akadmin/Funk-lab
1
0
Fork 0
mirror of https://github.com/Alkatrazz24/Funk-lab.git synced 2026-07-13 12:14:42 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(wireguard): accès distant au lab via VPN (Freebox 51820/udp → s01) (#80)

Browse source 
- rôle wireguard : serveur wg0 (10.99.0.0/24) sur storage-01, profils
  clients générés dans /etc/wireguard/clients/ (fichier .conf / QR code)
- gateway : filtrage nftables par pair — full (tout le lab) / portal
  (uniquement Traefik :80 = portail Guacamole), masquerade VPN→cluster
- dnsmasq : bind-dynamic + écoute wg0 → *.lab.local résolu dans le tunnel
- pairs initiaux : alkatrazz (full), invite-01 (portal)
- vault : clés WireGuard + reprise de l'archive Authentik (remplace #78)
- doc : admin/infra/wireguard.md (onboarding pair, pièges, exploitation)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
ALI YESILKAYA 2026-07-07 11:11:43 +02:00 • committed by GitHub
parent fbec998c21
commit bc0e1dd53e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
13 changed files with 388 additions and 123 deletions
Download patch file Download diff file Expand all files Collapse all files

29
ansible/roles/gateway/templates/nftables.conf.j2
View file

@ -17,12 +17,15 @@ table inet filter {
ip protocol icmp accept
ip6 nexthdr icmpv6 accept
# SSH depuis le LAN domestique et le LAN cluster
tcp dport 22 ip saddr { 192.168.1.0/24, 192.168.10.0/24 } accept
# SSH depuis le LAN domestique, le LAN cluster et le tunnel WireGuard
tcp dport 22 ip saddr { 192.168.1.0/24, 192.168.10.0/24, 10.99.0.0/24 } accept
# DNS + DHCP (dnsmasq)
udp dport 53 ip saddr 192.168.10.0/24 accept
tcp dport 53 ip saddr 192.168.10.0/24 accept
# WireGuard — handshake/transport (Freebox 51820/udp → funk-s01)
udp dport 51820 accept
# DNS + DHCP (dnsmasq) — cluster + clients VPN (dnsmasq écoute aussi sur wg0)
udp dport 53 ip saddr { 192.168.10.0/24, 10.99.0.0/24 } accept
tcp dport 53 ip saddr { 192.168.10.0/24, 10.99.0.0/24 } accept
udp dport 67 iif {{ lan_interface }} accept
# NFS
@ -73,6 +76,18 @@ table inet filter {
# 7777 = jeu/API ; 8888 = reliable messaging TCP (1.1) — bloqué = kick à ~60 s
ip daddr 192.168.10.20 tcp dport { 7777, 8888 } ct state new,established,related accept
ip daddr 192.168.10.20 udp dport 7777 ct state new,established,related accept
# WireGuard → lab : filtrage par pair (host_vars wireguard_peers)
{% for peer in wireguard_peers | selectattr('access', 'equalto', 'full') | list %}
# {{ peer.name }} — accès complet
iif "wg0" ip saddr {{ peer.ip }} ct state new,established,related accept
{% endfor %}
{% for peer in wireguard_peers | selectattr('access', 'equalto', 'portal') | list %}
# {{ peer.name }} — portail Guacamole uniquement (Traefik)
iif "wg0" ip saddr {{ peer.ip }} ip daddr 192.168.10.200 tcp dport 80 ct state new,established,related accept
{% endfor %}
# Retours vers le tunnel
oif "wg0" ct state established,related accept
}
chain output {
@ -95,5 +110,9 @@ table ip nat {
# NAT masquerade pour le LAN cluster
oif {{ wan_interface }} ip saddr 192.168.10.0/24 masquerade
# Clients VPN → LAN cluster : masquerade en IP s01 (retours garantis même si
# un nœud ne route pas 10.99.0.0/24)
oif {{ lan_interface }} ip saddr 10.99.0.0/24 masquerade
}
}