Lumpiasty/klaster
0
1
Fork 0
Code Issues Pull Requests 6 Packages Projects Releases Wiki Activity

Add NAT64, DNS64 to network

Browse Source
This commit is contained in:
Lumpiasty
2026-06-12 22:08:57 +02:00
parent 374ee146fe
commit 10c3321a5a
12 changed files with 511 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/routeros/tasks/addressing.yml
+7
View File
@@ -6,6 +6,9 @@
- address: 172.20.0.1/24
interface: containers
network: 172.20.0.0
- address: 192.168.239.1/30
interface: nat64
network: 192.168.239.0
- address: 192.168.4.1/24
interface: lo
network: 192.168.4.0
@@ -37,6 +40,10 @@
community.routeros.api_modify:
path: ipv6 address
data:
- address: fc64::1/126
advertise: false
comment: nat64 loopback
interface: nat64
- address: 2001:470:70:dd::2/64
advertise: false
interface: sit1
ansible/roles/routeros/tasks/base.yml
+61 -1
View File
@@ -6,6 +6,7 @@
- name: bridge1
vlan-filtering: true
- name: containers
- name: nat64
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
@@ -65,6 +66,12 @@
- bridge: containers
interface: veth-tailscale
comment: Tailscale container interface
- bridge: containers
interface: veth-coredns
comment: CoreDNS container interface
- bridge: nat64
interface: veth-tayga
comment: Tayga NAT64 container interface
- bridge: bridge1
interface: ether1
pvid: 2
@@ -188,7 +195,8 @@
values:
allow-remote-requests: true
cache-size: 20480
servers: 1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001
# CoreDNS container provides DNS64; it forwards upstream to 1.1.1.1/8.8.8.8.
servers: 172.20.0.3
- name: Configure DNS static entries
community.routeros.api_modify:
@@ -244,6 +252,45 @@
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
- name: Configure DHCP server options (IPv6-only preferred, RFC 8925)
community.routeros.api_modify:
path: ip dhcp-server option
data:
# Option 108: 32-bit seconds timer telling capable clients to disable IPv4.
# 0x00015180 = 86400 seconds (1 day).
- name: v6only-preferred
code: 108
value: 0x00015180
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
- name: Configure DHCP server option sets
community.routeros.api_modify:
path: ip dhcp-server option sets
data:
- name: v6only-set
options: v6only-preferred
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
- name: Attach option 108 to LAN DHCP server
community.routeros.api_find_and_modify:
ignore_dynamic: false
path: ip dhcp-server
find:
name: dhcp1
values:
dhcp-option-set: v6only-set
- name: Attach option 108 to IOT DHCP server
community.routeros.api_find_and_modify:
ignore_dynamic: false
path: ip dhcp-server
find:
name: dhcp3
values:
dhcp-option-set: v6only-set
- name: Configure IPv6 ND defaults
community.routeros.api_find_and_modify:
ignore_dynamic: false
@@ -252,3 +299,16 @@
default: true
values:
advertise-dns: true
- name: Configure IPv6 ND per-interface (pref64 for NAT64 discovery)
community.routeros.api_modify:
path: ipv6 nd
data:
# vlan2 (LAN) and vlan5 (IOT): advertise NAT64 prefix so CLAT-capable
# clients (iOS, Android, macOS) discover the NAT64 gateway via PREF64 RA option.
- interface: vlan2
pref64: 64:ff9b::/96
- interface: vlan5
pref64: 64:ff9b::/96
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
ansible/roles/routeros/tasks/containers.yml
+17 -2
View File
@@ -24,11 +24,11 @@
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
- name: Configure tailscale container
- name: Configure containers
community.routeros.api_modify:
path: container
data:
- dns: 172.17.0.1
- dns: 172.20.0.1
interface: veth-tailscale
logging: true
mountlists: tailscale_state
@@ -36,5 +36,20 @@
remote-image: gitea.lumpiasty.xyz/lumpiasty/mikrotik-tailscale:stable
root-dir: tailscale/root
start-on-boot: true
- dns: 172.20.0.1
interface: veth-coredns
logging: true
name: coredns
remote-image: gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik:latest
root-dir: coredns/root
start-on-boot: true
# Tayga auto-configures from the veth addresses and routes — no env vars needed.
- interface: veth-tayga
logging: true
name: tayga
remote-image: ghcr.io/apalrd/tayga-nat64
root-dir: tayga/root
start-on-boot: true
workdir: /app
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
ansible/roles/routeros/tasks/firewall.yml
+42
View File
@@ -67,6 +67,11 @@
chain: forward
comment: Allow from containers to everywhere
in-interface: containers
- action: accept
chain: forward
comment: Allow Tayga NAT64 pool to internet
out-interface: pppoe-gpon
src-address: 192.168.240.0/20
- action: jump
chain: forward
comment: Allow port forwards
@@ -254,6 +259,11 @@
chain: srcnat
comment: GPON ONT management
dst-address: 192.168.100.1
- action: masquerade
chain: srcnat
comment: Tayga NAT64 dynamic pool to internet
out-interface: pppoe-gpon
src-address: 192.168.240.0/20
- action: dst-nat
chain: dstnat
comment: TS3
@@ -375,6 +385,30 @@
dst-address: 2001:470:71:dd::/64
out-interface-list: wan
reject-with: icmp-no-route
# Block NAT64-mapped RFC1918 destinations before any broad accept rules.
# Without these, NAT64 (64:ff9b::/96) could be used to reach private IPv4
# ranges by encoding them in the prefix — bypassing IPv4 forward policy.
# 64:ff9b::a00:0/104 = 10.0.0.0/8
# 64:ff9b::ac10:0/108 = 172.16.0.0/12
# 64:ff9b::c0a8:0/112 = 192.168.0.0/16
- action: reject
chain: forward
comment: Block NAT64 to RFC1918 (10/8)
dst-address: 64:ff9b::a00:0/104
out-interface: nat64
reject-with: icmp-no-route
- action: reject
chain: forward
comment: Block NAT64 to RFC1918 (172.16/12)
dst-address: 64:ff9b::ac10:0/108
out-interface: nat64
reject-with: icmp-no-route
- action: reject
chain: forward
comment: Block NAT64 to RFC1918 (192.168/16)
dst-address: 64:ff9b::c0a8:0/112
out-interface: nat64
reject-with: icmp-no-route
- action: accept
chain: forward
comment: Allow from LAN to everywhere
@@ -412,6 +446,11 @@
comment: Allow from IOT to internet only
in-interface: vlan5
out-interface-list: wan
- action: accept
chain: forward
comment: Allow from IOT to internet via NAT64
in-interface: vlan5
out-interface: nat64
- action: accept
chain: forward
comment: Allow from OPENWRT UPLINK to internet only
@@ -427,6 +466,9 @@
dst-address: 2001:470:61a3:500::/64
in-interface-list: wan
out-interface: containers
# NAT64 to Tayga is now covered by the broad per-VLAN accept rules above.
# RFC1918-mapped destinations are blocked at the top of the chain before
# those broad accepts, so no separate per-source NAT64 rules are needed.
- action: accept
chain: forward
comment: Allow tcp transmission port to LAN
ansible/roles/routeros/tasks/routing.yml
+16
View File
@@ -21,6 +21,15 @@
suppress-hw-offload: false
target-scope: 10
vrf-interface: pppoe-gpon
- comment: Tayga NAT64 dynamic pool
disabled: false
distance: 1
dst-address: 192.168.240.0/20
gateway: 192.168.239.2
routing-table: main
scope: 30
suppress-hw-offload: false
target-scope: 10
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
@@ -41,6 +50,13 @@
pref-src: ""
routing-table: main
suppress-hw-offload: false
- comment: NAT64 prefix via Tayga
disabled: false
distance: 1
dst-address: 64:ff9b::/96
gateway: fc64::2%nat64
routing-table: main
suppress-hw-offload: false
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
ansible/roles/routeros/tasks/wan.yml
+11
View File
@@ -37,5 +37,16 @@
mac-address: 7E:7E:A1:B1:2A:7B
name: veth-tailscale
comment: Tailscale container
- address: 172.20.0.3/24
dhcp: false
gateway: 172.20.0.1
name: veth-coredns
comment: CoreDNS container
- address: 192.168.239.2/30,fc64::2/126
dhcp: false
gateway: 192.168.239.1
gateway6: fc64::1
name: veth-tayga
comment: Tayga NAT64 container
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible