Starting an rc file to set up netgraph.

ansible/roles/jail/files/setup_netgraph

@@ -0,0 +1,23 @@
+#!/bin/sh
+# /usr/local/etc/rc.d/setup_netgraph
+#
+# REQUIRE: FILESYSTEM kld
+# PROVIDE: setup_netgraph
+# BEFORE: netif
+
+. /etc/rc.subr
+name=setup_netgraph
+rcvar=${name}_enable
+start_cmd="${name}_start"
+stop_cmd="${name}_stop"
+load_rc_config $name
+
+setup_netgraph_start() {
+    /usr/local/bin/setup_netgraph start
+}
+
+setup_netgraph_stop() {
+    /usr/local/bin/setup_netgraph stop
+}
+
+run_rc_command "$1"

ansible/roles/jail/files/setup_netgraph_odo

@@ -0,0 +1,41 @@
+#!/usr/local/bin/bash
+
+cleanup() {
+    ngctl shutdown nat_link2:
+    ngctl shutdown nat_uplink0:
+    ngctl shutdown jail_nat_wg0:
+}
+
+setup_netgraph_start() {
+    cleanup
+
+    ngctl -d -f - <<EOF
+mkpeer . eiface hook ether
+name .:hook nat_uplink0
+EOF
+
+    ngctl -d -f - <<EOF
+mkpeer nat_uplink0: bridge ether link0
+name nat_uplink0:ether jail_nat_wg0
+EOF
+
+    ngctl -d -f - <<EOF
+mkpeer jail_nat_wg0: eiface link2 ether
+name jail_nat_wg0:link2 nat_link2
+EOF
+
+    ifconfig $(ngctl msg 'nat_uplink0:' getifname | grep Args | cut -d '"' -f 2) name nat_uplink0 10.10.11.1/24 up
+    ifconfig $(ngctl msg 'jail_nat_wg0:link2' getifname | grep Args | cut -d '"' -f 2) name nat_link2
+}
+
+setup_netgraph_stop() {
+    cleanup
+}
+
+if [ "$1" = "start" ]; then
+    setup_netgraph_start
+elif [ "$1" = "stop" ]; then
+    setup_netgraph_stop
+else
+    >&2 echo "Unrecognized command"
+fi