CCCHH/ansible-infra
CCCHH/ansible-infra
3
2
Fork 1
Code Issues 18 Pull requests 9 Wiki Activity Actions

z9-router(host): change vlan 54 to 55 and remove netwan move vlan 400 to netlan

Browse source
This commit is contained in:
bitwhisker 2026-08-01 23:30:36 +02:00
commit ffb88164ee
Signed by: bitwhisker
SSH key fingerprint: SHA256:KybIk/tusSKao6eLGY+ILlFa1rCrzwx66/acBAcKUqE
9 changed files with 40 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

18
resources/z9/z9-router/nftables/nftables.conf
View file

@ -6,26 +6,26 @@
# Interfaces
define if_netwan = "netwan"
#define if_netwan = "netwan"
define if_netlan = "netlan"
define if_wg55_management = "wg55"
define if_wg56_management = "wg56"
define if_netwan_400_fux_uplink = "netwan.400"
define if_netlan_51_clients = "netlan.51"
define if_netlan_52_iot = "netlan.52"
define if_netlan_53_public = "netlan.53"
define if_netlan_54_management = "netlan.54"
define if_netlan_55_management = "netlan"
# Interface Groups
define wan_ifs = { $if_netwan_400_fux_uplink }
define lan_ifs = { $if_netlan_51_clients,
$if_netlan_52_iot,
$if_netlan_53_public,
$if_netlan_54_management }
$if_netlan_55_management }
define v4_exposed_ifs = { $if_netlan_53_public }
define v6_exposed_ifs = { $if_netlan_53_public }
define v4_nat_ifs = { $if_netlan_51_clients,
$if_netlan_52_iot,
$if_netlan_54_management }
$if_netlan_55_management }
## Rules
@ -79,7 +79,7 @@ table inet host {
iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access"
# Allow DNS server access from lan_ifs
iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
}
}
@ -91,7 +91,7 @@ table ip v4nat {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
iifname { $v4_nat_ifs, $if_wg55_management } oifname $wan_ifs masquerade
iifname { $v4_nat_ifs, $if_wg56_management } oifname $wan_ifs masquerade
}
}
@ -103,13 +103,13 @@ table inet forward {
ct state established,related accept
# Allow internet access.
iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access"
iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
# Allow access to exposed networks from internet.
meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
# Allow clients and management to most
iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
}
}