talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Create a netgraph bridge for jails getting full access to NAT.

Browse Source
This commit is contained in:
Tom Alexander
2022-10-31 21:28:35 -04:00
parent 55c36a2bd9
commit 7bfc817894
3 changed files with 29 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
ansible/roles/jail/files/setup_netgraph_odo
View File

@@ -7,11 +7,15 @@ cleanup() {
ngctl shutdown wg_link2:
ngctl shutdown wg_uplink0:
ngctl shutdown wg_bridge0:
ngctl shutdown host_link3:
ngctl shutdown host_uplink1:
ngctl shutdown host_bridge1:
}
setup_netgraph_start() {
cleanup
# Create a bridge for jails that only speak wireguard
ngctl -d -f - <<EOF
mkpeer . eiface hook ether
name .:hook host_uplink0
@@ -48,6 +52,26 @@ EOF
ifconfig $(ngctl msg 'wg_uplink0:' getifname | grep Args | cut -d '"' -f 2) name wg_uplink0 10.241.199.1/24 up
ifconfig $(ngctl msg 'wg_bridge0:link2' getifname | grep Args | cut -d '"' -f 2) name wg_link2
# Create a bridge for jails given full access to NAT
ngctl -d -f - <<EOF
mkpeer . eiface hook ether
name .:hook host_uplink1
EOF
ngctl -d -f - <<EOF
mkpeer host_uplink1: bridge ether link0
name host_uplink1:ether host_bridge1
EOF
ngctl -d -f - <<EOF
mkpeer host_bridge1: eiface link2 ether
name host_bridge1:link2 host_link3
EOF
ifconfig $(ngctl msg 'host_uplink1:' getifname | grep Args | cut -d '"' -f 2) name host_uplink1 10.213.177.1/24 up
ifconfig $(ngctl msg 'host_bridge1:link2' getifname | grep Args | cut -d '"' -f 2) name host_link3
}
setup_netgraph_stop() {