Home Explore Help
Register Sign In
mark22k
/
vpn.mk16.de
mirror of https://codeberg.org/mark22k/vpn.mk16.de.git
Watch 1
Star 0
Fork 0
Files Issues 0

No Description

Branch: main
Branches Tags
vpn.mk16.de
ZIP TAR.GZ
Marek Kuethe 8aeff4a09f add new peer 1 month ago
group_vars 0af53a4fe3 initial commit 4 months ago
host_vars 8aeff4a09f add new peer 1 month ago
roles 53f8823e10 improve scripts 3 months ago
.gitignore 4daa9027af Initial commit 4 months ago
LICENSE 4daa9027af Initial commit 4 months ago
README.md d9d7cfab08 bug fixes and add readme 4 months ago
ansible.cfg d9d7cfab08 bug fixes and add readme 4 months ago
inventory.yml 0af53a4fe3 initial commit 4 months ago
pw_file.sh 0af53a4fe3 initial commit 4 months ago
update.yml 53f8823e10 improve scripts 3 months ago
vpn.mk16.de.yml d9d7cfab08 bug fixes and add readme 4 months ago

README.md

vpn.mk16.de

This Ansible profile describes a VPN server based on VyOS. This has one IPv4 and one IPv6. Furthermore, it has a /64 subnet. It is connected to the dnet (dn42 + NeoNetwork + CRXN) via BGP with BFD.

Roles:

  • basics - Increases the commit revision, sets the system name and domain, removes the motd message, and enables system reboot on kernel panic.
  • connection - Configures DNS servers and the IP addresses and routes to access the Internet.
  • dnet - Configures the connection between the dnet gateways and sets the appropriate settings.
  • dns-forwarding - Activates a DNS forwarding service to the system DNS servers and enables it for the clients.
  • firewall - Configures the firewall. It is especially important that no firewall rule number is used twice. Because of the rule numbering, all firewall settings are made in this role.
  • network-tweaks - Increases some kernel limits for better performance.
  • roadwarriar-vpn - Core module for the VPN server. Sets up the WireGuard clients and associated rules. Without this module, the dnet module will not work.
  • save-configuration - Saves the current configuration. (This could also be outsourced to a handler).
  • ssh - Enables SSH
  • ssh-ddos - Enables SSH brute force protection, similar to fail2ban.
  • ssh-keys - Installs my SSH keys
  • ssh-secure - Limits the use of the algorithms with SSH to a safe minimum (only chacha20 with poly1305, AES256-GCM, no Diffle-Hellman, only Curve25519-SHA256, HMAC-sha2-512, umac-128) Maybe disable umac?!