--- ssh_users_root: - equinox - datacop network_mgmt_zone: "{{ network_zones.mgmt }}" wireguard_keys: gwhetzner: pub: "fqaKDJbSj6V0H98d78d/lnFLolefgp6zDPH9bN4+zUY=" priv: "{{ vault_wireguard_priv_keys.gwhetzner }}" wireguard_gateway_tunnels: wg-emc: priv_key: "{{ wireguard_keys.gwhetzner.priv }}" addresses: - 192.168.254.6/30 default_gateway: inner: 192.168.254.5 peers: - pub_key: "{{ hostvars['ele-gwhetzner'].wireguard_keys.emc.pub }}" endpoint: host: 178.63.180.138 # TODO: fix this variable "{{ hostvars['ele-gwhetzner'].external_ip }}" port: 51821 keepalive_interval: 15 allowed_ips: - 0.0.0.0/0 openwrt_network_external: - name: interface 'wanmur' options: ifname: 'eth5' proto: static ipaddr: "{{ network_zones.murat_transfer.prefix | ipaddr(network_zones.murat_transfer.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_zones.murat_transfer.prefix | ipaddr('netmask') }}" accept_ra: 0 - name: rule options: priority: 41050 src: "{{ network_zones.murat_transfer.prefix | ipaddr(network_zones.murat_transfer.offsets[inventory_hostname]) | ipaddr('address') }}/32" lookup: 105 - name: rule options: priority: 41051 mark: 105 lookup: 105 - name: route 'murdefault' options: interface: 'wanmur' table: 105 target: '0.0.0.0/0' gateway: "{{ network_zones.murat_transfer.prefix | ipaddr(network_zones.murat_transfer.offsets['ele-mur']) | ipaddr('address') }}" - name: interface 'wanlte' options: ifname: 'eth4' proto: static ipaddr: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_zones.datacop_lte.prefix | ipaddr('netmask') }}" accept_ra: 0 - name: rule options: priority: 41040 src: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}/32" lookup: 104 - name: rule options: priority: 41041 mark: 104 lookup: 104 - name: route 'ltedefault' options: interface: 'wanlte' table: 104 target: '0.0.0.0/0' gateway: "{{ network_zones.datacop_lte.gateway }}" - name: rule options: priority: 50000 lookup: 105 network_internal_zone_names__wanmur: - lan - guest - mixer - infoscreens network_internal_zone_names__wanlte: [] network_internal_zone_names__wgemc: - emc network_internal_zone_names: "{{ network_internal_zone_names__wanmur + network_internal_zone_names__wanlte + network_internal_zone_names__wgemc }}" openwrt_network_internal: "{{ openwrt_network_internal_yaml | from_yaml }}" openwrt_network_internal_yaml: | {% for zone_name in network_internal_zone_names %} - name: "interface '{{ zone_name }}'" options: ifname: "eth0.{{ network_zones[zone_name].vlan }}" proto: static ipaddr: "{{ network_zones[zone_name].gateway }}" netmask: "{{ network_zones[zone_name].prefix | ipaddr('netmask') }}" accept_ra: 0 {% endfor %} openwrt_network_base: - name: globals 'globals' options: ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" - name: interface 'loopback' options: ifname: lo proto: static ipaddr: 127.0.0.1 netmask: 255.0.0.0 - name: interface 'mgmt' options: ifname: "eth0.{{ network_mgmt_zone.vlan }}" proto: static ipaddr: "{{ network_mgmt_zone.prefix | ipaddr(network_mgmt_zone.