CCCHH/ansible-infra
CCCHH/ansible-infra
3
2
Fork 1
Code Issues 18 Pull requests 9 Wiki Activity Actions

z9-router(host): remove netwan, vlan55 untagged, add and fix DNS, fix formatting

Browse source
This commit is contained in:
bitwhisker 2026-08-07 22:32:58 +02:00
commit 251f0c61d2
Signed by: bitwhisker
SSH key fingerprint: SHA256:KybIk/tusSKao6eLGY+ILlFa1rCrzwx66/acBAcKUqE
8 changed files with 22 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

15
resources/z9/z9-router/nftables/nftables.conf
View file

@ -1,4 +1,5 @@
#!/usr/sbin/nft -f
flush ruleset
## Variables
@ -6,9 +7,8 @@
# Interfaces
#define if_netwan = "netwan"
define if_netlan = "netlan"
define if_wg56_management = "wg56"
define if_wg56_management = "wg56"
define if_netwan_400_fux_uplink = "netwan.400"
define if_netlan_51_clients = "netlan.51"
define if_netlan_52_iot = "netlan.52"
@ -29,7 +29,6 @@ define v4_nat_ifs = { $if_netlan_51_clients,
## Rules
table inet reverse-path-forwarding {
chain rpf-filter {
type filter hook prerouting priority mangle + 10; policy drop;
@ -49,7 +48,7 @@ table inet host {
ct state invalid drop
ct state established,related accept
ip protocol icmp accept
ip protocol icmp accept
# ICMPv6
# https://datatracker.ietf.org/doc/html/rfc4890#autoid-24
# Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped"
@ -79,7 +78,7 @@ table inet host {
iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access"
# Allow DNS server access from lan_ifs
iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
iifname { $lan_ifs, $if_wg56_management } meta l4proto { tcp, udp } dport 53 accept comment "allow dns server access from lan_ifs"
}
}
@ -103,7 +102,7 @@ table inet forward {
ct state established,related accept
# Allow internet access.
iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
# Allow access to exposed networks from internet.
meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
@ -111,5 +110,9 @@ table inet forward {
# Allow clients and management to most
iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
# Fux PVE backups
ip6 saddr { 2a07:c481:0:1::/64 } ip6 daddr { 2a07:c481:1:36::15/128 } accept comment "allow Fux PVE to access CCCHH PBS"
}
}

8
resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev
View file

@ -1,8 +0,0 @@
[NetDev]
Name=netlan.55
Kind=vlan
MACAddress=BC:24:11:D2:65:B4
[VLAN]
Id=55

7
resources/z9/z9-router/systemd_networkd/20-netlan.network
View file

@ -5,14 +5,14 @@ Name=netlan
RequiredForOnline=no
[Network]
#LinkLocalAddressing=no
DHCP=no
#IPv6AcceptRA=no
DNS=10.89.213.1
DNS=2a07:c481:1:36::1
VLAN=netlan.51
VLAN=netlan.52
VLAN=netlan.53
#VLAN=netlan.55
#VLAN=netlan.55 # vlan 55 ist untaged im pve
VLAN=netwan.400
#Description=Management
@ -34,4 +34,3 @@ Prefix=2a07:c481:1:36::/64
Assign=true
Token=static:::1

2
resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network
View file

@ -7,6 +7,8 @@ RequiredForOnline=no
[Network]
Description=clients
DNS=10.89.208.1
DNS=2a07:c481:1:33::1
# Masquerading done in nftables (nftables.conf).
IPv6SendRA=yes

2
resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network
View file

@ -7,6 +7,8 @@ RequiredForOnline=no
[Network]
Description=IoT
DNS=10.89.212.1
DNS=2a07:c481:1:34::1
# Masquerading done in nftables (nftables.conf).
IPv6SendRA=yes

2
resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network
View file

@ -7,6 +7,8 @@ RequiredForOnline=no
[Network]
Description=public
DNS=185.161.130.65
DNS=2a07:c481:1:35::1
# Masquerading done in nftables (nftables.conf).
IPv6SendRA=yes

27
resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network
View file

@ -1,27 +0,0 @@
[Match]
Name=netlan.55
Type=vlan
[Link]
RequiredForOnline=no
[Network]
Description=Management
# Masquerading done in nftables (nftables.conf).
IPv6SendRA=yes
[Address]
Address=10.89.213.1/24
[IPv6SendRA]
UplinkInterface=netwan.400
EmitDomains=true
Domains=ccchh.net
Managed=true
[IPv6Prefix]
Prefix=2a07:c481:1:36::/64
Assign=true
Token=static:::1