--- ssh_keys_root: "{{ ssh_keys.equinox[env_group] + ssh_keys.datacop }}" wireguard_keys: gwhetzner: pub: "fqaKDJbSj6V0H98d78d/lnFLolefgp6zDPH9bN4+zUY=" priv: "{{ vault_wireguard_priv_keys.gwhetzner }}" wireguard_gateway_tunnels: wg-emc: priv_key: "{{ wireguard_keys.gwhetzner.priv }}" addresses: - 192.168.254.6/30 default_gateway: inner: 192.168.254.5 peers: - pub_key: "{{ hostvars['ele-gwhetzner'].wireguard_keys.emc.pub }}" endpoint: host: 178.63.180.138 # TODO: fix this variable "{{ hostvars['ele-gwhetzner'].external_ip }}" port: 51821 keepalive_interval: 15 allowed_ips: - 0.0.0.0/0 network_mgmt_zone: "{{ network_zones.mgmt }}" network_internal_zone_names__emc: - emc network_internal_zone_names__wan: - lan - guest - mixer - infoscreens network_internal_zone_names: "{{ network_internal_zone_names__wan + network_internal_zone_names__emc }}" openwrt_network_external: - name: switch_vlan options: device: 'switch0' ## for some reason vlan-id 502 does not work. why?? #vlan: '{{ network_zones.forum_a1.vlan }}' vlan: '1' ports: '4 6t' - name: interface 'wanforum' options: ## for some reason vlan-id 502 does not work. why?? #ifname: 'eth0.{{ network_zones.forum_a1.vlan }}' ifname: 'eth0.1' proto: dhcp defaultroute: '0' ## see static route 'forumdefault' below accept_ra: 0 - name: rule options: priority: 40000 lookup: 101 - name: route 'forumdefault' options: interface: 'wanforum' table: 101 target: '0.0.0.0/0' gateway: 192.168.0.254 ## A1 router @ForumStadtpark uses this address - name: switch_vlan options: device: 'switch0' ## for some reason vlan-id 502 does not work. why?? #vlan: '{{ network_zones.funkfeuer.vlan }}' vlan: '2' ports: '3 6t' - name: interface 'wanff' options: ## for some reason vlan-id 502 does not work. why?? #ifname: 'eth0.{{ network_zones.funkfeuer.vlan }}' ifname: 'eth0.2' proto: static ipaddr: "{{ network_zones.funkfeuer.prefix | ipaddr(network_zones.funkfeuer.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_zones.funkfeuer.prefix | ipaddr('netmask') }}" accept_ra: 0 - name: rule options: priority: 39000 src: "{{ network_zones.funkfeuer.prefix | ipaddr(network_zones.funkfeuer.offsets[inventory_hostname]) | ipaddr('address') }}/32" lookup: 102 - name: rule options: priority: 39001 mark: 102 lookup: 102 - name: route 'ffdefault' options: interface: 'wanff' table: 102 target: '0.0.0.0/0' gateway: "{{ network_zones.funkfeuer.gateway }}" - name: switch_vlan options: device: 'switch0' ## for some reason vlan-id 512 does not work. why?? #vlan: '{{ network_zones.datacop_lte.vlan }}' vlan: '3' ports: '2 6t' - name: interface 'wanlte' options: ## for some reason vlan-id 512 does not work. why?? #ifname: 'eth0.{{ network_zones.datacop_lte.vlan }}' ifname: 'eth0.3' proto: static ipaddr: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_zones.datacop_lte.prefix | ipaddr('netmask') }}" accept_ra: 0 - name: rule options: priority: 38000 src: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}/32" lookup: 103 - name: rule options: priority: 38001 mark: 103 lookup: 103 - name: route 'ltedefault' options: interface: 'wanlte' table: 103 target: '0.0.0.0/0' gateway: "{{ network_zones.datacop_lte.gateway }}" openwrt_network_internal: "{{ openwrt_network_internal_yaml | from_yaml }}" openwrt_network_internal_yaml: | {% for zone_name in network_internal_zone_names %} - name: switch_vlan options: device: 'switch0' vlan: '{{ network_zones[zone_name].vlan }}' ports: '0t 6t' - name: "interface '{{ zone_name }}'" options: ifname: "eth0.