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_mgmt_zone.prefix | ipaddr('netmask') }}" accept_ra: 0 openwrt_dhcp_external: - name: dhcp 'wanmur' options: interface: 'wanmur' ignore: '1' - name: dhcp 'wanlte' options: interface: 'wanlte' ignore: '1' openwrt_dhcp_internal: "{{ openwrt_dhcp_internal_yaml | from_yaml }}" openwrt_dhcp_internal_yaml: | {% for zone_name in network_internal_zone_names %} - name: "dhcp '{{ zone_name }}'" options: interface: "{{ zone_name }}" {% if 'dhcp' in network_zones[zone_name] %} start: {{ network_zones[zone_name].dhcp.start }} limit: {{ network_zones[zone_name].dhcp.limit }} leasetime: {{ network_zones[zone_name].dhcp.leasetime | default('12h') }} dhcpv6: 'disabled' ra: 'disabled' {% else %} ignore: '1' {% endif %} {% endfor %} openwrt_dhcp_base: - name: dnsmasq options: domainneeded: '1' boguspriv: '0' filterwin2k: '0' localise_queries: '1' rebind_protection: '0' rebind_localhost: '1' local: '/lan/' domain: 'lan' expandhosts: '1' nonegcache: '0' authoritative: '1' readethers: '1' leasefile: '/tmp/dhcp.leases' resolvfile: '/tmp/resolv.conf.auto' localservice: '1' server: - 1.1.1.1 - name: odhcpd 'odhcpd' options: maindhcp: '0' leasefile: '/tmp/hosts/odhcpd' leasetrigger: '/usr/sbin/odhcpd-update' - name: dhcp 'mgmt' options: interface: 'mgmt' ignore: '1' install_playbook: openwrt openwrt_variant: openwrt openwrt_release: 19.07.7 openwrt_arch: x86 openwrt_target: 64 openwrt_profile: Generic openwrt_output_image_suffixes: - "combined-ext4.img.gz" openwrt_packages_remove: - ppp - ppp-mod-pppoe - firewall - odhcpd-ipv6only openwrt_packages_add: - kmod-ipt-nat - kmod-ipt-conntrack - haveged - htop - ip - less - nano - tcpdump-mini - iperf - iperf3 - mtr - iptraf-ng - qos-scripts - wireguard - prometheus-node-exporter-lua - prometheus-node-exporter-lua-nat_traffic - prometheus-node-exporter-lua-netstat - prometheus-node-exporter-lua-openwrt openwrt_mixin: /etc/dropbear/authorized_keys: content: "{{ ssh_keys_root | join('\n') }}\n" /etc/htoprc: file: "{{ global_files_dir }}/common/htoprc" /etc/wireguard/wg-emc.priv: content: "{{ wireguard_gateway_tunnels['wg-emc'].priv_key }}\n" mode: "0600" /etc/rc.d/S21network-wgemc: link: "../init.d/network-wgemc" /etc/rc.d/K91network-wgemc: link: "../init.d/network-wgemc" /etc/init.d/network-wgemc: mode: "0755" content: | #!/bin/sh /etc/rc.common START=21 STOP=91 start() { ip link add dev wg-emc type wireguard wg set wg-emc fwmark 105 private-key /etc/wireguard/wg-emc.priv {% for peer in wireguard_gateway_tunnels['wg-emc'].peers %} wg set wg-emc peer {{ peer.pub_key }} endpoint {{ peer.endpoint.host }}:{{ peer.endpoint.port }} persistent-keepalive {{ peer.keepalive_interval }} allowed-ips {{ peer.allowed_ips | join(',') }} {% endfor %} {% for addr in wireguard_gateway_tunnels['wg-emc'].addresses %} ip addr add dev wg-emc {{ addr }} {% endfor %} ip link set up dev wg-emc ip route add default via {{ wireguard_gateway_tunnels['wg-emc'].default_gateway.inner }} table 200 proto static } stop() { ip link del dev wg-emc } /etc/rc.d/S22network-fw: link: "../init.d/network-fw" /etc/rc.d/K92network-fw: link: "../init.d/network-fw" /etc/init.d/network-fw: mode: "0755" content: | #!/bin/sh /etc/rc.common START=22 STOP=91 start() { ### management MGMT_IF=$(uci get network.mgmt.ifname) MGMT_IPADDR=$(uci get network.mgmt.ipaddr) MGMT_NETMASK=$(uci get network.mgmt.netmask) iptables -A INPUT -i lo -d 127.0.0.0/8 -j ACCEPT iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT ### external zones # mur iptables -A INPUT -i "eth5" -p icmp -j ACCEPT iptables -A INPUT -i "eth5" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "eth5" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # LTE