Support > ✅
-  - IPv6 > IPv6 Connectivity > Native IPv6 connection
-  - IPv6 > Connection Settings > Automatically negotiate a global address
-  - IPv6 > Connection Settings > Use DHCPv6 Rapid Commit > ✅
-  - DNS Server > DNSv6 Server > Use Other DNSv6 Servers > {{ pihole_ipv6 }}
+    - Disable DHCPv6 server in the FRITZ!Box for the home network > ✅
+      - There are no other DHCPv6 servers in the home network. > ✅
-- 
cgit v1.2.3