From 987327863a9adb21fc60ebea5ceee23304efb056 Mon Sep 17 00:00:00 2001
From: jtbx <ccc@jtbx.de>
Date: Sun, 23 Feb 2025 18:49:19 +0100
Subject: [PATCH 1/6] router(host): introduce router

---
 inventories/chaosknoten/hosts.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index cae283d..c164b0b 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -55,6 +55,9 @@ all:
     public-reverse-proxy:
       ansible_host: public-reverse-proxy.hamburg.ccc.de
       ansible_user: chaos
+    router:
+      ansible_host: router.hamburg.ccc.de
+      ansible_user: chaos
     wiki:
       ansible_host: wiki-intern.hamburg.ccc.de
       ansible_user: chaos
@@ -81,6 +84,7 @@ base_config_hosts:
     pad:
     pretalx:
     public-reverse-proxy:
+    router:
     tickets:
     wiki:
     zammad:
@@ -161,6 +165,7 @@ infrastructure_authorized_keys_hosts:
     pad:
     pretalx:
     public-reverse-proxy:
+    router:
     wiki:
     zammad:
 wiki_hosts:

From ed8670f7da83a4b2a6f351cfa57057e943b9e4d8 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 20:05:02 +0200
Subject: [PATCH 2/6] systemd_networkd(role): introd. role for deploy.
 systemd-networkd config

---
 inventories/chaosknoten/hosts.yaml              |  2 ++
 playbooks/deploy.yaml                           |  5 +++++
 roles/systemd_networkd/README.md                | 11 +++++++++++
 roles/systemd_networkd/meta/argument_specs.yaml |  6 ++++++
 roles/systemd_networkd/tasks/main.yaml          | 14 ++++++++++++++
 5 files changed, 38 insertions(+)
 create mode 100644 roles/systemd_networkd/README.md
 create mode 100644 roles/systemd_networkd/meta/argument_specs.yaml
 create mode 100644 roles/systemd_networkd/tasks/main.yaml

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index c164b0b..b4739c4 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -88,6 +88,8 @@ base_config_hosts:
     tickets:
     wiki:
     zammad:
+systemd_networkd_hosts:
+  hosts:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index d7dcdac..69648b2 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -4,6 +4,11 @@
   roles:
     - base_config
 
+- name: Ensure systemd-networkd config deployment on systemd_networkd_hosts
+  hosts: systemd_networkd_hosts
+  roles:
+    - systemd_networkd
+
 - name: Ensure deployment of infrastructure authorized keys
   hosts: infrastructure_authorized_keys_hosts
   roles:
diff --git a/roles/systemd_networkd/README.md b/roles/systemd_networkd/README.md
new file mode 100644
index 0000000..3297c47
--- /dev/null
+++ b/roles/systemd_networkd/README.md
@@ -0,0 +1,11 @@
+# Role `systemd_networkd`
+
+Deploys the given systemd-networkd configuration files.
+
+## Support Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+- `systemd_networkd__config_dir`: Directory with systemd-networkd configs to deploy.
diff --git a/roles/systemd_networkd/meta/argument_specs.yaml b/roles/systemd_networkd/meta/argument_specs.yaml
new file mode 100644
index 0000000..81b046a
--- /dev/null
+++ b/roles/systemd_networkd/meta/argument_specs.yaml
@@ -0,0 +1,6 @@
+argument_specs:
+  main:
+    options:
+      systemd_networkd__config_dir:
+        type: path
+        required: true
diff --git a/roles/systemd_networkd/tasks/main.yaml b/roles/systemd_networkd/tasks/main.yaml
new file mode 100644
index 0000000..f88ed14
--- /dev/null
+++ b/roles/systemd_networkd/tasks/main.yaml
@@ -0,0 +1,14 @@
+- name: ensure rsync is installed
+  ansible.builtin.apt:
+    name: rsync
+    state: present
+  become: true
+
+- name: synchronize systemd-networkd configs
+  ansible.posix.synchronize:
+    src: "{{ systemd_networkd__config_dir }}"
+    dest: "/etc/systemd/network"
+    archive: false
+    recursive: true
+    delete: true
+  become: true