{{ network_zones[zone_name].vlan }}" proto: static ipaddr: "{{ network_zones[zone_name].gateway }}" netmask: "{{ network_zones[zone_name].prefix | ipaddr('netmask') }}" accept_ra: 0 {% if zone_name in network_internal_zone_names__emc %} - name: rule options: priority: 33000 in: "{{ zone_name }}" lookup: 200 {% endif %} {% endfor %} openwrt_network_base: - name: globals 'globals' options: ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" - name: interface 'loopback' options: ifname: lo proto: static ipaddr: 127.0.0.1 netmask: 255.0.0.0 - name: switch options: name: 'switch0' reset: '1' enable_vlan: '1' - name: switch_vlan options: device: 'switch0' vlan: '{{ network_mgmt_zone.vlan }}' ports: '0t 1 6t' - name: interface 'mgmt' options: ifname: "eth0.{{ network_mgmt_zone.vlan }}" proto: static ipaddr: "{{ network_mgmt_zone.prefix | ipaddr(network_mgmt_zone.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_mgmt_zone.prefix | ipaddr('netmask') }}" accept_ra: 0 openwrt_dhcp_external: - name: dhcp 'wanforum' options: interface: 'wanforum' ignore: '1' - name: dhcp 'wanff' options: interface: 'wanff' ignore: '1' - name: dhcp 'wanlte' options: interface: 'wanlte' ignore: '1' openwrt_dhcp_internal: "{{ openwrt_dhcp_internal_yaml | from_yaml }}" openwrt_dhcp_internal_yaml: | {% for zone_name in network_internal_zone_names %} - name: "dhcp '{{ zone_name }}'" options: interface: "{{ zone_name }}" {% if 'dhcp' in network_zones[zone_name] %} start: {{ network_zones[zone_name].dhcp.start }} limit: {{ network_zones[zone_name].dhcp.limit }} leasetime: {{ network_zones[zone_name].dhcp.leasetime | default('12h') }} dhcpv6: 'disabled' ra: 'disabled' {% else %} ignore: '1' {% endif %} {% endfor %} openwrt_dhcp_base: - name: dnsmasq options: domainneeded: '1' boguspriv: '0' filterwin2k: '0' localise_queries: '1' rebind_protection: '0' rebind_localhost: '1' local: '/lan/' domain: 'lan' expandhosts: '1' nonegcache: '0' authoritative: '1' readethers: '1' leasefile: '/tmp/dhcp.leases' resolvfile: '/tmp/resolv.conf.auto' localservice: '1' - name: odhcpd 'odhcpd' options: maindhcp: '0' leasefile: '/tmp/hosts/odhcpd' leasetrigger: '/usr/sbin/odhcpd-update' - name: dhcp 'mgmt' options: interface: 'mgmt' ignore: '1' openwrt_variant: openwrt openwrt_release: 19.07.1 openwrt_arch: ramips openwrt_target: mt7621 openwrt_profile: ubnt-erx openwrt_output_image_suffixes: - "{{ openwrt_profile }}-squashfs-sysupgrade.bin" openwrt_packages_remove: - ppp - ppp-mod-pppoe - firewall - odhcpd-ipv6only openwrt_packages_add: - kmod-ipt-nat - haveged - htop - ip - less - nano - tcpdump-mini - iperf - mtr - iptraf-ng - qos-scripts - wireguard openwrt_mixin: /etc/dropbear/authorized_keys: content: "{{ ssh_keys_root | join('\n') }}\n" /etc/htoprc: file: "{{ global_files_dir }}/common/htoprc" /etc/wireguard/wg-emc.priv: content: "{{ wireguard_gateway_tunnels['wg-emc'].priv_key }}\n" mode: "0600" /etc/rc.d/S21network-emc: link: "../init.d/network-emc" /etc/rc.d/K91network-emc: link: "../init.d/network-emc" /etc/init.d/network-emc: mode: "0755" content: | #!/bin/sh /etc/rc.common START=21 STOP=91 start() { ip link add dev wg-emc type wireguard wg set wg-emc fwmark 102 private-key /etc/wireguard/wg-emc.priv {% for peer in wireguard_gateway_tunnels['wg-emc'].peers %} wg set wg-emc peer {{ peer.pub_key }} endpoint {{ peer.endpoint.host }}:{{ peer.endpoint.port }} persistent-keepalive {{ peer.keepalive_interval }} allowed-ips {{ peer.allowed_ips | join(',') }} {% endfor %} {% for addr in wireguard_gateway_tunnels['wg-emc'].addresses %} ip addr add dev wg-emc {{ addr }} {% endfor %} ip link set up dev wg-emc ip route add default via {{ wireguard_gateway_tunnels['wg-emc'].default_gateway.inner }} table 200 proto static } stop() { ip link del dev wg-emc ip rule del pref 33000 } /etc/rc.d/S22network-fw: link: "../init.d/network-fw" /etc/rc.d/K92network-fw: link: "../init.d/network-fw" /etc/init.d/network-fw: mode: "0755" content: | #!