diff options
author | Christian Pointner <equinox@spreadspace.org> | 2022-11-20 23:30:14 +0100 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2022-11-20 23:30:14 +0100 |
commit | b6d36823effe31d9c12c927f5d05ddab8c7005c0 (patch) | |
tree | f20a721e510a85da81428b2f7d9f46ae51614b05 /inventory/host_vars/ch-router.yml | |
parent | ch-mimas: external_ip (diff) | |
parent | add wireguard-based remote vpn connections to ch-(pan|mimas) (diff) |
Merge branch 'topic/wireguard-extern-vpn'
Diffstat (limited to 'inventory/host_vars/ch-router.yml')
-rw-r--r-- | inventory/host_vars/ch-router.yml | 48 |
1 files changed, 45 insertions, 3 deletions
diff --git a/inventory/host_vars/ch-router.yml b/inventory/host_vars/ch-router.yml index c0165250..ce4ed984 100644 --- a/inventory/host_vars/ch-router.yml +++ b/inventory/host_vars/ch-router.yml @@ -45,6 +45,8 @@ openwrt_packages_add: - mtr - usbutils - openvpn-openssl + - kmod-wireguard + - wireguard-tools - iptraf-ng - prometheus-node-exporter-lua - prometheus-node-exporter-lua-nat_traffic @@ -156,11 +158,14 @@ openwrt_mixin: define nic_mgmt = eth2 define nic_internal = eth0 define nic_openvpn = extern0 + define nic_remote = remote define prefix_mgmt = {{ network_zones.mgmt.prefix }} define prefix_openvpn = 192.168.8.0/24 + define prefix_remote = 192.168.51.0/24 + define prefix_svc = {{ network_zones.svc.prefix }} define prefixes_internal = { {{ network_zones.svc.prefix }}, {{ network_zones.lan.prefix }} } - + define ip_prometheus_legacy = {{ network_zones.lan.prefix | ansible.utils.ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ansible.utils.ipaddr('address') }} table inet global { ## INPUT @@ -180,7 +185,7 @@ openwrt_mixin: ip protocol icmp accept ip6 nexthdr ipv6-icmp accept tcp dport { {{ ansible_port }} } accept - udp dport { openvpn } accept + udp dport { openvpn, 51820 } accept } chain input_openvpn { @@ -189,10 +194,16 @@ openwrt_mixin: tcp dport { {{ ansible_port }} } accept } + chain input_remote { + ip saddr != $prefix_remote drop + ip protocol icmp accept + tcp dport { {{ ansible_port }} } accept + } + chain input { type filter hook input priority filter; policy drop; ct state vmap { established: accept, related: accept, invalid: drop } - iifname vmap { lo: accept, $nic_mgmt: jump input_mgmt, $nic_internal: jump input_internal, $nic_magenta: jump input_magenta, $nic_openvpn: jump input_openvpn } + iifname vmap { lo: accept, $nic_mgmt: jump input_mgmt, $nic_internal: jump input_internal, $nic_magenta: jump input_magenta, $nic_openvpn: jump input_openvpn, $nic_remote: jump input_remote } } @@ -203,6 +214,8 @@ openwrt_mixin: iif $nic_internal ip saddr $prefixes_internal oif $nic_magenta accept iif $nic_internal ip saddr $prefixes_internal oifname $nic_openvpn ip daddr $prefix_openvpn accept iifname $nic_openvpn ip saddr $prefix_openvpn oif $nic_internal ip daddr $prefixes_internal accept + iif $nic_internal ip saddr { $prefix_svc, $ip_prometheus_legacy } oifname $nic_remote ip daddr $prefix_remote accept + iifname $nic_remote ip saddr $prefix_remote oif $nic_internal ip daddr { $prefix_svc, $ip_prometheus_legacy } accept {% for name, svc in network_services.items() %} iif $nic_magenta oif $nic_internal ip daddr {{ svc.addr }} tcp dport { {{ svc.ports | join(', ') }} } accept comment "Service: {{ name }}" {% endfor %} @@ -341,6 +354,35 @@ openwrt_uci: netmask: "{{ network_zones.lan.prefix | ansible.utils.ipaddr('netmask') }}" gateway: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets['ch-gw-lan']) | ansible.utils.ipaddr('address') }}" + - name: interface 'remote' + options: + proto: wireguard + private_key: "{{ vault_wireguard_remote_private_key }}" + listen_port: 51820 + addresses: + - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets[inventory_hostname]) }}" + nohostroute: 1 + + - name: wireguard_remote 'pan' + options: + public_key: "sd/OqiO0hktuJ3FvIBnM8RJpqG0lkN7wWJjdKbU1TSw=" + # preshared_key: "" + endpoint_host: "{{ hostvars['ch-pan'].network.primary.address | ansible.utils.ipaddr('address') }}" + endpoint_port: 51820 + allowed_ips: + - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-pan']) | ansible.utils.ipaddr('address') }}" + persistent_keepalive: 60 + + - name: wireguard_remote 'mimas' + options: + public_key: "ZpvJ3Myn/FSJTqsEkNB5AQaVAuTqfFFCAqLomkeZV3g=" + # preshared_key: "" + endpoint_host: "{{ hostvars['ch-mimas'].external_ip }}" + endpoint_port: 51820 + allowed_ips: + - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-mimas']) | ansible.utils.ipaddr('address') }}" + persistent_keepalive: 60 + sqm: - name: queue 'magenta' options: |