From ffb88164ee3b07b15d66103e7d7a147b9836787c Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 1 Aug 2026 23:30:36 +0200 Subject: [PATCH] z9-router(host): change vlan 54 to 55 and remove netwan move vlan 400 to netlan --- resources/z9/z9-router/kea_dhcp.yaml | 4 +-- resources/z9/z9-router/nftables/nftables.conf | 18 ++++++------- .../z9-router/systemd_networkd/00-netwan.link | 6 ----- ...0-netlan.54.netdev => 10-netlan.55.netdev} | 4 +-- .../{10-wg55.netdev => 10-wg56.netdev} | 2 +- .../systemd_networkd/20-netlan.network | 27 ++++++++++++++++--- .../systemd_networkd/20-netwan.network | 13 --------- .../{20-wg55.network => 20-wg56.network} | 2 +- ...etwork => 21-netlan.55-management.network} | 2 +- 9 files changed, 40 insertions(+), 38 deletions(-) delete mode 100644 resources/z9/z9-router/systemd_networkd/00-netwan.link rename resources/z9/z9-router/systemd_networkd/{10-netlan.54.netdev => 10-netlan.55.netdev} (73%) rename resources/z9/z9-router/systemd_networkd/{10-wg55.netdev => 10-wg56.netdev} (99%) delete mode 100644 resources/z9/z9-router/systemd_networkd/20-netwan.network rename resources/z9/z9-router/systemd_networkd/{20-wg55.network => 20-wg56.network} (87%) rename resources/z9/z9-router/systemd_networkd/{21-netlan.54-management.network => 21-netlan.55-management.network} (95%) diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index 5859b65b..4f7ea31f 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -6,7 +6,7 @@ kea_dhcp__dns_servers: kea_dhcp__dhcp4: enable: true - interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + interfaces: ["netlan.51", "netlan.52", "netlan"] subnets: - id: 1 subnet: 10.89.208.0/22 @@ -228,7 +228,7 @@ kea_dhcp__dhcp4: kea_dhcp__dhcp6: enable: true - interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + interfaces: ["netlan.51", "netlan.52", "netlan"] subnets: - id: 1 subnet: "2a07:c481:1:33::/64" diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index 88534127..e59e5bda 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -6,26 +6,26 @@ # Interfaces -define if_netwan = "netwan" +#define if_netwan = "netwan" define if_netlan = "netlan" -define if_wg55_management = "wg55" +define if_wg56_management = "wg56" define if_netwan_400_fux_uplink = "netwan.400" define if_netlan_51_clients = "netlan.51" define if_netlan_52_iot = "netlan.52" define if_netlan_53_public = "netlan.53" -define if_netlan_54_management = "netlan.54" +define if_netlan_55_management = "netlan" # Interface Groups define wan_ifs = { $if_netwan_400_fux_uplink } define lan_ifs = { $if_netlan_51_clients, $if_netlan_52_iot, $if_netlan_53_public, - $if_netlan_54_management } + $if_netlan_55_management } define v4_exposed_ifs = { $if_netlan_53_public } define v6_exposed_ifs = { $if_netlan_53_public } define v4_nat_ifs = { $if_netlan_51_clients, $if_netlan_52_iot, - $if_netlan_54_management } + $if_netlan_55_management } ## Rules @@ -79,7 +79,7 @@ table inet host { iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access" # Allow DNS server access from lan_ifs - iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs" + iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs" } } @@ -91,7 +91,7 @@ table ip v4nat { chain postrouting { type nat hook postrouting priority srcnat; policy accept; - iifname { $v4_nat_ifs, $if_wg55_management } oifname $wan_ifs masquerade + iifname { $v4_nat_ifs, $if_wg56_management } oifname $wan_ifs masquerade } } @@ -103,13 +103,13 @@ table inet forward { ct state established,related accept # Allow internet access. - iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access" + iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access" # Allow access to exposed networks from internet. meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access" meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access" # Allow clients and management to most - iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces" + iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces" } } diff --git a/resources/z9/z9-router/systemd_networkd/00-netwan.link b/resources/z9/z9-router/systemd_networkd/00-netwan.link deleted file mode 100644 index 523e18a9..00000000 --- a/resources/z9/z9-router/systemd_networkd/00-netwan.link +++ /dev/null @@ -1,6 +0,0 @@ -[Match] -MACAddress=BC:24:11:CF:65:57 -Type=ether - -[Link] -Name=netwan diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev similarity index 73% rename from resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev index 4ea5ec6a..74bd182d 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev @@ -1,8 +1,8 @@ [NetDev] -Name=netlan.54 +Name=netlan.55 Kind=vlan MACAddress=BC:24:11:D2:65:B4 [VLAN] -Id=54 +Id=55 diff --git a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev b/resources/z9/z9-router/systemd_networkd/10-wg56.netdev similarity index 99% rename from resources/z9/z9-router/systemd_networkd/10-wg55.netdev rename to resources/z9/z9-router/systemd_networkd/10-wg56.netdev index f2de509a..70966e22 100644 --- a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-wg56.netdev @@ -1,7 +1,7 @@ [NetDev] Description=Admin-Wireguard Kind=wireguard -Name=wg55 +Name=wg56 [WireGuard] ListenPort=51820 diff --git a/resources/z9/z9-router/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network index 7fab501b..75767b56 100644 --- a/resources/z9/z9-router/systemd_networkd/20-netlan.network +++ b/resources/z9/z9-router/systemd_networkd/20-netlan.network @@ -5,12 +5,33 @@ Name=netlan RequiredForOnline=no [Network] -LinkLocalAddressing=no +#LinkLocalAddressing=no DHCP=no -IPv6AcceptRA=no +#IPv6AcceptRA=no VLAN=netlan.51 VLAN=netlan.52 VLAN=netlan.53 -VLAN=netlan.54 +#VLAN=netlan.55 +VLAN=netwan.400 + +#Description=Management + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.213.1/24 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:36::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/z9-router/systemd_networkd/20-netwan.network b/resources/z9/z9-router/systemd_networkd/20-netwan.network deleted file mode 100644 index b42b95ab..00000000 --- a/resources/z9/z9-router/systemd_networkd/20-netwan.network +++ /dev/null @@ -1,13 +0,0 @@ -[Match] -Name=netwan - -[Link] -RequiredForOnline=no - -[Network] -LinkLocalAddressing=no -DHCP=no -IPv6AcceptRA=no - -VLAN=netwan.400 - diff --git a/resources/z9/z9-router/systemd_networkd/20-wg55.network b/resources/z9/z9-router/systemd_networkd/20-wg56.network similarity index 87% rename from resources/z9/z9-router/systemd_networkd/20-wg55.network rename to resources/z9/z9-router/systemd_networkd/20-wg56.network index 750e8445..6c56251b 100644 --- a/resources/z9/z9-router/systemd_networkd/20-wg55.network +++ b/resources/z9/z9-router/systemd_networkd/20-wg56.network @@ -1,5 +1,5 @@ [Match] -Name=wg55 +Name=wg56 [Network] Address=10.89.214.1/24 diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network similarity index 95% rename from resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network index e1bf0c8a..1e8086a1 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network +++ b/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network @@ -1,5 +1,5 @@ [Match] -Name=netlan.54 +Name=netlan.55 Type=vlan [Link]