Add NAT64, DNS64 to network

ansible/roles/routeros/tasks/base.yml

@@ -6,6 +6,7 @@
       - name: bridge1
         vlan-filtering: true
       - name: containers
+      - name: nat64
     handle_absent_entries: remove
     handle_entries_content: remove_as_much_as_possible
 
@@ -65,6 +66,12 @@
       - bridge: containers
         interface: veth-tailscale
         comment: Tailscale container interface
+      - bridge: containers
+        interface: veth-coredns
+        comment: CoreDNS container interface
+      - bridge: nat64
+        interface: veth-tayga
+        comment: Tayga NAT64 container interface
       - bridge: bridge1
         interface: ether1
         pvid: 2
@@ -188,7 +195,8 @@
     values:
       allow-remote-requests: true
       cache-size: 20480
-      servers: 1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001
+      # CoreDNS container provides DNS64; it forwards upstream to 1.1.1.1/8.8.8.8.
+      servers: 172.20.0.3
 
 - name: Configure DNS static entries
   community.routeros.api_modify:
@@ -244,6 +252,45 @@
     handle_absent_entries: remove
     handle_entries_content: remove_as_much_as_possible
 
+- name: Configure DHCP server options (IPv6-only preferred, RFC 8925)
+  community.routeros.api_modify:
+    path: ip dhcp-server option
+    data:
+      # Option 108: 32-bit seconds timer telling capable clients to disable IPv4.
+      # 0x00015180 = 86400 seconds (1 day).
+      - name: v6only-preferred
+        code: 108
+        value: 0x00015180
+    handle_absent_entries: remove
+    handle_entries_content: remove_as_much_as_possible
+
+- name: Configure DHCP server option sets
+  community.routeros.api_modify:
+    path: ip dhcp-server option sets
+    data:
+      - name: v6only-set
+        options: v6only-preferred
+    handle_absent_entries: remove
+    handle_entries_content: remove_as_much_as_possible
+
+- name: Attach option 108 to LAN DHCP server
+  community.routeros.api_find_and_modify:
+    ignore_dynamic: false
+    path: ip dhcp-server
+    find:
+      name: dhcp1
+    values:
+      dhcp-option-set: v6only-set
+
+- name: Attach option 108 to IOT DHCP server
+  community.routeros.api_find_and_modify:
+    ignore_dynamic: false
+    path: ip dhcp-server
+    find:
+      name: dhcp3
+    values:
+      dhcp-option-set: v6only-set
+
 - name: Configure IPv6 ND defaults
   community.routeros.api_find_and_modify:
     ignore_dynamic: false
@@ -252,3 +299,16 @@
       default: true
     values:
       advertise-dns: true
+
+- name: Configure IPv6 ND per-interface (pref64 for NAT64 discovery)
+  community.routeros.api_modify:
+    path: ipv6 nd
+    data:
+      # vlan2 (LAN) and vlan5 (IOT): advertise NAT64 prefix so CLAT-capable
+      # clients (iOS, Android, macOS) discover the NAT64 gateway via PREF64 RA option.
+      - interface: vlan2
+        pref64: 64:ff9b::/96
+      - interface: vlan5
+        pref64: 64:ff9b::/96
+    handle_absent_entries: remove
+    handle_entries_content: remove_as_much_as_possible