From 217b44c3fac37cd00786905fbbe70c35e5d12bae Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 20:03:30 +0200
Subject: [PATCH 3/6] router(host): add systemd-networkd-based network config

---
 inventories/chaosknoten/host_vars/router.yaml |  1 +
 inventories/chaosknoten/hosts.yaml            |  1 +
 .../router/systemd_networkd/00-net0.link      |  6 ++++
 .../router/systemd_networkd/00-net1.link      |  6 ++++
 .../router/systemd_networkd/00-net2.link      |  6 ++++
 .../systemd_networkd/10-net0.2-v4_nat.netdev  |  7 +++++
 .../10-net0.3-ci_runner.netdev                |  7 +++++
 .../router/systemd_networkd/20-net0.network   | 12 ++++++++
 .../router/systemd_networkd/20-net1.network   | 14 +++++++++
 .../router/systemd_networkd/20-net2.network   | 14 +++++++++
 .../systemd_networkd/21-net0.2-v4_nat.network | 23 +++++++++++++++
 .../21-net0.3-ci_runners.network              | 29 +++++++++++++++++++
 12 files changed, 126 insertions(+)
 create mode 100644 inventories/chaosknoten/host_vars/router.yaml
 create mode 100644 resources/chaosknoten/router/systemd_networkd/00-net0.link
 create mode 100644 resources/chaosknoten/router/systemd_networkd/00-net1.link
 create mode 100644 resources/chaosknoten/router/systemd_networkd/00-net2.link
 create mode 100644 resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev
 create mode 100644 resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev
 create mode 100644 resources/chaosknoten/router/systemd_networkd/20-net0.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/20-net1.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/20-net2.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network

diff --git a/inventories/chaosknoten/host_vars/router.yaml b/inventories/chaosknoten/host_vars/router.yaml
new file mode 100644
index 0000000..b181c0a
--- /dev/null
+++ b/inventories/chaosknoten/host_vars/router.yaml
@@ -0,0 +1 @@
+systemd_networkd__config_dir: 'resources/chaosknoten/router/systemd_networkd/'
diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index b4739c4..98af847 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -90,6 +90,7 @@ base_config_hosts:
     zammad:
 systemd_networkd_hosts:
   hosts:
+    router:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/resources/chaosknoten/router/systemd_networkd/00-net0.link b/resources/chaosknoten/router/systemd_networkd/00-net0.link
new file mode 100644
index 0000000..0c55d13
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/00-net0.link
@@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:54:11:15
+Type=ether
+
+[Link]
+Name=net0
diff --git a/resources/chaosknoten/router/systemd_networkd/00-net1.link b/resources/chaosknoten/router/systemd_networkd/00-net1.link
new file mode 100644
index 0000000..ef04d04
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/00-net1.link
@@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:9A:FB:34
+Type=ether
+
+[Link]
+Name=net1
diff --git a/resources/chaosknoten/router/systemd_networkd/00-net2.link b/resources/chaosknoten/router/systemd_networkd/00-net2.link
new file mode 100644
index 0000000..2a56f72
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/00-net2.link
@@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:AE:C7:04
+Type=ether
+
+[Link]
+Name=net2
diff --git a/resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev b/resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev
new file mode 100644
index 0000000..a46afb4
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev
@@ -0,0 +1,7 @@
+[NetDev]
+Name=net0.2
+Kind=vlan
+
+[VLAN]
+Id=2
+
diff --git a/resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev b/resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev
new file mode 100644
index 0000000..0cd60db
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev
@@ -0,0 +1,7 @@
+[NetDev]
+Name=net0.3
+Kind=vlan
+
+[VLAN]
+Id=3
+
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net0.network b/resources/chaosknoten/router/systemd_networkd/20-net0.network
new file mode 100644
index 0000000..a32d75e
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/20-net0.network
@@ -0,0 +1,12 @@
+[Match]
+Name=net0
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+VLAN=net0.2
+VLAN=net0.3
+
+LinkLocalAddressing=no
+
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net1.network b/resources/chaosknoten/router/systemd_networkd/20-net1.network
new file mode 100644
index 0000000..c8bffc1
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/20-net1.network
@@ -0,0 +1,14 @@
+[Match]
+Name=net1
+
+[Network]
+DNS=212.12.50.158
+IPForward=ipv4
+IPv6AcceptRA=no
+
+[Address]
+Address=212.12.48.123/24
+
+[Route]
+Gateway=212.12.48.55
+
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net2.network b/resources/chaosknoten/router/systemd_networkd/20-net2.network
new file mode 100644
index 0000000..b3f497d
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/20-net2.network
@@ -0,0 +1,14 @@
+[Match]
+Name=net2
+
+[Network]
+#DNS=212.12.50.158
+IPForward=ipv6
+IPv6AcceptRA=no
+
+[Address]
+Address=2a00:14b0:4200:3500::130:2/112
+
+[Route]
+Gateway=2a00:14b0:4200:3500::130:1
+
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
new file mode 100644
index 0000000..880dd1d
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
@@ -0,0 +1,23 @@
+[Match]
+Name=net0.2
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=v4-NAT
+
+IPMasquerade=ipv4
+IPv6SendRA=yes
+
+[Address]
+Address=10.32.2.1/24
+
+[IPv6SendRA]
+UplinkInterface=net2
+
+[IPv6Prefix]
+Prefix=2a00:14b0:42:102::/64
+Assign=true
+Token=static:::1
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
new file mode 100644
index 0000000..6f73beb
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
@@ -0,0 +1,29 @@
+[Match]
+Name=net0.3
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=ci-runners
+
+IPMasquerade=ipv4
+IPv6SendRA=yes
+
+DHCPServer=true
+
+[DHCPServer]
+PoolOffset=100
+PoolSize=150
+
+[Address]
+Address=10.32.3.1/24
+
+[IPv6SendRA]
+UplinkInterface=net2
+
+[IPv6Prefix]
+Prefix=2a00:14b0:42:103::/64
+Assign=true
+Token=static:::1

