talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add a bridge for jails behind wireguard.

Browse Source
This commit is contained in:
Tom Alexander 2022-10-29 22:44:35 -04:00
parent 9168cc51cf
commit 68069a17b4
Signed by: talexander
GPG Key ID: D3A179C9A53C0EDE
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ansible/roles/jail/files/jails/cloak.conf
View File

@ -2,6 +2,7 @@ cloak {
path = "/jail/main/jails/cloak"; path = "/jail/main/jails/cloak";
vnet; vnet;
vnet.interface += "host_link2"; vnet.interface += "host_link2";
vnet.interface += "wg_uplink0";
devfs_ruleset = 13; devfs_ruleset = 13;
mount.devfs; # To expose tun device mount.devfs; # To expose tun device

20
ansible/roles/jail/files/setup_netgraph_odo
View File

@ -4,6 +4,9 @@ cleanup() {
ngctl shutdown host_link2: ngctl shutdown host_link2:
ngctl shutdown host_uplink0: ngctl shutdown host_uplink0:
ngctl shutdown host_bridge0: ngctl shutdown host_bridge0:
ngctl shutdown wg_link2:
ngctl shutdown wg_uplink0:
ngctl shutdown wg_bridge0:
} }
setup_netgraph_start() { setup_netgraph_start() {
@ -28,6 +31,23 @@ EOF
ifconfig $(ngctl msg 'host_bridge0:link2' getifname | grep Args | cut -d '"' -f 2) name host_link2 ifconfig $(ngctl msg 'host_bridge0:link2' getifname | grep Args | cut -d '"' -f 2) name host_link2
# Create internal bridge for jails that are forced through wireguard # Create internal bridge for jails that are forced through wireguard
ngctl -d -f - <<EOF
mkpeer . eiface hook ether
name .:hook wg_uplink0
EOF
ngctl -d -f - <<EOF
mkpeer wg_uplink0: bridge ether link0
name wg_uplink0:ether wg_bridge0
EOF
ngctl -d -f - <<EOF
mkpeer wg_bridge0: eiface link2 ether
name wg_bridge0:link2 wg_link2
EOF
ifconfig $(ngctl msg 'wg_uplink0:' getifname | grep Args | cut -d '"' -f 2) name wg_uplink0 10.241.199.1/24 up
ifconfig $(ngctl msg 'wg_bridge0:link2' getifname | grep Args | cut -d '"' -f 2) name wg_link2
} }
setup_netgraph_stop() { setup_netgraph_stop() {