added mullvad uplink

roles/configure_iptables/templates/ip6tables.rules

@@ -10,13 +10,18 @@
 {% endfor %}
 {% endif %}
 
-{% if 'ffrl_uplink' in group_names %}
+{% if 'fastd' in group_names %}
+{% for peer in groups['ffrl_uplink'] %}
+-A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} ! -s fe80::/64 ! -d fe80::/64 -j MARK --set-xmark 0x1/0xffffffff
+{% endfor %}
+{% endif %}
+{% if 'mullvad_uplink' in group_names %}
 {% for peer in groups['fastd'] %}
 -A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} ! -s fe80::/64 ! -d fe80::/64 -j MARK --set-xmark 0x1/0xffffffff
 {% endfor %}
 {% endif %}
-{% if 'fastd' in group_names %}
+{% if 'ffrl_uplink' in group_names %}
-{% for peer in groups['ffrl_uplink'] %}
+{% for peer in groups['fastd'] %}
 -A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} ! -s fe80::/64 ! -d fe80::/64 -j MARK --set-xmark 0x1/0xffffffff
 {% endfor %}
 {% endif %}
@@ -47,13 +52,18 @@ COMMIT
 {% endfor %}
 {% endif %}
 # wireguard_backbone
-{% if 'ffrl_uplink' in group_names %}
+{% if 'fastd' in group_names %}
+{% for peer in groups['ffrl_uplink'] %}
+-A INPUT -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -p udp --dport 6696 -j ACCEPT
+{% endfor %}
+{% endif %}
+{% if 'mullvad_uplink' in group_names %}
 {% for peer in groups['fastd'] %}
 -A INPUT -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -p udp --dport 6696 -j ACCEPT
 {% endfor %}
 {% endif %}
-{% if 'fastd' in group_names %}
+{% if 'ffrl_uplink' in group_names %}
-{% for peer in groups['ffrl_uplink'] %}
+{% for peer in groups['fastd'] %}
 -A INPUT -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -p udp --dport 6696 -j ACCEPT
 {% endfor %}
 {% endif %}

roles/configure_iptables/templates/iptables.rules

@@ -10,13 +10,18 @@
 {% endfor %}
 {% endif %}
 
-{% if 'ffrl_uplink' in group_names %}
+{% if 'fastd' in group_names %}
+{% for peer in groups['ffrl_uplink'] %}
+-A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -j MARK --set-xmark 0x1/0xffffffff
+{% endfor %}
+{% endif %}
+{% if 'mullvad_uplink' in group_names %}
 {% for peer in groups['fastd'] %}
 -A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -j MARK --set-xmark 0x1/0xffffffff
 {% endfor %}
 {% endif %}
-{% if 'fastd' in group_names %}
+{% if 'ffrl_uplink' in group_names %}
-{% for peer in groups['ffrl_uplink'] %}
+{% for peer in groups['fastd'] %}
 -A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -j MARK --set-xmark 0x1/0xffffffff
 {% endfor %}
 {% endif %}
@@ -78,4 +83,7 @@ COMMIT
 -A POSTROUTING ! -s {{ ffrl_ip4 }} -o {{ peer.name }} -j SNAT --to-source {{ ffrl_ip4 }}
 {% endfor %}
 {% endif %}
+{% if 'mullvad_uplink' in group_names %}
+-A POSTROUTING -o mullvad -j MASQUERADE
+{% endif %}
 COMMIT

roles/install_babeld/templates/babeld.conf.j2

@@ -50,6 +50,9 @@ import-table 42
 #in ip 2001:db8:cafe:cafe::/64 allow
 #in deny
 
+{% if 'mullvad_uplink' in group_names %}
+redistribute if mullvad metric 128
+{% endif %}
 {% if 'ffrl_uplink' in group_names %}
 {% for peer in ffrl_peers %}
 redistribute if {{ peer.name }} metric 128

roles/install_openvpn/files/mullvad-up.sh

@@ -3,6 +3,6 @@
 sleep 3
 echo Reroute via $route_vpn_gateway
 ip route replace 0.0.0.0/0 via $route_vpn_gateway proto static table ffmyk
-ip -6 route replace default dev $dev proto static table ffmyk
+#ip -6 route replace default dev $dev proto static table ffmyk
 
 exit 0

roles/install_wireguard_backbone/tasks/main.yml

@@ -4,8 +4,12 @@
       src: wgbackbone@.service
       dest: /etc/systemd/system/wgbackbone@.service
 
+- include_tasks: fastd_tasks.yml
+  when: "'fastd' in group_names"
+
+- include_tasks: mullvad_uplink_tasks.yml
+  when: "'mullvad_uplink' in group_names"
+
 - include_tasks: ffrl_uplink_tasks.yml
   when: "'ffrl_uplink' in group_names"
 
-- include_tasks: fastd_tasks.yml
-  when: "'fastd' in group_names"

roles/install_wireguard_backbone/tasks/mullvad_uplink_tasks.yml

@@ -0,0 +1,29 @@
+---
+- name: create wireguard config for peers
+  template:
+      src: wg.conf.j2
+      dest: /etc/wireguard/wgbb{{ hostvars[item]['wireguard_bb_name'] }}.conf
+      mode: 0400
+  with_items: "{{ groups['fastd'] }}"
+
+- name: create wireguard up scripts for peers
+  template:
+      src: up.sh.j2
+      dest: /etc/wireguard/upbb{{ hostvars[item]['wireguard_bb_name'] }}.sh
+      mode: 0744
+  with_items: "{{ groups['fastd'] }}"
+
+- name: create wireguard down scripts for peers
+  template:
+      src: down.sh.j2
+      dest: /etc/wireguard/downbb{{ hostvars[item]['wireguard_bb_name'] }}.sh
+      mode: 0744
+  with_items: "{{ groups['fastd'] }}"
+
+- name: start and enable wireguard mesh
+  systemd:
+      name: wgbackbone@{{ hostvars[item]['wireguard_bb_name'] }}.service
+      enabled: yes
+      state: started
+      daemon_reload: yes
+  with_items: "{{ groups['fastd'] }}"

setup_fastd.yml

@@ -26,10 +26,23 @@
       #- install_monitoring
       - install_admin_packages
 - name: install openvpn uplink
-  hosts: mullvad_fastd
+  hosts: mullvad_uplink
   user: root
   roles:
+      - configure_journald
+      - configure_sysctl
+      - configure_iptables
+      - configure_static_routes
+      - install_cronie
+      #- install_php
+      #- install_nginx
+      - install_ntp
+      - install_haveged
+      - install_wireguard
+      - install_wireguard_backbone
+      - install_babeld
       - install_openvpn
+      - install_admin_packages
 - name: setup ffrl
   hosts: ffrl_uplink
   user: root