z9-router(host): remove netwan, vlan55 untagged, add and fix DNS, fix formatting

inventories/z9/host_vars/z9-router.yaml

@@ -3,5 +3,8 @@ systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z
 nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/nftables/nftables.conf') }}"
 ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin"
 ansible_pull__timer_randomized_delay_sec: 0min
-unbound_access_control: [ "10.89.208.0/20" ]
+unbound_access_control: [ "10.89.208.0/20", "2a07:c481:1::/48" ]
+deploy_systemd_resolved_config__enable: false
+deploy_systemd_resolved_config__dns:
+  - 127.0.0.1
 kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml

resources/z9/z9-router/nftables/nftables.conf

@@ -1,4 +1,5 @@
 #!/usr/sbin/nft -f
+flush ruleset
 
 ## Variables
 
@@ -6,7 +7,6 @@
 
 
 # Interfaces
-#define if_netwan = "netwan"
 define if_netlan = "netlan"
 define if_wg56_management = "wg56"
 define if_netwan_400_fux_uplink = "netwan.400"
@@ -29,7 +29,6 @@ define v4_nat_ifs = { $if_netlan_51_clients,
 
 
 ## Rules
-
 table inet reverse-path-forwarding {
     chain rpf-filter {
         type filter hook prerouting priority mangle + 10; policy drop;
@@ -79,7 +78,7 @@ table inet host {
         iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access"
 
         # Allow DNS server access from lan_ifs
-        iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
+        iifname { $lan_ifs, $if_wg56_management } meta l4proto { tcp, udp } dport 53 accept comment "allow dns server access from lan_ifs"
     }
 }
 
@@ -111,5 +110,9 @@ table inet forward {
 
         # Allow clients and management to most
         iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
+
+        # Fux PVE backups
+        ip6 saddr { 2a07:c481:0:1::/64 } ip6 daddr { 2a07:c481:1:36::15/128 } accept comment "allow Fux PVE to access CCCHH PBS"
     }
 }
+

resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev

@@ -1,8 +0,0 @@
-[NetDev]
-Name=netlan.55
-Kind=vlan
-MACAddress=BC:24:11:D2:65:B4
-
-[VLAN]
-Id=55
-

resources/z9/z9-router/systemd_networkd/20-netlan.network

@@ -5,14 +5,14 @@ Name=netlan
 RequiredForOnline=no
 
 [Network]
-#LinkLocalAddressing=no
 DHCP=no
-#IPv6AcceptRA=no
+DNS=10.89.213.1
+DNS=2a07:c481:1:36::1
 
 VLAN=netlan.51
 VLAN=netlan.52
 VLAN=netlan.53
-#VLAN=netlan.55
+#VLAN=netlan.55 # vlan 55 ist untaged im pve
 VLAN=netwan.400
 
 #Description=Management
@@ -34,4 +34,3 @@ Prefix=2a07:c481:1:36::/64
 Assign=true
 Token=static:::1
 
-

resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network

@@ -7,6 +7,8 @@ RequiredForOnline=no
 
 [Network]
 Description=clients
+DNS=10.89.208.1
+DNS=2a07:c481:1:33::1
 
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes

resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network

@@ -7,6 +7,8 @@ RequiredForOnline=no
 
 [Network]
 Description=IoT
+DNS=10.89.212.1
+DNS=2a07:c481:1:34::1
 
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes

resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network

@@ -7,6 +7,8 @@ RequiredForOnline=no
 
 [Network]
 Description=public
+DNS=185.161.130.65
+DNS=2a07:c481:1:35::1
 
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes

resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network

@@ -1,27 +0,0 @@
-[Match]
-Name=netlan.55
-Type=vlan
-
-[Link]
-RequiredForOnline=no
-
-[Network]
-Description=Management
-
-# Masquerading done in nftables (nftables.conf).
-IPv6SendRA=yes
-
-[Address]
-Address=10.89.213.1/24
-
-[IPv6SendRA]
-UplinkInterface=netwan.400
-EmitDomains=true
-Domains=ccchh.net
-Managed=true
-
-[IPv6Prefix]
-Prefix=2a07:c481:1:36::/64
-Assign=true
-Token=static:::1
-