blob: cfbe49d385eddb3e5a8aa4e43150aea9730d4789 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
# Gateway Role
Configures a system as a network gateway with dynamic VPN routing capabilities.
## Overview
This role makes a system (typically Raspberry Pi) into a network gateway.
Paired with `wireguard`, and `wg-portal` roles, this can control network VPN transparently.
## Configuration
### Required Variables
```yaml
gateway_enabled: true
gateway_local_ipv4_subnet: "192.168.1.0/24"
gateway_router_interface: "end0"
```
### IPv6 Support (Optional)
IPv6 gateway is enabled by setting both `network_ipv6_address` and `gateway_local_ipv6_subnet`:
```yaml
network_ipv6_address: "2a02:xxxx:xxxx:xxxx::254/64" # Pi's IPv6 address
gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet
```
To disable IPv6 entirely, remove both variables from `host_vars`. The role will:
- Omit `accept_ra` sysctl (no IPv6 interface key written)
- Skip IPv6 iptables masquerade rules (`gateway_local_ipv6_subnet` defaults to `""`)
- Leave `net.ipv6.conf.all.forwarding=0`
**Note:** `accept_ra` is set per-interface (`gateway_router_interface`) only when IPv6 is enabled.
This prevents rogue RA acceptance on WireGuard and LAN interfaces.
## Network Architecture
```txt
Client Devices (192.168.1.0/24)
↓
┌─────────────────────────────┐
│ Raspberry Pi Gateway │
│ (192.168.1.254) │
└─────────────────────────────┘
↓
┌─────────────┬───────────────┐
│ VPN Mode │ Direct Mode │
│ │ │
│ WireGuard │ ISP Router │
│ Tunnel │ (192.168.1.1) │
│ wg-* │ │
└─────────────┴───────────────┘
↓ ↓
VPN Server ────────┴───── Internet
```
**VPN Mode:**
- All traffic NAT'd through `wg+` interfaces
- Pi and client traffic both use VPN exit IP
- Most VPN providers IPv4/IPv6 protocol routing automatically
**Direct Mode Characteristics:**
- All traffic NAT'd through router interface (`end0`)
- Direct IPv4/IPv6 routing to ISP
- Standard internet routing
## Requirements
- **WireGuard Interfaces**: Must follow `wg*` naming pattern (`wg0`, `wg-us1`, etc.)
- **Client Configuration**: Devices must use Pi as default gateway (192.168.1.254)
- **IP Forwarding**: Kernel IP forwarding must be enabled (`net.ipv4.ip_forward=1`)
- **WireGuard Config**: Use default routing (`Table=auto` or unset, NOT `Table=off`)
## Operation
### Event-Based System
```bash
# Check udev rules
cat /etc/udev/rules.d/99-wireguard-gateway.rules
# Monitor VPN mode service
systemctl status gateway-vpn-mode.service
journalctl -u gateway-vpn-mode.service -f
# Monitor direct mode service
systemctl status gateway-direct-mode.service
journalctl -u gateway-direct-mode.service -f
# Test manual execution
/usr/local/bin/gateway-apply-rules vpn
/usr/local/bin/gateway-apply-rules direct
```
### Troubleshooting
```bash
# Verify iptables rules
sudo iptables -L -n -v
sudo iptables -t nat -L -n -v
# Check WireGuard interface detection
ip link show | grep wg
# Test traffic routing
curl -4 ifconfig.co # Should show VPN IP when VPN active
curl -6 ifconfig.co # Should show VPN IPv6 when VPN active
```
|
