wireguard/gateway: switch to nftables

8 files changed, 66 insertions, 83 deletions

diff --git a/dan/ele-gwhetzner.yml b/dan/ele-gwhetzner.yml
index 8dd65f13..bcd75bcd 100644
--- a/dan/ele-gwhetzner.yml
+++ b/dan/ele-gwhetzner.yml
@@ -9,4 +9,5 @@
   - role: core/ntp
   - role: network/wireguard/base
   - role: network/wireguard/p2p
-  # - role: network/wireguard/gateway
+  - role: network/nftables/base
+  - role: network/wireguard/gateway
diff --git a/dan/ele-media.yml b/dan/ele-media.yml
index e5509155..5f1fd826 100644
--- a/dan/ele-media.yml
+++ b/dan/ele-media.yml
@@ -13,8 +13,8 @@
   - role: apt-repo/spreadspace
   - role: kubernetes/base
   - role: kubernetes/standalone/base
-#  - role: network/wireguard/base
-#  - role: network/wireguard/gateway
+  - role: network/wireguard/base
+  - role: network/wireguard/gateway
 
 #  - role: dyndns/client
 #  - role: acmetool/base
diff --git a/inventory/host_vars/ele-media.yml b/inventory/host_vars/ele-media.yml
index e4239ed1..a0a203ba 100644
--- a/inventory/host_vars/ele-media.yml
+++ b/inventory/host_vars/ele-media.yml
@@ -64,6 +64,29 @@ zfs_pools:
     create_vdevs: raidz /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N2AYHY8E /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4ND0PVLUE /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N6PJ1CSJ /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N3YN09NC
 
 
+wireguard_keys:
+  gwhetzner:
+    pub: "YO78lnFJdlGnKxBrtVZF4QXF7bpF8rAP7yF97klWLzg="
+    priv: "{{ vault_wireguard_priv_keys.gwhetzner }}"
+
+wireguard_gateway_tunnels:
+  wg-gwhetzner:
+    priv_key: "{{ wireguard_keys.gwhetzner.priv }}"
+    addresses:
+    - 192.168.254.2/30
+    default_gateway:
+      outer: 178.63.180.138
+      inner: 192.168.254.1
+    peers:
+    - pub_key: "{{ hostvars['ele-gwhetzner'].wireguard_keys.elemedia.pub }}"
+      endpoint:
+        host: 178.63.180.138 # TODO: fix this variable "{{ hostvars['ele-gwhetzner'].external_ip }}"
+        port: 51820
+      keepalive_interval: 15
+      allowed_ips:
+      - 0.0.0.0/0
+
+
 # dyndns:
 #   server: ch-pan
 
@@ -97,26 +120,3 @@ zfs_pools:
 #     lv: ncdata
 #     size: 150G
 #     fs: ext4
-
-
-# wireguard_keys:
-#   gwhetzner:
-#     pub: "YO78lnFJdlGnKxBrtVZF4QXF7bpF8rAP7yF97klWLzg="
-#     priv: "{{ vault_wireguard_priv_keys.gwhetzner }}"
-
-# wireguard_gateway_tunnels:
-#   wg-gwhetzner:
-#     priv_key: "{{ wireguard_keys.gwhetzner.priv }}"
-#     addresses:
-#     - 192.168.254.2/30
-#     default_gateway:
-#       outer: 178.63.180.138
-#       inner: 192.168.254.1
-#     peers:
-#     - pub_key: "{{ hostvars['ele-gwhetzner'].wireguard_keys.elemedia.pub }}"
-#       endpoint:
-#         host: 178.63.180.138 # TODO: fix this variable "{{ hostvars['ele-gwhetzner'].external_ip }}"
-#         port: 51820
-#       keepalive_interval: 15
-#       allowed_ips:
-#       - 0.0.0.0/0
diff --git a/roles/network/wireguard/gateway/handlers/main.yml b/roles/network/wireguard/gateway/handlers/main.yml
index 625032dc..4454e240 100644
--- a/roles/network/wireguard/gateway/handlers/main.yml
+++ b/roles/network/wireguard/gateway/handlers/main.yml
@@ -4,3 +4,8 @@
     daemon_reload: yes
     name: systemd-networkd
     state: restarted
+
+- name: reload nftables
+  service:
+    name: nftables
+    state: reloaded
diff --git a/roles/network/wireguard/gateway/tasks/main.yml b/roles/network/wireguard/gateway/tasks/main.yml
index bc14db1b..0234fc6c 100644
--- a/roles/network/wireguard/gateway/tasks/main.yml
+++ b/roles/network/wireguard/gateway/tasks/main.yml
@@ -26,25 +26,15 @@
     state: started
 
 
-- name: create iptables service unit
+- name: install nftables rules
   loop: "{{ wireguard_gateway_tunnels | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
   when: "'ip_snat' in item.value or 'port_forwardings' in item.value"
   template:
-    src: systemd-iptables.service.j2
-    dest: "/etc/systemd/system/wireguard-gateway-{{ item.key }}-iptables.service"
-
-- name: enable/start iptables service unit
-  loop: "{{ wireguard_gateway_tunnels | dict2items }}"
-  loop_control:
-    label: "{{ item.key }}"
-  when: "'ip_snat' in item.value or 'port_forwardings' in item.value"
-  systemd:
-    daemon_reload: yes
-    name: "wireguard-gateway-{{ item.key }}-iptables.service"
-    enabled: yes
-    state: started
+    src: nftables.rules.j2
+    dest: "/etc/nftables.d/wireguard-gateway-{{ item.key }}.nft"
+  notify: reload nftables
 
 
 - name: install workaround for default-gateway handling
diff --git a/roles/network/wireguard/gateway/templates/nftables.rules.j2 b/roles/network/wireguard/gateway/templates/nftables.rules.j2
new file mode 100644
index 00000000..fcf4a21b
--- /dev/null
+++ b/roles/network/wireguard/gateway/templates/nftables.rules.j2
@@ -0,0 +1,26 @@
+# {{ ansible_managed }}
+{% if 'ip_snat' in item.value %}
+
+table ip nat {
+  chain wireguard-gateway-{{ item.key }}-snat {
+    type nat hook postrouting priority 100; policy accept;
+    ip saddr { {{ item.value.addresses | map('ipaddr', 'network/prefix') | join(', ') }} } oifname {{ item.value.ip_snat.interface }} snat to {{ item.value.ip_snat.to }}
+  }
+}
+{% endif %}
+{% if 'port_forwardings' in item.value %}
+
+table ip nat {
+  chain wireguard-gateway-{{ item.key }}-port-forwardings {
+    type nat hook prerouting priority -100; policy accept;
+{%   for forward in item.value.port_forwardings %}
+{%     for port in forward.tcp_ports | default([]) %}
+    ip daddr {{ forward.dest }} tcp dport {{ port }} dnat to {{ forward.tcp_ports[port] }}
+{%     endfor %}
+{%     for port in forward.udp_ports | default([]) %}
+    ip daddr {{ forward.dest }} udp dport {{ port }} dnat to {{ forward.udp_ports[port] }}
+{%     endfor %}
+{%   endfor %}
+  }
+}
+{% endif %}
diff --git a/roles/network/wireguard/gateway/templates/systemd-iptables.service.j2 b/roles/network/wireguard/gateway/templates/systemd-iptables.service.j2
deleted file mode 100644
index 11cf4b8a..00000000
--- a/roles/network/wireguard/gateway/templates/systemd-iptables.service.j2
+++ /dev/null
@@ -1,42 +0,0 @@
-[Unit]
-Wants=network-online.target
-After=network-online.target
-
-
-[Service]
-Type=oneshot
-
-{% if 'ip_snat' in item.value %}
-ExecStart=/usr/sbin/sysctl net.ipv4.ip_forward=1
-{%   for addr in item.value.addresses %}
-ExecStart=/sbin/iptables -t nat -A POSTROUTING -s {{ addr | ipaddr('network/prefix') }} -o {{ item.value.ip_snat.interface }} -j SNAT --to {{ item.value.ip_snat.to }}
-{%   endfor %}
-{% endif %}
-{% for forward in item.value.port_forwardings | default([]) %}
-{%   for port in forward.tcp_ports | default([]) %}
-ExecStart=/sbin/iptables -t nat -A PREROUTING -d {{ forward.dest }} -p tcp --dport {{ port }} -j DNAT --to {{ forward.tcp_ports[port] }}
-{%   endfor %}
-{%   for port in forward.udp_ports | default([]) %}
-ExecStart=/sbin/iptables -t nat -A PREROUTING -d {{ forward.dest }} -p udp --dport {{ port }} -j DNAT --to {{ forward.udp_ports[port] }}
-{%   endfor %}
-{% endfor %}
-
-{% if 'ip_snat' in item.value %}
-{%   for addr in item.value.addresses %}
-ExecStop=/sbin/iptables -t nat -D POSTROUTING -s {{ addr | ipaddr('network/prefix') }} -o {{ item.value.ip_snat.interface }} -j SNAT --to {{ item.value.ip_snat.to }}
-{%   endfor %}
-{% endif %}
-{% for forward in item.value.port_forwardings | default([]) %}
-{%   for port in forward.tcp_ports | default([]) %}
-ExecStop=/sbin/iptables -t nat -D PREROUTING -d {{ forward.dest }} -p tcp --dport {{ port }} -j DNAT --to {{ forward.tcp_ports[port] }}
-{%   endfor %}
-{%   for port in forward.udp_ports | default([]) %}
-ExecStop=/sbin/iptables -t nat -D PREROUTING -d {{ forward.dest }} -p udp --dport {{ port }} -j DNAT --to {{ forward.udp_ports[port] }}
-{%   endfor %}
-{% endfor %}
-
-RemainAfterExit=yes
-
-
-[Install]
-WantedBy=multi-user.target
diff --git a/roles/network/wireguard/gateway/templates/systemd.network.j2 b/roles/network/wireguard/gateway/templates/systemd.network.j2
index 6847aa6a..d1dd2139 100644
--- a/roles/network/wireguard/gateway/templates/systemd.network.j2
+++ b/roles/network/wireguard/gateway/templates/systemd.network.j2
@@ -6,7 +6,10 @@ Name={{ item.key }}
 Address={{ addr }}
 {% endfor %}
 {% if 'ip_masq' in item.value and item.value.ip_masq %}
-IPMasquerade=yes
+IPMasquerade=ipv4
+{% endif %}
+{% if 'ip_snat' in item.value %}
+IPForward=ipv4
 {% endif %}
 {% if 'default_gateway' in item.value %}