12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091 |
- #
- # {{ site }} / {{ network }} FASTd configuration (Salt managed)
- #
- log to syslog level info;
- interface "{{ site }}_{{ network }}";
- {%- if 'aes' in grains['cpu_flags'] %}
- method "aes128-ctr+umac";
- {%- else %}
- #method "aes128-ctr+umac"; # Not supported by CPU on this machine
- {%- endif %}
- method "salsa2012+umac";
- {#- Calculating FASTd port depending on network_type #}
- {%- set port = -1 %}
- {%- if network_type == 'nodes' %}
- {%- set port = 10000 + site_no|int %}
- {%- elif network_type == 'intergw' %}
- {%- set port = 11000 + site_no|int %}
- {%- endif %}
- {%- if network in ['nodes4', 'intergw'] %}
- bind 0.0.0.0:{{ port }} interface "vrf_external";
- {%- endif %}
- {%- if network in ['nodes6', 'intergw'] %}
- bind [::]:{{ port }} interface "vrf_external";
- {%- endif %}
- # Mark packets to make sure they are associated to VRF vrf_external.
- # Specifying the interface and setsockopt() isn't enough for fastd.
- packet mark 0x1023;
- secret "{{ secret }}";
- mtu 1406;
- status socket "/var/run/fastd.{{ site }}_{{ network }}.sock";
- on up "
- ip link set $INTERFACE down
- ip link set address {{ mac_address }} dev $INTERFACE
- ip link set $INTERFACE up
- batctl -m {{ bat_iface }} if add $INTERFACE
- ";
- on down "
- batctl -m {{ bat_iface }} if del $INTERFACE
- ";
- {%- if network_type == 'nodes' %}
- #on establish async "/usr/local/bin/ff_log_vpnpeer establish";
- #on disestablish async "/usr/local/bin/ff_log_vpnpeer disestablish";
- include peers from "/etc/freifunk/peers";
- {%- if peer_limit %}
- peer limit {{ peer_limit }};
- {%- endif %}
- {%- elif network_type == 'intergw' %}
- #
- # Set up Inter-Gw-VPN link to all nodes of this site
- {%- set node_is_gw = True if grains.id.startswith('gw') else False %}
- {%- for peer, peer_config in salt['pillar.get']('nodes').items ()|sort if peer != grains.id %}
- {%- if site not in peer_config.get ('sites', {}) %}{% continue %}{% endif %}
- {%- if 'fastd' not in peer_config %}{% continue %}{% endif %}
- {#- non gw nodes are only allowed to connect to gw peers #}
- {%- set peer_is_gw = True if peer.startswith('gw') else False %}
- {%- if not node_is_gw and not peer_is_gw %}{% continue %}{% endif %}
- # Peer config for {{ peer }}
- peer "{{ peer }}" {
- key "{{ peer_config.get('fastd', {}).get('intergw_pubkey') }}";
- {%- if peer_is_gw %}
- {%- set ips = salt['ffho_net.get_node_iface_ips'](peer_config, 'vrf_external') %}
- {#- set peer IPv4 address #}
- {%- for ipv4 in ips['v4'] %}
- remote {{ ipv4 }}:{{ port }};
- {%- endfor %}
- {#- set peer IPv6 address #}
- {%- for ipv6 in ips['v6'] %}
- remote [{{ ipv6 }}]:{{ port }};
- {%- endfor %}
- {%- endif %}
- }
- {%- endfor %}
- {%- endif %}
|