WIP: Create a role for a Wireguard VPN endpoint
Some checks failed
continuous-integration/drone/push Build is failing

This commit is contained in:
jeltz 2021-01-31 06:07:05 +01:00
parent f6c9208a41
commit ea87aa7ec1
8 changed files with 188 additions and 0 deletions

1
hosts
View file

@ -58,6 +58,7 @@ matrix-services.adm.auro.re
serge.adm.auro.re serge.adm.auro.re
passbolt.adm.auro.re passbolt.adm.auro.re
vpn-ovh.adm.auro.re vpn-ovh.adm.auro.re
vpn-ovh-ng.auro.re
docker-ovh.adm.auro.re docker-ovh.adm.auro.re
switchs-manager.adm.auro.re switchs-manager.adm.auro.re
ldap-replica-ovh.adm.auro.re ldap-replica-ovh.adm.auro.re

View file

@ -0,0 +1,9 @@
---
- name: Reload network interfaces
command: ifreload -a
- name: Reload nftables
systemd:
name: nftables.service
state: reloaded
...

View file

@ -0,0 +1,60 @@
---
- name: Install required packages
apt:
pkg:
- ifupdown2
- wireguard
- nftables
state: latest
update_cache: yes
- name: Tweak sysctl to enable IP forwarding
template:
src: sysctl.conf.j2
dest: /etc/sysctl.d/forwarding.conf
owner: root
group: root
mode: u=rw,g=r,o=
- name: Create tunnels configurations
template:
src: wireguard.conf.j2
dest: "/etc/wireguard/{{ item.name }}.conf"
owner: root
group: root
mode: u=rw,g=,o=
loop: "{{ wireguard_endpoints }}"
# try to hide clear-text private keys from Ansible output
no_log: True
diff: no
- name: Create network interfaces
template:
src: interface.j2
dest: "/etc/network/interfaces.d/{{ item.name }}"
owner: root
group: root
mode: u=rw,g=r,o=
loop: "{{ wireguard_endpoints }}"
no_log: True
diff: no
notify:
- Reload network interfaces
- name: Enable nftables
systemd:
name: nftables.service
state: started
enabled: yes
- name: Configure nftables
template:
src: nftables.conf.j2
dest: /etc/nftables.conf
validate: /sbin/nft -c -f %s
owner: root
group: root
mode: u=rw,g=r,o=
notify:
- Reload nftables
...

View file

@ -0,0 +1,10 @@
# {{ ansible_managed }}
auto {{ item.name }}
iface {{ item.name }}
link-type wireguard
pre-up wg setconf $IFACE /etc/wireguard/$IFACE.conf
{% for addr in item.addrs %}
address {{ addr }}
{% endfor %}

View file

@ -0,0 +1,86 @@
#!/usr/sbin/nft -f
# {{ ansible_managed }}
flush ruleset
#table ip nat {
#
# chain prerouting {
# type nat hook prerouting priority -100
# policy accept
# }
#
# chain postrouting {
# type nat hook prerouting priority 100
# policy accept
#
# #{% for endpoint in wireguard_endpoints %}
# #oifname "{{ endpoint.name }}" masquerade
# #{% endfor %}
# }
#
#}
table inet filter {
set blacklist_v4 {
type ipv4_addr
}
set blacklist_v6 {
type ipv6_addr
}
chain blacklist {
ip saddr @blacklist_v4 drop
ip6 saddr @blacklist_v6 drop
}
chain conntrack {
ct state invalid drop
ct state related, established accept
}
chain input {
type filter hook input priority 0
policy drop
iif lo accept
jump blacklist
jump conntrack
# TODO: ansible + separate nftables module
ip protocol icmp accept
{% for rule in nftables_basic_input_rules %}
{{ rule.proto }} \
{% if "saddr" in rule %} saddr {{ rule.saddr }} \ {% endif %}
{% if "sport" in rule %} sport {{ rule.sport }} \ {% endif %}
{% if "daddr" in rule %} daddr {{ rule.daddr }} \ {% endif %}
{% if "dport" in rule %} dport {{ rule.dport }} \ {% endif %}
{{ rule.verdict }}
{% endfor %}
}
chain forward {
type filter hook forward priority 0
policy drop
iif lo accept
jump blacklist
jump conntrack
{% for endpoint in wireguard_endpoints %}
iifname "{{ endpoint.name }}" accept
{% endfor %}
}
chain output {
type filter hook output priority 0
policy accept
}
}

View file

@ -0,0 +1,4 @@
# {{ ansible_managed }}
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

View file

@ -0,0 +1,12 @@
# {{ ansible_managed }}
[Interface]
Address = {{ item.addrs | join(",") }}
PrivateKey = {{ item.private_key }}
ListenPort = {{ item.listen_port }}
{% for peer in item.peers %}
[Peer]
PublicKey = {{ item.public_key }}
AllowedIps = {{ item.allowed_addrs | join(",") }}
{% endfor %}

6
vpn.yml Executable file
View file

@ -0,0 +1,6 @@
#!/usr/bin/env ansible-playbook
---
- hosts: vpn-ovh-ng.auro.re
roles:
- wireguard-endpoint
...