iptables -A INPUT -i "eth4" -p icmp -j ACCEPT iptables -A INPUT -i "eth4" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "eth4" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # Wireguard EMC iptables -A INPUT -i "wg-emc" -p icmp -j ACCEPT iptables -A INPUT -i "wg-emc" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "wg-emc" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -o "wg-emc" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu ### internal zones {% for zone_name in network_internal_zone_names %} # {{ zone_name }} {% if 'dhcp' in network_zones[zone_name] %} iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p udp --dport 67 --sport 68 -j ACCEPT {% endif %} {% if 'dhcp' in network_zones[zone_name] or network_zones[zone_name].gateway in network_zones[zone_name].dns %} iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p udp --dport 53 -d "{{ network_zones[zone_name].gateway }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p tcp --dport 53 -d "{{ network_zones[zone_name].gateway }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT {% endif %} iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p icmp -d "{{ network_zones[zone_name].gateway }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT {% if zone_name in network_internal_zone_names__wanmur %} {% set ext_interface = "eth5" %} {% set rt_table = "105" %} {% elif zone_name in network_internal_zone_names__wanlte %} {% set ext_interface = "eth4" %} {% set rt_table = "104" %} {% elif zone_name in network_internal_zone_names__wgemc %} {% set ext_interface = "wg-emc" %} {% set rt_table = "200" %} {% endif %} iptables -A FORWARD -i "eth0.{{ network_zones[zone_name].vlan }}" -o "{{ ext_interface }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT iptables -A FORWARD -i "{{ ext_interface }}" -o "eth0.{{ network_zones[zone_name].vlan }}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -t nat -A POSTROUTING -o "{{ ext_interface }}" -s "{{ network_zones[zone_name].prefix }}" -j MASQUERADE ip rule add pref {{ loop.index + 33000 }} iif "eth0.{{ network_zones[zone_name].vlan }}" lookup {{ rt_table }} {% endfor %} ### iptables -P INPUT DROP iptables -P FORWARD DROP } stop() { iptables -P INPUT ACCEPT iptables -F INPUT iptables -P FORWARD ACCEPT iptables -F FORWARD iptables -t nat -F POSTROUTING {% for zone_name in network_internal_zone_names %} ip rule del pref {{ loop.index + 33000 }} {% endfor %} } openwrt_uci: system: - name: system options: hostname: '{{ host_name }}' timezone: 'CET-1CEST,M3.5.0,M10.5.0/3' ttylogin: '0' log_size: '64' urandom_seed: '0' - name: timeserver 'ntp' options: enabled: '1' enable_server: '0' server: - '0.lede.pool.ntp.org' - '1.lede.pool.ntp.org' - '2.lede.pool.ntp.org' - '3.lede.pool.ntp.org' dropbear: - name: dropbear options: PasswordAuth: 'off' RootPasswordAuth: 'off' Port: '{{ ansible_port }}' prometheus-node-exporter-lua: - name: prometheus-node-exporter-lua 'main' options: listen_interface: 'mgmt' listen_ipv6: '0' listen_port: '9100' dhcp: "{{ openwrt_dhcp_base + openwrt_dhcp_internal + openwrt_dhcp_external }}" network: "{{ openwrt_network_base + openwrt_network_internal + openwrt_network_external }}" prometheus_scrape_endpoint: "{{ network_mgmt_zone.prefix | ipaddr(network_mgmt_zone.offsets[inventory_hostname]) | ipaddr('address') }}:9100" prometheus_exporters_default: - openwrt