From c8fa55fafde70d05515ffd1982cae5ddf9a89868 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 21:38:39 +0200
Subject: [PATCH 4/6] nftables(role): introduce role for deploying nftables

---
 inventories/chaosknoten/hosts.yaml      |  2 ++
 playbooks/deploy.yaml                   |  5 +++++
 roles/nftables/README.md                | 11 +++++++++++
 roles/nftables/handlers/main.yaml       |  5 +++++
 roles/nftables/meta/argument_specs.yaml |  6 ++++++
 roles/nftables/tasks/main.yaml          | 15 +++++++++++++++
 6 files changed, 44 insertions(+)
 create mode 100644 roles/nftables/README.md
 create mode 100644 roles/nftables/handlers/main.yaml
 create mode 100644 roles/nftables/meta/argument_specs.yaml
 create mode 100644 roles/nftables/tasks/main.yaml

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 98af847..82eec99 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -91,6 +91,8 @@ base_config_hosts:
 systemd_networkd_hosts:
   hosts:
     router:
+nftables_hosts:
+  hosts:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index 69648b2..d971cf4 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -9,6 +9,11 @@
   roles:
     - systemd_networkd
 
+- name: Ensure nftables deployment on nftables_hosts
+  hosts: nftables_hosts
+  roles:
+    - nftables
+
 - name: Ensure deployment of infrastructure authorized keys
   hosts: infrastructure_authorized_keys_hosts
   roles:
diff --git a/roles/nftables/README.md b/roles/nftables/README.md
new file mode 100644
index 0000000..81d8871
--- /dev/null
+++ b/roles/nftables/README.md
@@ -0,0 +1,11 @@
+# Role `nftables`
+
+Deploys nftables.
+
+## Support Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+- `nftables__config`: nftables configuration to deploy.
diff --git a/roles/nftables/handlers/main.yaml b/roles/nftables/handlers/main.yaml
new file mode 100644
index 0000000..3b72c54
--- /dev/null
+++ b/roles/nftables/handlers/main.yaml
@@ -0,0 +1,5 @@
+- name: Restart nftables service
+  ansible.builtin.systemd_service:
+    name: nftables
+    state: restarted
+  become: true
diff --git a/roles/nftables/meta/argument_specs.yaml b/roles/nftables/meta/argument_specs.yaml
new file mode 100644
index 0000000..aa56223
--- /dev/null
+++ b/roles/nftables/meta/argument_specs.yaml
@@ -0,0 +1,6 @@
+argument_specs:
+  main:
+    options:
+      nftables__config:
+        type: str
+        required: true
diff --git a/roles/nftables/tasks/main.yaml b/roles/nftables/tasks/main.yaml
new file mode 100644
index 0000000..46ea18d
--- /dev/null
+++ b/roles/nftables/tasks/main.yaml
@@ -0,0 +1,15 @@
+- name: ensure nftables is installed
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+  become: true
+
+- name: deploy nftables configuration
+  ansible.builtin.copy:
+    content: "{{ nftables__config }}"
+    dest: "/etc/nftables.conf"
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+  notify: Restart nftables service

From e3c12b18e8be5d8da3b818f5a6d1f24be94a9bcd Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 23:34:17 +0200
Subject: [PATCH 5/6] router(host): add nftables config for basic router
 functionality

---
 inventories/chaosknoten/host_vars/router.yaml |  1 +
 inventories/chaosknoten/hosts.yaml            |  1 +
 .../chaosknoten/router/nftables/nftables.conf | 73 +++++++++++++++++++
