blob: 6c46cc9b96ab8f44c222d8e8634788ab68fe93ff (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
# Gateway Role
Configures a system as a network gateway with dynamic VPN routing capabilities.
## Overview
This role makes a system (typically Raspberry Pi) into a network gateway.
Paired with `wireguard`, and `wg-portal` roles, this can control network VPN transparently.
## Configuration
### Required Variables
```yaml
gateway_enabled: true
gateway_local_ipv4_subnet: "192.168.1.0/24"
gateway_router_interface: "end0"
```
### IPv6 Support (Optional)
IPv6 gateway is enabled by setting `gateway_local_ipv6_subnet` to the ULA prefix advertised by radvd:
```yaml
gateway_local_ipv6_subnet: "fd00:xxxx:xxxx:xxxx::/64" # ULA prefix (stable, router-independent)
```
When set, this role:
- Enables `net.ipv6.conf.all.forwarding=1` and `accept_ra=2` on `gateway_router_interface`
- Deploys radvd advertising the ULA prefix with `AdvDefaultPreference high` — Pi wins as IPv6 default router
- Adds ip6tables MASQUERADE/FORWARD rules matching by interface (not subnet) so all source addresses are handled
**Prerequisite:** Disable the router's RA (FritzBox: Home Network > IPv6 > Router advertisement > ❌) after
setting `network_ipv6_gateway` in `host_vars` so Pi keeps its static IPv6 default route to the router.
See `roles/pihole/README.md` for the full two-step setup.
To disable IPv6, leave `gateway_local_ipv6_subnet: ""` (default). The role skips all ip6tables rules and disables radvd.
## Network Architecture
```txt
Client Devices (192.168.1.0/24)
↓
┌─────────────────────────────┐
│ Raspberry Pi Gateway │
│ (192.168.1.254) │
└─────────────────────────────┘
↓
┌─────────────┬───────────────┐
│ VPN Mode │ Direct Mode │
│ │ │
│ WireGuard │ ISP Router │
│ Tunnel │ (192.168.1.1) │
│ wg-* │ │
└─────────────┴───────────────┘
↓ ↓
VPN Server ────────┴───── Internet
```
**VPN Mode:**
- All traffic NAT'd through `wg+` interfaces
- Pi and client traffic both use VPN exit IP
- Most VPN providers IPv4/IPv6 protocol routing automatically
**Direct Mode Characteristics:**
- IPv4 traffic NAT'd through router interface (`end0`)
- IPv6 forwarded without NAT (globally routable addresses, native routing)
- Standard internet routing via ISP
## Requirements
- **WireGuard Interfaces**: Must follow `wg*` naming pattern (`wg0`, `wg-us1`, etc.)
- **Client Configuration**: Devices must use Pi as default gateway (192.168.1.254)
- **IP Forwarding**: Kernel IP forwarding must be enabled (`net.ipv4.ip_forward=1`)
- **WireGuard Config**: Use default routing (`Table=auto` or unset, NOT `Table=off`)
## Operation
### Event-Based System
```bash
# Check udev rules
cat /etc/udev/rules.d/99-wireguard-gateway.rules
# Monitor VPN mode service
systemctl status gateway-vpn-mode.service
journalctl -u gateway-vpn-mode.service -f
# Monitor direct mode service
systemctl status gateway-direct-mode.service
journalctl -u gateway-direct-mode.service -f
# Test manual execution
/usr/local/bin/gateway-apply-rules vpn
/usr/local/bin/gateway-apply-rules direct
```
### Troubleshooting
```bash
# Verify iptables rules
sudo iptables -L -n -v
sudo iptables -t nat -L -n -v
# Check WireGuard interface detection
ip link show | grep wg
# Test traffic routing
curl -4 ifconfig.co # Should show VPN IP when VPN active
curl -6 ifconfig.co # Should show VPN IPv6 when VPN active
```
|
