crans
/
ansible
mirror of http://gitlab.adm.crans.org/nounous/ansible.git
19
0
Fork 0
Code Issues Projects Releases Wiki Activity

[wireguard] Also NAT IPv6

certbot_on_virtu
_benjamin 2020-08-24 14:12:23 +02:00
parent c3a8c6002f
commit 1f759b6d20
1 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
roles/wireguard/templates/nftables.conf
View File

@ -2,17 +2,31 @@
flush ruleset flush ruleset
{% set sputnik_ip = query('ldap', 'ip', 'sputnik', 'adm') %} {% set sputnik_ip = (query('ldap', 'ip', 'sputnik', 'adm') | ipv4)[0] %}
table ip nat { table ip nat {
chain prerouting { chain prerouting {
type nat hook prerouting priority 0; policy accept; type nat hook prerouting priority 0; policy accept;
ip daddr {{ sputnik_ip }} dnat 172.31.0.2 ip daddr {{ sputnik_ip }} dnat to 172.31.0.2
} }
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; policy accept; type nat hook postrouting priority 100; policy accept;
ip saddr 172.31.0.2 ip protocol icmp snat {{ sputnik_ip }} ip saddr 172.31.0.2 ip protocol icmp snat to {{ sputnik_ip }}
ip saddr 172.31.0.2 ip protocol tcp snat {{ sputnik_ip }} ip saddr 172.31.0.2 ip protocol tcp snat to {{ sputnik_ip }}
ip saddr 172.31.0.2 ip protocol udp snat {{ sputnik_ip }} ip saddr 172.31.0.2 ip protocol udp snat to {{ sputnik_ip }}
}
}
{% set sputnik_ip6 = (query('ldap', 'ip', 'sputnik', 'adm') | ipv6)[0] %}
table ip6 nat {
chain prerouting {
type nat hook prerouting priority 0; policy accept;
ip6 daddr {{ sputnik_ip6 }} dnat to fd0c:700:0:8::2
}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
ip6 saddr fd0c:700:0:8::2 ip6 nexthdr icmpv6 snat to {{ sputnik_ip6 }}
ip6 saddr fd0c:700:0:8::2 ip6 nexthdr tcp snat to {{ sputnik_ip6 }}
ip6 saddr fd0c:700:0:8::2 ip6 nexthdr udp snat to {{ sputnik_ip6 }}
} }
} }