 .../systemd_networkd/21-net0.2-v4_nat.network |  2 +-
 .../21-net0.3-ci_runners.network              |  2 +-
 5 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 resources/chaosknoten/router/nftables/nftables.conf

diff --git a/inventories/chaosknoten/host_vars/router.yaml b/inventories/chaosknoten/host_vars/router.yaml
index b181c0a..134d29f 100644
--- a/inventories/chaosknoten/host_vars/router.yaml
+++ b/inventories/chaosknoten/host_vars/router.yaml
@@ -1 +1,2 @@
 systemd_networkd__config_dir: 'resources/chaosknoten/router/systemd_networkd/'
+nftables__config: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/router/nftables/nftables.conf') }}"
diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 82eec99..1d033de 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -93,6 +93,7 @@ systemd_networkd_hosts:
     router:
 nftables_hosts:
   hosts:
+    router:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
new file mode 100644
index 0000000..6bc6cbe
--- /dev/null
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -0,0 +1,73 @@
+#!/usr/sbin/nft -f
+
+## Variables
+
+# Interfaces
+define if_net1_v4_wan = "net1"
+define if_net2_v6_wan = "net2"
+define if_net0_2_v4_nat = "net0.2"
+define if_net0_3_ci_runner = "net0.3"
+
+# Interface Groups
+define wan_ifs = { $if_net1_v4_wan,
+                   $if_net2_v6_wan }
+define lan_ifs = { $if_net0_2_v4_nat,
+                   $if_net0_3_ci_runner }
+
+
+## Rules
+
+table inet reverse-path-forwarding {
+    chain rpf-filter {
+        type filter hook prerouting priority mangle + 10; policy drop;
+
+        # Only allow packets if their source address is routed via their incoming interface.
+        # https://github.com/NixOS/nixpkgs/blob/d9d87c51960050e89c79e4025082ed965e770d68/nixos/modules/services/networking/firewall-nftables.nix#L100
+        fib saddr . mark . iif oif exists accept
+    }
+}
+
+table inet host {
+    chain input {
+        type filter hook input priority filter; policy drop;
+
+        iifname "lo" accept comment "allow loopback"
+
+        ct state invalid drop
+        ct state established,related accept
+
+		ip protocol icmp accept
+		ip6 nexthdr icmpv6 accept
+
+        # Allow SSH access.
+        tcp dport 22 accept comment "allow ssh access"
+
+        # Allow DHCP server access.
+		iifname $if_net0_3_ci_runner udp dport 67 accept comment "allow dhcp server access"
+    }
+}
+
+table ip v4nat {
+    chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+    }
+
+    chain postrouting {
+        type nat hook postrouting priority srcnat; policy accept;
+
+        oifname $if_net1_v4_wan masquerade
+    }
+}
+
+table inet forward {
+    chain forward {
+        type filter hook forward priority filter; policy drop;
+
+        ct state invalid drop
+        ct state established,related accept
+
+        # Allow internet access.
+		meta nfproto ipv6 iifname $lan_ifs oifname $if_net2_v6_wan accept comment "allow v6 internet access"
+		meta nfproto ipv4 iifname $lan_ifs oifname $if_net1_v4_wan accept comment "allow v4 internet access"
+    }
+}
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
index 880dd1d..c7fd9a7 100644
--- a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
@@ -8,7 +8,7 @@ RequiredForOnline=no
 [Network]
 Description=v4-NAT
 
