z9-router(host): change vlan 54 to 55 and remove netwan move vlan 400 to netlan
This commit is contained in:
parent
b76fac2255
commit
ffb88164ee
SSH key fingerprint:
SHA256:KybIk/tusSKao6eLGY+ILlFa1rCrzwx66/acBAcKUqE
9 changed files with 40 additions and 38 deletions
|
|
@ -6,7 +6,7 @@ kea_dhcp__dns_servers:
|
|||
|
||||
kea_dhcp__dhcp4:
|
||||
enable: true
|
||||
interfaces: [ "netlan.51", "netlan.52", "netlan.54" ]
|
||||
interfaces: ["netlan.51", "netlan.52", "netlan"]
|
||||
subnets:
|
||||
- id: 1
|
||||
subnet: 10.89.208.0/22
|
||||
|
|
@ -228,7 +228,7 @@ kea_dhcp__dhcp4:
|
|||
|
||||
kea_dhcp__dhcp6:
|
||||
enable: true
|
||||
interfaces: [ "netlan.51", "netlan.52", "netlan.54" ]
|
||||
interfaces: ["netlan.51", "netlan.52", "netlan"]
|
||||
subnets:
|
||||
- id: 1
|
||||
subnet: "2a07:c481:1:33::/64"
|
||||
|
|
|
|||
|
|
@ -6,26 +6,26 @@
|
|||
|
||||
|
||||
# Interfaces
|
||||
define if_netwan = "netwan"
|
||||
#define if_netwan = "netwan"
|
||||
define if_netlan = "netlan"
|
||||
define if_wg55_management = "wg55"
|
||||
define if_wg56_management = "wg56"
|
||||
define if_netwan_400_fux_uplink = "netwan.400"
|
||||
define if_netlan_51_clients = "netlan.51"
|
||||
define if_netlan_52_iot = "netlan.52"
|
||||
define if_netlan_53_public = "netlan.53"
|
||||
define if_netlan_54_management = "netlan.54"
|
||||
define if_netlan_55_management = "netlan"
|
||||
|
||||
# Interface Groups
|
||||
define wan_ifs = { $if_netwan_400_fux_uplink }
|
||||
define lan_ifs = { $if_netlan_51_clients,
|
||||
$if_netlan_52_iot,
|
||||
$if_netlan_53_public,
|
||||
$if_netlan_54_management }
|
||||
$if_netlan_55_management }
|
||||
define v4_exposed_ifs = { $if_netlan_53_public }
|
||||
define v6_exposed_ifs = { $if_netlan_53_public }
|
||||
define v4_nat_ifs = { $if_netlan_51_clients,
|
||||
$if_netlan_52_iot,
|
||||
$if_netlan_54_management }
|
||||
$if_netlan_55_management }
|
||||
|
||||
|
||||
## Rules
|
||||
|
|
@ -79,7 +79,7 @@ table inet host {
|
|||
iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access"
|
||||
|
||||
# Allow DNS server access from lan_ifs
|
||||
iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
|
||||
iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -91,7 +91,7 @@ table ip v4nat {
|
|||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
|
||||
iifname { $v4_nat_ifs, $if_wg55_management } oifname $wan_ifs masquerade
|
||||
iifname { $v4_nat_ifs, $if_wg56_management } oifname $wan_ifs masquerade
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -103,13 +103,13 @@ table inet forward {
|
|||
ct state established,related accept
|
||||
|
||||
# Allow internet access.
|
||||
iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access"
|
||||
iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
|
||||
|
||||
# Allow access to exposed networks from internet.
|
||||
meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
|
||||
meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
|
||||
|
||||
# Allow clients and management to most
|
||||
iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
|
||||
iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +0,0 @@
|
|||
[Match]
|
||||
MACAddress=BC:24:11:CF:65:57
|
||||
Type=ether
|
||||
|
||||
[Link]
|
||||
Name=netwan
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
[NetDev]
|
||||
Name=netlan.55
|
||||
Kind=vlan
|
||||
MACAddress=BC:24:11:D2:65:B4
|
||||
|
||||
[VLAN]
|
||||
Id=55
|
||||
|
||||
90
resources/z9/z9-router/systemd_networkd/10-wg56.netdev
Normal file
90
resources/z9/z9-router/systemd_networkd/10-wg56.netdev
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
[NetDev]
|
||||
Description=Admin-Wireguard
|
||||
Kind=wireguard
|
||||
Name=wg56
|
||||
|
||||
[WireGuard]
|
||||
ListenPort=51820
|
||||
PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_private_key
|
||||
|
||||
# WireGuard Peers
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = stb
|
||||
AllowedIPs = 10.89.214.2/32,2a07:c481:1:37::2/128
|
||||
PublicKey = vILSL4dbaC5IaTsRhJviamV18ssxWSj+qLVyowLQ214=
|
||||
PersistentKeepalive = 30
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = fi
|
||||
AllowedIPs = 10.89.214.3/32,2a07:c481:1:37::3/128
|
||||
PublicKey = UHi/if5uW2V3+8Q3R+uk6/XpRi4fPXbw7chsKI4xlkI=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_fi_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = jtbx
|
||||
AllowedIPs = 10.89.214.4/32,2a07:c481:1:37::4/128
