GitLab

If the openvpn role is applied before the kresd role, then the requisite bind
mounted /etc/knot-resolver directory, that is required for the openvpn container
to start, will not exist when the role attempts to do the systemd restart,
causing a failure.

This is required as of
leap/menshen@8acd8591

subrepo:
  subdir:   "float"
  merged:   "7406f7a"
upstream:
  origin:   "https://git.autistici.org/ai3/float.git"
  branch:   "master"
  commit:   "7406f7a"
git-subrepo:
  version:  "0.4.1"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "a04d8c2"

Instead, install ansible-mitogen package

UDP tuning

Closes #47 and #7

See merge request !49

subrepo:
  subdir:   "float"
  merged:   "65eba04"
upstream:
  origin:   "https://git.autistici.org/ai3/float.git"
  branch:   "master"
  commit:   "65eba04"
git-subrepo:
  version:  "0.4.1"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "a04d8c2"

subrepo:
  subdir:   "float"
  merged:   "abdaea7"
upstream:
  origin:   "https://git.autistici.org/ai3/float.git"
  branch:   "master"
  commit:   "abdaea7"
git-subrepo:
  version:  "0.4.1"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "a04d8c2"

Add UDP support (fixes #29 and fixes #30).

Closes #30 and #29

See merge request !48

Each protocol must have its own netblock pool to draw its client IPs from. So we
change the `openvpn_network` variable to be per-protocol (`openvpn_tcp_network`
and `openvpn_udp_network`), the same for ipv6.

Additionally, we need to also have the nameserver listen on the UDP IP.

This builds on the simplevpn.py change in the previous commit, which produces
the eip-service.json with the udp ports, as well as changes in the openvpn
container which launches a secondary openvpn process for UDP.

Expose UDP ports in eip-service.json

See merge request !47

Kali Kaneko authored Jul 27, 2021 and Kali Kaneko committed Jul 27, 2021

do note that we need to read port info from config if we want to make
that configurable.

Fix listening address for kresd (fixes: #45)

Closes #45

See merge request !46

This will listen on port 1194 and port 53 and redirect traffic to
openvpn (running now on port 80). It will also advertise those ports in the
`eip-service.json`.

In order to accomplish this, we need to have the knot-resolver listen explicitly
on the openvpn ip, instead of being greedy with its ports.

Have shapeshifter listen on ::1 so its available over ipv6 (#40).

See merge request !44

As discussed, we decided to have openvpn run on port 80, and shapeshifter run on
port 443. There did not seem to be any point in obfuscation, if its done on a
standard port.

Block incoming ipv6 to clients

See merge request !43

There is no need for a distinct ipv6 gateway address, we already configure the
v6 address of the gateway in {{ ip6 }} and then one configures an
openvpn_network6 for IPs that the clients get.

We should only be allowing incoming connections to the gateway on its {{ ip }}
address, and outgoing traffic is SNAT'd to using the {{ egress_ip }} for the
source address of outgoing traffic.

Its confusing to call it a gateway address, when the purpose is for it to be
used for egress traffic