-IPMasquerade=ipv4
+# Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
 
 [Address]
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
index 6f73beb..9caca86 100644
--- a/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
@@ -8,7 +8,7 @@ RequiredForOnline=no
 [Network]
 Description=ci-runners
 
-IPMasquerade=ipv4
+# Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
 
 DHCPServer=true

From 23548107d52d774ed5bbb2cd745f4bda17aef308 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 21 Sep 2025 02:16:51 +0200
Subject: [PATCH 6/6] router killing turing

---
 .../chaosknoten/router/nftables/nftables.conf | 17 +++++++++++---
 .../router/systemd_networkd/00-net1.link      |  3 ++-
 .../10-net0.4-v4_nat_legacy.netdev            |  6 +++++
 .../systemd_networkd/10-net0.5-public.netdev  |  6 +++++
 .../router/systemd_networkd/20-net0.network   |  3 ++-
 .../router/systemd_networkd/20-net1.network   | 11 +++++----
 .../21-net0.4-v4_nat_legacy.network           | 23 +++++++++++++++++++
 .../systemd_networkd/21-net0.5-public.network | 22 ++++++++++++++++++
 8 files changed, 81 insertions(+), 10 deletions(-)
 create mode 100644 resources/chaosknoten/router/systemd_networkd/10-net0.4-v4_nat_legacy.netdev
 create mode 100644 resources/chaosknoten/router/systemd_networkd/10-net0.5-public.netdev
 create mode 100644 resources/chaosknoten/router/systemd_networkd/21-net0.4-v4_nat_legacy.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/21-net0.5-public.network

diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
index 6bc6cbe..8d30852 100644
--- a/resources/chaosknoten/router/nftables/nftables.conf
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -7,12 +7,20 @@ define if_net1_v4_wan = "net1"
 define if_net2_v6_wan = "net2"
 define if_net0_2_v4_nat = "net0.2"
 define if_net0_3_ci_runner = "net0.3"
+define if_net0_4_v4_nat_legacy = "net0.4"
+define if_net0_5_public = "net0.5"
 
 # Interface Groups
 define wan_ifs = { $if_net1_v4_wan,
                    $if_net2_v6_wan }
 define lan_ifs = { $if_net0_2_v4_nat,
-                   $if_net0_3_ci_runner }
+                   $if_net0_3_ci_runner,
+                   $if_net0_4_v4_nat_legacy,
+                   $if_net0_5_public }
+define v4_exposed_ifs = { $if_net0_5_public }
+define v6_exposed_ifs = { $if_net0_2_v4_nat,
+                          $if_net0_4_v4_nat_legacy,
+                          $if_net0_5_public }
 
 
 ## Rules
@@ -67,7 +75,10 @@ table inet forward {
         ct state established,related accept
 
         # Allow internet access.
-		meta nfproto ipv6 iifname $lan_ifs oifname $if_net2_v6_wan accept comment "allow v6 internet access"
-		meta nfproto ipv4 iifname $lan_ifs oifname $if_net1_v4_wan accept comment "allow v4 internet access"
+        iifname $lan_ifs oifname $wan_ifs accept comment "allow internet access"
+
+        # Allow access to exposed networks from internet.
+        meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
+        meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
     }
 }
diff --git a/resources/chaosknoten/router/systemd_networkd/00-net1.link b/resources/chaosknoten/router/systemd_networkd/00-net1.link
index ef04d04..9489f17 100644
--- a/resources/chaosknoten/router/systemd_networkd/00-net1.link
+++ b/resources/chaosknoten/router/systemd_networkd/00-net1.link
@@ -1,5 +1,6 @@
 [Match]
-MACAddress=BC:24:11:9A:FB:34
+# Stolen from turing to make 212.12.48.122 work.
+MACAddress=0E:A4:E3:97:16:92
 Type=ether
 
