Skip to content

Latest commit

 

History

History
124 lines (85 loc) · 3.63 KB

README.md

File metadata and controls

124 lines (85 loc) · 3.63 KB
Raw

clammy-ng

The next generation ansible-managed linux router framework using all the trendy new things

preface

If you dislike systemd. This project is not for you.

intro

Current device target is a nanopi-r5s running Armbian using a WAN port for internet, and then LAN1 and LAN2 aggregated in a Router on a stick pattern for east-west traffic.

This should work on a standard ARM or x86 debian linux system. Currently targeted at bleeding edge debian side.. Bookworm should work fine.

Desire is to have a robust router config with zone firewall leveraging the following underlying components

  • netplan
  • firewalld foomuuri
  • dnsmasq
  • frrouting
  • wireguard

functionality status

Currently works:

  • wan configuration
  • bonidng/LACP config
  • vlan support
  • dhcp zones
  • dns
  • zone firewall policies
  • dynamic dns client setup
  • helper script for leases
  • armbian adjustments
    • irqbalance
    • schedutil governor
  • install some helpful tools
    • mtr
    • bmon
    • vnstat
    • lnav
    • dig
    • batcat
    • clammy_leases.sh

getting started

This repo is meant to be the ansible project directory.. or close to it plus documentation.. Trying to leverage off-the-shelf roles when possible. Other roles will via the clammy collection The roles in the clammy collection need README.md updates, but the defaults/main.yml are very understandable. code should be straight forward

environment setup

there are better ways, but this way for now... .gitignore has been preconfigured to use namedspace ansible home ~/.clammy-ng-ansible/ and venv used in the example.

requirements

assume you have python3 and python3-venv installed

python3 -m venv venv
source venv/bin/activate
python3 -m pip install -r requirements.txt
ansible-galaxy install -r requirements.yml
ansible-galaxy install -r requirements-clammy-ng.yml

approach notes

  • everything should be ansible role driven
  • only roles in calling playbook ex: full.yml
  • all config driven by host_vars or group_vars

tool selection

  • try to use modern linux tools
  • no large daemons
  • friendly tui for looking at state on router
  • use things like node_exporter and dnsmasq_exporter for visualizing externally

order of operations

Naturally there's some sequencing challenges with a router.. especially out of the box. For now full.yml is the POC full sequence of operations. in reality, this stuff will proably want to be decoupled...

I think there's going to be a generally need to decouple WAN interface-oriented operations from LAN, including firewall management.

approach so far:

  1. sanitize some armbian stuff such as removing NetworkManager
  2. sysctl_base config # interface specific stuff might move this
  3. configure wan interface
  4. configure lan interfaces
  5. configure vpn interfaces
  6. configure wan firewall ingress and port forwards
  7. configure lan/vpn zones
  8. configure wan/vpn zone policies
  9. configure DHCP / DNS (dnsmasq) # what happens if vpn needs DNS to work?
  10. configure advanced routing (frrouting)
  11. extra ammenitities
  12. configure monitoring

demo and screenshots

Updating firewall demo with ansible / clammy-ng

firewalldemo

Clean interface names thanks to netplan

Handy Script to view dhcp leases

Filter live firewall logs easily with lnav

Bandwidth Monitoring with bmon