From d5210c0d1632cdbe58f2e1ec0a3e9c36b242df78 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sat, 19 Nov 2022 11:53:33 +0100
Subject: ch-router: add wireguard remote interface (WIP)

---
 inventory/group_vars/chaos-at-home/network.yml |  8 ++++-
 inventory/host_vars/ch-router.yml              | 45 ++++++++++++++++++++++++--
 2 files changed, 50 insertions(+), 3 deletions(-)

(limited to 'inventory')

diff --git a/inventory/group_vars/chaos-at-home/network.yml b/inventory/group_vars/chaos-at-home/network.yml
index f461cc3c..0831d324 100644
--- a/inventory/group_vars/chaos-at-home/network.yml
+++ b/inventory/group_vars/chaos-at-home/network.yml
@@ -87,7 +87,6 @@ network_zones:
       ## legacy stuff
       ch-auth-legacy: 88
 
-
   mgmt:
     vlan: 42
     prefix: 192.168.42.0/24
@@ -120,6 +119,13 @@ network_zones:
     offsets:
       ch-router: 2
 
+  remote:
+    prefix: 192.168.51.0/24
+    offsets:
+      ch-router: 1
+      ch-pan: 2
+      ch-mimas: 3
+
 
 network_services:
   ssh-jump:
diff --git a/inventory/host_vars/ch-router.yml b/inventory/host_vars/ch-router.yml
index c0165250..794ae485 100644
--- a/inventory/host_vars/ch-router.yml
+++ b/inventory/host_vars/ch-router.yml
@@ -45,6 +45,8 @@ openwrt_packages_add:
   - mtr
   - usbutils
   - openvpn-openssl
+  - kmod-wireguard
+  - wireguard-tools
   - iptraf-ng
   - prometheus-node-exporter-lua
   - prometheus-node-exporter-lua-nat_traffic
@@ -156,9 +158,11 @@ openwrt_mixin:
       define nic_mgmt = eth2
       define nic_internal = eth0
       define nic_openvpn = extern0
+      define nic_remote = remote
 
       define prefix_mgmt = {{ network_zones.mgmt.prefix }}
       define prefix_openvpn = 192.168.8.0/24
+      define prefix_remote = 192.168.51.0/24
       define prefixes_internal = { {{ network_zones.svc.prefix }}, {{ network_zones.lan.prefix }} }
 
 
@@ -180,7 +184,7 @@ openwrt_mixin:
           ip protocol icmp accept
           ip6 nexthdr ipv6-icmp accept
           tcp dport { {{ ansible_port }} } accept
-          udp dport { openvpn } accept
+          udp dport { openvpn, 51820 } accept
         }
 
         chain input_openvpn {
@@ -189,10 +193,16 @@ openwrt_mixin:
           tcp dport { {{ ansible_port }} } accept
         }
 
+        chain input_remote {
+          ip saddr != $prefix_remote drop
+          ip protocol icmp accept
+          tcp dport { {{ ansible_port }} } accept
+        }
+
         chain input {
           type filter hook input priority filter; policy drop;
           ct state vmap { established: accept, related: accept, invalid: drop }
-          iifname vmap { lo: accept, $nic_mgmt: jump input_mgmt, $nic_internal: jump input_internal, $nic_magenta: jump input_magenta, $nic_openvpn: jump input_openvpn }
+          iifname vmap { lo: accept, $nic_mgmt: jump input_mgmt, $nic_internal: jump input_internal, $nic_magenta: jump input_magenta, $nic_openvpn: jump input_openvpn, $nic_remote: jump input_remote }
         }
 
 
@@ -203,6 +213,8 @@ openwrt_mixin:
           iif $nic_internal ip saddr $prefixes_internal oif $nic_magenta accept
           iif $nic_internal ip saddr $prefixes_internal oifname $nic_openvpn ip daddr $prefix_openvpn accept
           iifname $nic_openvpn ip saddr $prefix_openvpn oif $nic_internal ip daddr $prefixes_internal accept
+          iif $nic_internal ip saddr $prefixes_internal oifname $nic_remote ip daddr $prefix_remote accept
+          iifname $nic_remote ip saddr $prefix_remote oif $nic_internal ip daddr $prefixes_internal accept ## TODO: review allowed connections
       {% for name, svc in network_services.items() %}
           iif $nic_magenta oif $nic_internal ip daddr {{ svc.addr }} tcp dport { {{ svc.ports | join(', ') }} } accept comment "Service: {{ name }}"
       {% endfor %}
@@ -341,6 +353,35 @@ openwrt_uci:
         netmask: "{{ network_zones.lan.prefix | ansible.utils.ipaddr('netmask') }}"
         gateway: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets['ch-gw-lan']) | ansible.utils.ipaddr('address') }}"
 
+    - name: interface 'remote'
+      options:
+        proto: wireguard
+        private_key: "{{ vault_wireguard_remote_private_key }}"
+        listen_port: 51820
+        addresses:
+        - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets[inventory_hostname]) }}"
+        nohostroute: 1
+
+    - name: wireguard_remote 'ch-pan'
+      options:
+        public_key: "" ## TODO
+        # preshared_key: ""
+        endpoint_host: "{{ hostvars['ch-pan'].network.primary.address | ansible.utils.ipaddr('address') }}"
+        endpoint_port: 51820
+        allowed_ips:
+        - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-pan']) }}"
+        persistent_keepalive: 60
+
+    - name: wireguard_remote 'ch-mimas'
+      options:
+        public_key: "" ## TODO
+        # preshared_key: ""
+        endpoint_host: "{{ hostvars['ch-mimas'].external_ip }}"
+        endpoint_port: 51820
+        allowed_ips:
+        - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-mimas']) }}"
+        persistent_keepalive: 60
+
   sqm:
     - name: queue 'magenta'
       options:
-- 
cgit v1.2.3