 [Link]
diff --git a/resources/chaosknoten/router/systemd_networkd/10-net0.4-v4_nat_legacy.netdev b/resources/chaosknoten/router/systemd_networkd/10-net0.4-v4_nat_legacy.netdev
new file mode 100644
index 0000000..5cb68ed
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/10-net0.4-v4_nat_legacy.netdev
@@ -0,0 +1,6 @@
+[NetDev]
+Name=net0.4
+Kind=vlan
+
+[VLAN]
+Id=4
diff --git a/resources/chaosknoten/router/systemd_networkd/10-net0.5-public.netdev b/resources/chaosknoten/router/systemd_networkd/10-net0.5-public.netdev
new file mode 100644
index 0000000..be3c9d9
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/10-net0.5-public.netdev
@@ -0,0 +1,6 @@
+[NetDev]
+Name=net0.5
+Kind=vlan
+
+[VLAN]
+Id=5
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net0.network b/resources/chaosknoten/router/systemd_networkd/20-net0.network
index a32d75e..59897cf 100644
--- a/resources/chaosknoten/router/systemd_networkd/20-net0.network
+++ b/resources/chaosknoten/router/systemd_networkd/20-net0.network
@@ -7,6 +7,7 @@ RequiredForOnline=no
 [Network]
 VLAN=net0.2
 VLAN=net0.3
+VLAN=net0.4
+VLAN=net0.5
 
 LinkLocalAddressing=no
-
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net1.network b/resources/chaosknoten/router/systemd_networkd/20-net1.network
index c8bffc1..5789ef6 100644
--- a/resources/chaosknoten/router/systemd_networkd/20-net1.network
+++ b/resources/chaosknoten/router/systemd_networkd/20-net1.network
@@ -5,10 +5,11 @@ Name=net1
 DNS=212.12.50.158
 IPForward=ipv4
 IPv6AcceptRA=no
-
-[Address]
+# v4 taken from turing for routing public v4 range and turing-compat for v4-NAT-legacy network.
+# Also just the v4 for other purposes as well.
+Address=212.12.48.122/24
 Address=212.12.48.123/24
-
-[Route]
+# v6 for turing-compat for v4-NAT-legacy network routed v6.
+Address=2a00:14b0:4200:3000:122::1
 Gateway=212.12.48.55
-
+Gateway=2a00:14b0:4200:3000::1
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.4-v4_nat_legacy.network b/resources/chaosknoten/router/systemd_networkd/21-net0.4-v4_nat_legacy.network
new file mode 100644
index 0000000..dd63a73
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.4-v4_nat_legacy.network
@@ -0,0 +1,23 @@
+[Match]
+Name=net0.4
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=v4-NAT-legacy
+
+# Masquerading done in nftables (nftables.conf).
+IPv6SendRA=yes
+
+[Address]
+Address=172.31.17.129/25
+
+[IPv6SendRA]
+UplinkInterface=net1
+
+[IPv6Prefix]
+Prefix=2a00:14b0:f000:23::/64
+Assign=true
+Token=static:::1
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.5-public.network b/resources/chaosknoten/router/systemd_networkd/21-net0.5-public.network
new file mode 100644
index 0000000..d49eb60
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.5-public.network
@@ -0,0 +1,22 @@
+[Match]
+Name=net0.5
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=public
+
+IPv6SendRA=yes
+
+[Address]
+Address=212.12.50.209/29
+
+[IPv6SendRA]
+UplinkInterface=net2
+
+[IPv6Prefix]
+Prefix=2a00:14b0:42:105::/64
+Assign=true
+Token=static:::1