blob: eda1b0871b17e6247af9116199c1cd97021a5b60 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
# Gateway Role
Configures a system as a network gateway with dynamic VPN routing capabilities.
## Overview
This role makes a system (typically Raspberry Pi) into a network gateway.
Paired with `wireguard`, and `wg-portal` roles, this can control network VPN transparently.
## Configuration
### Required Variables
```yaml
gateway_enabled: true
gateway_local_ipv4_subnet: "192.168.1.0/24"
gateway_router_interface: "end0"
```
## Network Architecture
```txt
Client Devices (192.168.1.0/24)
↓
┌─────────────────────────────┐
│ Raspberry Pi Gateway │
│ (192.168.1.254) │
└─────────────────────────────┘
↓
┌─────────────┬───────────────┐
│ VPN Mode │ Direct Mode │
│ │ │
│ WireGuard │ ISP Router │
│ Tunnel │ (192.168.1.1) │
│ wg-* │ │
└─────────────┴───────────────┘
↓ ↓
VPN Server ────────┴───── Internet
```
**VPN Mode:**
- All traffic NAT'd through `wg+` interfaces
- Pi and client traffic both use VPN exit IP
**Direct Mode Characteristics:**
- IPv4 traffic NAT'd through router interface (`end0`)
## Requirements
- **WireGuard Interfaces**: Must follow `wg*` naming pattern (`wg0`, `wg-us1`, etc.)
- **Client Configuration**: Devices must use Pi as default gateway (192.168.1.254)
- **IP Forwarding**: Kernel IP forwarding must be enabled (`net.ipv4.ip_forward=1`)
- **WireGuard Config**: Use default routing (`Table=auto` or unset, NOT `Table=off`)
## Operation
### Event-Based System
```bash
# Check udev rules
cat /etc/udev/rules.d/99-wireguard-gateway.rules
# Monitor VPN mode service
systemctl status gateway-vpn-mode.service
journalctl -u gateway-vpn-mode.service -f
# Monitor direct mode service
systemctl status gateway-direct-mode.service
journalctl -u gateway-direct-mode.service -f
# Test manual execution
/usr/local/bin/gateway-apply-rules vpn
/usr/local/bin/gateway-apply-rules direct
```
### Troubleshooting
```bash
# Verify iptables rules
sudo iptables -L -n -v
sudo iptables -t nat -L -n -v
# Test traffic routing
curl -4 ifconfig.co # Should show VPN IP when VPN active
```
|
