space_server: enable NAT64/DNS64 network

6 files changed, 34 insertions, 4 deletions

diff --git a/roles/space_server/files/networkd/10-lan15.network b/roles/space_server/files/networkd/10-lan15.network
index b202b9b..4c6babc 100644
--- a/roles/space_server/files/networkd/10-lan15.network
+++ b/roles/space_server/files/networkd/10-lan15.network
@@ -2,7 +2,7 @@
 Name=lan15
 
 [Link]
-ARP=no
+ARP=yes
 
 [Network]
 DHCP=no
diff --git a/roles/space_server/files/networkd/10-nat64.netdev b/roles/space_server/files/networkd/10-nat64.netdev
new file mode 100644
index 0000000..af0b249
--- /dev/null
+++ b/roles/space_server/files/networkd/10-nat64.netdev
@@ -0,0 +1,3 @@
+[NetDev]
+Name=nat64
+Kind=tun
diff --git a/roles/space_server/files/networkd/10-nat64.network b/roles/space_server/files/networkd/10-nat64.network
new file mode 100644
index 0000000..097e388
--- /dev/null
+++ b/roles/space_server/files/networkd/10-nat64.network
@@ -0,0 +1,15 @@
+[Match]
+Name=nat64
+
+[Network]
+DHCP=no
+IPv6AcceptRA=no
+Address=10.42.128.1/17
+IPForward=yes
+LLMNR=no
+MulticastDNS=no
+LLDP=no
+
+[Route]
+Destination=2a01:4262:1ab:0:0:f::/96
+PreferredSource=2a01:4262:1ab::
diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf
index 0cb7c4f..8b3124c 100644
--- a/roles/space_server/files/nftables.conf
+++ b/roles/space_server/files/nftables.conf
@@ -38,9 +38,11 @@ define pass_ip4  = 10.42.4.1
 define pass_net4 = 10.42.4.0/24
 define pass_net6 = 2a01:4262:1ab:e::/64
 
-#define nat64_if   = nat64
-#define nat64_net  = 10.42.255.0/24
-#define nat64_net6 = fde2:52b4:4a19:ffff::/96
+define futu_if   = lan15
+define futu_net6 = 2a01:4262:1ab:f::/64
+
+define nat64_if   = nat64
+define nat64_net4 = 10.42.128.0/17
 
 define colo_if   = lan20
 define colo_ip4  = 185.38.175.65
@@ -116,6 +118,7 @@ table ip filter {
 		iif $priv_if ip saddr $priv_net4 accept
 		iif $free_if ip saddr $free_net4 ip daddr != $int_net4 accept
 		iif $pass_if ip saddr $pass_net4 accept
+		iif $nat64_if ip saddr $nat64_net4 accept
 		iif $colo_if ip saddr $colo_net4 ip daddr != $int_net4 accept
 		oif $colo_if accept
 
@@ -171,6 +174,7 @@ table ip6 filter {
 		iif $priv_if ip6 saddr $priv_net6 accept
 		iif $free_if ip6 saddr $free_net6 ip6 daddr != $ext_net6 accept
 		iif $pass_if ip6 saddr $pass_net6 accept
+		iif $futu_if ip6 saddr $futu_net6 accept
 		iif $colo_if ip6 saddr $colo_net6 ip6 daddr != $ext_net6 accept
 		oif $colo_if accept
 
diff --git a/roles/space_server/files/nftables.service b/roles/space_server/files/nftables.service
index f1c9028..89e9cfe 100644
--- a/roles/space_server/files/nftables.service
+++ b/roles/space_server/files/nftables.service
@@ -8,6 +8,7 @@ Requires=sys-devices-virtual-net-lan13.device
 Requires=sys-devices-virtual-net-lan14.device
 Requires=sys-devices-virtual-net-lan15.device
 Requires=sys-devices-virtual-net-lan20.device
+Requires=sys-devices-virtual-net-nat64.device
 After=sys-devices-virtual-net-lan10.device
 After=sys-devices-virtual-net-lan11.device
 After=sys-devices-virtual-net-lan12.device
@@ -15,6 +16,7 @@ After=sys-devices-virtual-net-lan13.device
 After=sys-devices-virtual-net-lan14.device
 After=sys-devices-virtual-net-lan15.device
 After=sys-devices-virtual-net-lan20.device
+After=sys-devices-virtual-net-nat64.device
 Before=network-online.target
 
 [Service]
diff --git a/roles/space_server/files/tayga-labitat.conf b/roles/space_server/files/tayga-labitat.conf
new file mode 100644
index 0000000..f9826d9
--- /dev/null
+++ b/roles/space_server/files/tayga-labitat.conf
@@ -0,0 +1,6 @@
+tun-device nat64
+ipv4-addr 10.42.128.1
+#ipv6-addr 2a01:4262:1ab::
+prefix 2a01:4262:1ab:0:0:f::/96
+dynamic-pool 10.42.128.0/17
+data-dir /var/lib/tayga/labitat