mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2024-11-10 06:51:04 +01:00
Added role native-wireguard-behind-firewall
This commit is contained in:
parent
e865e54777
commit
a273f6752f
2
roles/native-wireguard-behind-firewall/meta/main.yml
Normal file
2
roles/native-wireguard-behind-firewall/meta/main.yml
Normal file
@ -0,0 +1,2 @@
|
||||
dependencies:
|
||||
- native-wireguard
|
4
roles/native-wireguard-behind-firewall/readme.md
Normal file
4
roles/native-wireguard-behind-firewall/readme.md
Normal file
@ -0,0 +1,4 @@
|
||||
# native-wireguard-behind-nat
|
||||
|
||||
# see
|
||||
- https://gist.github.com/insdavm/b1034635ab23b8839bf957aa406b5e39
|
2
roles/native-wireguard-behind-firewall/tasks/main.yml
Normal file
2
roles/native-wireguard-behind-firewall/tasks/main.yml
Normal file
@ -0,0 +1,2 @@
|
||||
- name: adapt iptable rules
|
||||
shell: iptables -A FORWARD -i wg0-client -j ACCEPT && iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
@ -6,5 +6,5 @@ Manages wireguard natively on host. More information are available in the [Arch
|
||||
wg genkey | tee peer_A.key | wg pubkey > peer_A.pub
|
||||
``
|
||||
|
||||
# chown root:systemd-network /etc/systemd/network/99-*.netdev
|
||||
# chmod 0640 /etc/systemd/network/99-*.netdev
|
||||
chown root:systemd-network /etc/systemd/network/99-*.netdev
|
||||
chmod 0640 /etc/systemd/network/99-*.netdev
|
||||
|
@ -8,3 +8,9 @@
|
||||
owner: root
|
||||
group: root
|
||||
notify: restart wireguard
|
||||
|
||||
- name: enable ipv4-forwarding
|
||||
shell: sysctl net.ipv4.ip_forward=1
|
||||
|
||||
- name: enable ipv6-forwarding
|
||||
shell: sysctl net.ipv6.conf.all.forwarding=1
|
||||
|
7
site.yml
7
site.yml
@ -7,11 +7,16 @@
|
||||
- system-update
|
||||
- native-journalctl
|
||||
- native-hostname
|
||||
- name: setup wireguard hosts
|
||||
- name: setup standard wireguard hosts
|
||||
hosts: wireguard_hosts
|
||||
become: true
|
||||
roles:
|
||||
- native-wireguard
|
||||
- name: setup wireguard hosts behind firewall\nat
|
||||
hosts: wireguard_behind_firewall_hosts
|
||||
become: true
|
||||
roles:
|
||||
- native-wireguard-behind-firewall
|
||||
- name: setup primary backup hosts
|
||||
hosts: primary_backup_hosts
|
||||
become: true
|
||||
|
Loading…
Reference in New Issue
Block a user