From 4b1ba9064c70f9d0226668c01e46285f4c50927f Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Tue, 2 Sep 2025 03:16:55 +0200
Subject: Fix wireguard_gateway test on CI

Allow the wireguard_gateway to configure all forwarding for all the
interfaces available for the connections
---
 roles/wireguard_gateway/tasks/main.yml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

(limited to 'roles')

diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml
index bfd54886..f8cb1ed0 100644
--- a/roles/wireguard_gateway/tasks/main.yml
+++ b/roles/wireguard_gateway/tasks/main.yml
@@ -27,11 +27,11 @@
     table: "nat"
     chain: "POSTROUTING"
     source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
-    out_interface: "{{ wireguard_autostart_connection }}"
+    out_interface: "{{ item }}"
     jump: "MASQUERADE"
     comment: "NAT local subnet traffic through VPN"
     state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  when: ansible_default_ipv4.address is defined
+  with_items: "{{ wireguard_connections }}"
 
 - name: "Add IPv4 FORWARD rule to accept traffic from local subnet"
   become: true
@@ -41,7 +41,6 @@
     jump: "ACCEPT"
     comment: "Allow forwarding from local subnet"
     state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  when: ansible_default_ipv4.address is defined
 
 - name: "Add IPv4 FORWARD rule to accept established connections"
   become: true
@@ -52,7 +51,6 @@
     jump: "ACCEPT"
     comment: "Allow established connections"
     state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  when: ansible_default_ipv4.address is defined
 
 # IPv6 iptables rules
 - name: "Add IPv6 NAT masquerading for traffic through VPN"
@@ -61,12 +59,12 @@
     table: "nat"
     chain: "POSTROUTING"
     source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}"
-    out_interface: "{{ wireguard_autostart_connection }}"
+    out_interface: "{{ item }}"
     jump: "MASQUERADE"
     comment: "NAT IPv6 local subnet traffic through VPN"
     ip_version: "ipv6"
     state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  when: ansible_default_ipv6.address is defined
+  with_items: "{{ wireguard_connections }}"
 
 - name: "Add IPv6 FORWARD rule to accept traffic from local subnet"
   become: true
@@ -77,7 +75,6 @@
     comment: "Allow IPv6 forwarding from local subnet"
     ip_version: "ipv6"
     state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  when: ansible_default_ipv6.address is defined
 
 - name: "Add IPv6 FORWARD rule to accept established connections"
   become: true
@@ -89,4 +86,3 @@
     comment: "Allow IPv6 established connections"
     ip_version: "ipv6"
     state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  when: ansible_default_ipv6.address is defined
-- 
cgit v1.2.3