/bin/sh /etc/rc.common START=22 STOP=91 start() { WAN_IF=$(uci get network.wanforum.ifname) FF_IF=$(uci get network.wanff.ifname) LTE_IF=$(uci get network.wanlte.ifname) MGMT_IF=$(uci get network.mgmt.ifname) MGMT_IPADDR=$(uci get network.mgmt.ipaddr) MGMT_NETMASK=$(uci get network.mgmt.netmask) iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT ### todo: limit the destination address? iptables -A INPUT -i "$WAN_IF" -p icmp -j ACCEPT iptables -A INPUT -i "$WAN_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "$WAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -i "$FF_IF" -p icmp -j ACCEPT iptables -A INPUT -i "$FF_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "$FF_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -i "$LTE_IF" -p icmp -j ACCEPT iptables -A INPUT -i "$LTE_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "$LTE_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -i "wg-emc" -p icmp -j ACCEPT iptables -A INPUT -i "wg-emc" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "wg-emc" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -o "wg-emc" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # all internal zones for zone in {{ network_internal_zone_names | join(' ') }}; do interface=$(uci get "network.$zone.ifname") ipaddr=$(uci get "network.$zone.ipaddr") netmask=$(uci get "network.$zone.netmask") ### todo: only add this if dhcp is in network_zones[zone] iptables -A INPUT -i "$interface" -p udp --dport 67 --sport 68 -j ACCEPT ### todo: only do this if dhcp is in network_zones[zone] or $ipaddr is in network_zones[zone].dns iptables -A INPUT -i "$interface" -p udp --dport 53 -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT iptables -A INPUT -i "$interface" -p tcp --dport 53 -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT iptables -A INPUT -i "$interface" -p icmp -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT iptables -A INPUT -i "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT case "$zone" in {{ network_internal_zone_names__wan | join('|') }}) iptables -A FORWARD -i "$interface" -o "$WAN_IF" -s "$ipaddr/$netmask" -j ACCEPT iptables -A FORWARD -i "$WAN_IF" -o "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -t nat -A POSTROUTING -o "$WAN_IF" -s "$ipaddr/$netmask" -j MASQUERADE ;; {{ network_internal_zone_names__emc | join('|') }}) iptables -A FORWARD -i "$interface" -o "wg-emc" -s "$ipaddr/$netmask" -j ACCEPT iptables -A FORWARD -i "wg-emc" -o "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -t nat -A POSTROUTING -o "wg-emc" -s "$ipaddr/$netmask" -j MASQUERADE ;; esac done iptables -P INPUT DROP iptables -P FORWARD DROP } stop() { iptables -P INPUT ACCEPT iptables -F INPUT iptables -P FORWARD ACCEPT iptables -F FORWARD iptables -t nat -F POSTROUTING } openwrt_uci: system: - name: system options: hostname: '{{ host_name }}' timezone: 'CET-1CEST,M3.5.0,M10.5.0/3' ttylogin: '0' log_size: '64' urandom_seed: '0' - name: timeserver 'ntp' options: enabled: '1' enable_server: '0' server: - '0.lede.pool.ntp.org' - '1.lede.pool.ntp.org' - '2.lede.pool.ntp.org' - '3.lede.pool.ntp.org' - name: gpio_switch 'poe_passthrough' options: name: 'PoE Passthrough' gpio_pin: '0' value: '0' dropbear: - name: dropbear options: PasswordAuth: 'off' RootPasswordAuth: 'off' Port: '{{ ansible_port }}' dhcp: "{{ openwrt_dhcp_base + openwrt_dhcp_internal + openwrt_dhcp_external }}" network: "{{ openwrt_network_base + openwrt_network_internal + openwrt_network_external }}"