diff options
| author | Egor Tensin <egor@tensin.name> | 2025-11-16 02:26:11 +0100 |
|---|---|---|
| committer | Egor Tensin <egor@tensin.name> | 2025-11-16 02:26:11 +0100 |
| commit | 2f4c770354703fe8a1e47d4d4038fddf92c70ab5 (patch) | |
| tree | 68ade61bc0b292cb790c7458707662aa6411a3f3 /roles | |
| parent | wireguard: wg_router -> wg_server (diff) | |
| download | infra-ansible-2f4c770354703fe8a1e47d4d4038fddf92c70ab5.tar.gz infra-ansible-2f4c770354703fe8a1e47d4d4038fddf92c70ab5.zip | |
wireguard: add parameter to tunnel all traffic
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/wireguard/defaults/main.yml | 2 | ||||
| -rw-r--r-- | roles/wireguard/templates/NetworkManager.nmconnection.j2 | 14 | ||||
| -rw-r--r-- | roles/wireguard/templates/wg-quick.conf.j2 | 8 |
3 files changed, 22 insertions, 2 deletions
diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml index 76d8346..d2826cb 100644 --- a/roles/wireguard/defaults/main.yml +++ b/roles/wireguard/defaults/main.yml @@ -12,3 +12,5 @@ wg_server: false wg_autoconnect: true wg_dependent_services: [] + +wg_tunnel_everything: false diff --git a/roles/wireguard/templates/NetworkManager.nmconnection.j2 b/roles/wireguard/templates/NetworkManager.nmconnection.j2 index 8564f6f..49b44ec 100644 --- a/roles/wireguard/templates/NetworkManager.nmconnection.j2 +++ b/roles/wireguard/templates/NetworkManager.nmconnection.j2 @@ -20,7 +20,9 @@ endpoint={{ peer.endpoint }} preshared-key={{ peer.preshared_key }} preshared-key-flags=0 {% endif %} -{% if peer.allowed_ips is defined %} +{% if wg_tunnel_everything %} +allowed-ips=0.0.0.0/0;::/0; +{% elif peer.allowed_ips is defined %} allowed-ips={{ (peer.allowed_ips | join(';')) + ';' }} {% endif %} {% if peer.persistent_keepalive is defined and peer.persistent_keepalive %} @@ -32,8 +34,18 @@ persistent-keepalive=25 [ipv4] address1={{ wg_addr4 }} method=manual +{% if wg_tunnel_everything %} +dns=1.1.1.1;1.0.0.1; +dns-priority=-10 +dns-search=~; +{% endif %} [ipv6] addr-gen-mode=stable-privacy address1={{ wg_addr6 }} method=manual +{% if wg_tunnel_everything %} +dns=2606:4700:4700::1111;2606:4700:4700::1001; +dns-priority=-10 +dns-search=~; +{% endif %} diff --git a/roles/wireguard/templates/wg-quick.conf.j2 b/roles/wireguard/templates/wg-quick.conf.j2 index 2d11edc..d2d1b69 100644 --- a/roles/wireguard/templates/wg-quick.conf.j2 +++ b/roles/wireguard/templates/wg-quick.conf.j2 @@ -6,6 +6,10 @@ Address = {{ wg_addr4 }}, {{ wg_addr6 }} ListenPort = {{ wg_listen_port }} SaveConfig = false +{% if wg_tunnel_everything %} +DNS = 1.1.1.1, 1.0.0.1, 2606:4700:4700::1111, 2606:4700:4700::1001 +{% endif %} + {% if wg_server %} PostUp = iptables -t nat -A POSTROUTING -s {{ wg_addr4 }} -m policy --pol none --dir out -j MASQUERADE PostUp = iptables -A FORWARD -s {{ wg_addr4 }} -j ACCEPT @@ -24,7 +28,9 @@ PublicKey = {{ peer.public_key }} {% if peer.preshared_key is defined %} PresharedKey = {{ peer.preshared_key }} {% endif %} -{% if peer.allowed_ips is defined %} +{% if wg_tunnel_everything %} +AllowedIPs = 0.0.0.0/0, ::/0 +{% elif peer.allowed_ips is defined %} AllowedIPs = {{ peer.allowed_ips | join(', ') }} {% endif %} {% if peer.endpoint is defined %} |