|
||||
PublicKey = NyyEqdWgScgsnTF8Zz/Om4Lc84fdFMwVtvaCmLEkUlQ=
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = June
|
||||
AllowedIPs = 10.89.214.6/32,2a07:c481:1:37::6/128
|
||||
PublicKey = 6jAEB+f9przBGxPhuvv9U9gvZDEBQNqpQSD0BoGqXQQ=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = Max
|
||||
AllowedIPs = 10.89.214.7/32,2a07:c481:1:37::7/128
|
||||
PublicKey = oC1hJjtlAgLX/CmbwTC+LPmd1uwluQTwsN8RaMNmHn0=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_Max_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = dario
|
||||
AllowedIPs = 10.89.214.9/32,2a07:c481:1:37::9/128
|
||||
PublicKey = bYF2EGRGpEGjiKcasi/oaWoWeLsgqsF6FGaq3Z4ERww=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_dario_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = June-mobile
|
||||
AllowedIPs = 10.89.214.11/32,2a07:c481:1:37::11/128
|
||||
PublicKey = 6edjXykegUgGjbkIG1aJyBlX1SgTKcqXXaSBVPHdKDc=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June-mobile_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = djerun_at_ferrum.local
|
||||
AllowedIPs = 10.89.214.12/32,2a07:c481:1:37::12/128
|
||||
PublicKey = aHbdkTHhPkd+o7wWfTua9nd72aF4OVp66zGtpaoD8Fg=
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = c6ristian
|
||||
AllowedIPs = 10.89.214.13/32,2a07:c481:1:37::13/128
|
||||
PublicKey = 6ndwj3Ur6AqfUPWuyPYXIaGZs2ujJKawSQ9LEvlYzEc=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_c6ristian_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = langoor
|
||||
AllowedIPs = 10.89.214.14/32,2a07:c481:1:37::14/128
|
||||
PublicKey = qTnVQlQa1m4SucFFNli/xM6QWfsdWx2baRAit7Cg8RM=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = langoor_home
|
||||
AllowedIPs = 10.89.214.15/32,2a07:c481:1:37::15/128
|
||||
PublicKey = NeMDs2+5rHuKO5ZYXVUR76GorgdesFUnDOFECQ3RzG4=
|
||||
PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_home_psk
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = lilly-lillysLaptop
|
||||
AllowedIPs = 10.89.214.16/32,2a07:c481:1:37::16/128
|
||||
PublicKey = IBsI+N8qUNpQnDc5HnqQ2Zo/1graFM0RMIecHmAF+Vk=
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = bitwhisker
|
||||
AllowedIPs = 10.89.214.17/32,2a07:c481:1:37::a/128
|
||||
PublicKey = DvEGvQPGi+IxeRTIA72Gx3WNINcrV9HRNB1v7mHnhjA=
|
||||
|
||||
[WireGuardPeer]
|
||||
# friendly_name = forestcat
|
||||
AllowedIPs = 10.89.214.18/32,2a07:c481:1:37::b/128
|
||||
PublicKey = PdJ7KlIeASizj0WTY87d7oSi14/MebrhRa+L8YiPoQE=
|
||||
|
||||
|
|
@ -5,12 +5,33 @@ Name=netlan
|
|||
RequiredForOnline=no
|
||||
|
||||
[Network]
|
||||
LinkLocalAddressing=no
|
||||
#LinkLocalAddressing=no
|
||||
DHCP=no
|
||||
IPv6AcceptRA=no
|
||||
#IPv6AcceptRA=no
|
||||
|
||||
VLAN=netlan.51
|
||||
VLAN=netlan.52
|
||||
VLAN=netlan.53
|
||||
VLAN=netlan.54
|
||||
#VLAN=netlan.55
|
||||
VLAN=netwan.400
|
||||
|
||||
#Description=Management
|
||||
|
||||
# Masquerading done in nftables (nftables.conf).
|
||||
IPv6SendRA=yes
|
||||
|
||||
[Address]
|
||||
Address=10.89.213.1/24
|
||||
|
||||
[IPv6SendRA]
|
||||
UplinkInterface=netwan.400
|
||||
EmitDomains=true
|
||||
Domains=ccchh.net
|
||||
Managed=true
|
||||
|
||||
[IPv6Prefix]
|
||||
Prefix=2a07:c481:1:36::/64
|
||||
Assign=true
|
||||
Token=static:::1
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,13 +0,0 @@
|
|||
[Match]
|
||||
Name=netwan
|
||||
|
||||
[Link]
|
||||
RequiredForOnline=no
|
||||
|
||||
[Network]
|
||||
LinkLocalAddressing=no
|
||||
DHCP=no
|
||||
IPv6AcceptRA=no
|
||||
|
||||
VLAN=netwan.400
|
||||
|
||||
6
resources/z9/z9-router/systemd_networkd/20-wg56.network
Normal file
6
resources/z9/z9-router/systemd_networkd/20-wg56.network
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
[Match]
|
||||
Name=wg56
|
||||
|
||||
[Network]
|
||||
Address=10.89.214.1/24
|
||||
Address=2a07:c481:1:37::1/64
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
[Match]
|
||||
Name=netlan.55
|
||||
Type=vlan
|
||||
|
||||
[Link]
|
||||
RequiredForOnline=no
|
||||
|
||||
[Network]
|
||||
Description=Management
|
||||
|
||||
# Masquerading done in nftables (nftables.conf).
|
||||
IPv6SendRA=yes
|
||||
|
||||
[Address]
|
||||
Address=10.89.213.1/24
|
||||
|
||||
[IPv6SendRA]
|
||||
UplinkInterface=netwan.400
|
||||
EmitDomains=true
|
||||
Domains=ccchh.net
|
||||
Managed=true
|
||||
|
||||
[IPv6Prefix]
|
||||
Prefix=2a07:c481:1:36::/64
|
||||
Assign=true
|
||||
Token=static:::1
|
||||
|
||||
Loading…
Reference in a new issue