From a895214d8fe4b515fbef15a7f919c5177543ac56 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sat, 29 Feb 2020 03:29:26 +0100
Subject: wireguard gateway works now (it is quite ugly though)

---
 roles/wireguard/gateway/tasks/main.yml             | 48 ++++++++++++++++++++++
 .../gateway/tasks/systemd-iptables.service.j2      | 42 +++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 roles/wireguard/gateway/tasks/systemd-iptables.service.j2

(limited to 'roles/wireguard/gateway/tasks')

diff --git a/roles/wireguard/gateway/tasks/main.yml b/roles/wireguard/gateway/tasks/main.yml
index 906ee640..bc14db1b 100644
--- a/roles/wireguard/gateway/tasks/main.yml
+++ b/roles/wireguard/gateway/tasks/main.yml
@@ -18,3 +18,51 @@
     src: systemd.network.j2
     dest: "/etc/systemd/network/{{ item.key }}.network"
   notify: restart systemd-networkd
+
+- name: enable systemd-networkd
+  systemd:
+    name: systemd-networkd
+    enabled: yes
+    state: started
+
+
+- name: create iptables service unit
+  loop: "{{ wireguard_gateway_tunnels | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: "'ip_snat' in item.value or 'port_forwardings' in item.value"
+  template:
+    src: systemd-iptables.service.j2
+    dest: "/etc/systemd/system/wireguard-gateway-{{ item.key }}-iptables.service"
+
+- name: enable/start iptables service unit
+  loop: "{{ wireguard_gateway_tunnels | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: "'ip_snat' in item.value or 'port_forwardings' in item.value"
+  systemd:
+    daemon_reload: yes
+    name: "wireguard-gateway-{{ item.key }}-iptables.service"
+    enabled: yes
+    state: started
+
+
+- name: install workaround for default-gateway handling
+  loop: "{{ wireguard_gateway_tunnels | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: "'default_gateway' in item.value"
+  template:
+    src: systemd-fix-default-gw.service.j2
+    dest: "/etc/systemd/system/wireguard-gateway-{{ item.key }}-fix-default-gw.service"
+
+- name: enable/start workaround for default-gateway handling
+  loop: "{{ wireguard_gateway_tunnels | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: "'default_gateway' in item.value"
+  systemd:
+    daemon_reload: yes
+    name: "wireguard-gateway-{{ item.key }}-fix-default-gw.service"
+    enabled: yes
+    state: started
diff --git a/roles/wireguard/gateway/tasks/systemd-iptables.service.j2 b/roles/wireguard/gateway/tasks/systemd-iptables.service.j2
new file mode 100644
index 00000000..11cf4b8a
--- /dev/null
+++ b/roles/wireguard/gateway/tasks/systemd-iptables.service.j2
@@ -0,0 +1,42 @@
+[Unit]
+Wants=network-online.target
+After=network-online.target
+
+
+[Service]
+Type=oneshot
+
+{% if 'ip_snat' in item.value %}
+ExecStart=/usr/sbin/sysctl net.ipv4.ip_forward=1
+{%   for addr in item.value.addresses %}
+ExecStart=/sbin/iptables -t nat -A POSTROUTING -s {{ addr | ipaddr('network/prefix') }} -o {{ item.value.ip_snat.interface }} -j SNAT --to {{ item.value.ip_snat.to }}
+{%   endfor %}
+{% endif %}
+{% for forward in item.value.port_forwardings | default([]) %}
+{%   for port in forward.tcp_ports | default([]) %}
+ExecStart=/sbin/iptables -t nat -A PREROUTING -d {{ forward.dest }} -p tcp --dport {{ port }} -j DNAT --to {{ forward.tcp_ports[port] }}
+{%   endfor %}
+{%   for port in forward.udp_ports | default([]) %}
+ExecStart=/sbin/iptables -t nat -A PREROUTING -d {{ forward.dest }} -p udp --dport {{ port }} -j DNAT --to {{ forward.udp_ports[port] }}
+{%   endfor %}
+{% endfor %}
+
+{% if 'ip_snat' in item.value %}
+{%   for addr in item.value.addresses %}
+ExecStop=/sbin/iptables -t nat -D POSTROUTING -s {{ addr | ipaddr('network/prefix') }} -o {{ item.value.ip_snat.interface }} -j SNAT --to {{ item.value.ip_snat.to }}
+{%   endfor %}
+{% endif %}
+{% for forward in item.value.port_forwardings | default([]) %}
+{%   for port in forward.tcp_ports | default([]) %}
+ExecStop=/sbin/iptables -t nat -D PREROUTING -d {{ forward.dest }} -p tcp --dport {{ port }} -j DNAT --to {{ forward.tcp_ports[port] }}
+{%   endfor %}
+{%   for port in forward.udp_ports | default([]) %}
+ExecStop=/sbin/iptables -t nat -D PREROUTING -d {{ forward.dest }} -p udp --dport {{ port }} -j DNAT --to {{ forward.udp_ports[port] }}
+{%   endfor %}
+{% endfor %}
+
+RemainAfterExit=yes
+
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3