From f80a8e9df1b76a57f13ec70b4c8f87f4a0d74ac2 Mon Sep 17 00:00:00 2001 From: Kyattsukuro Date: Wed, 9 Sep 2026 23:41:14 +0200 Subject: [PATCH] added homeassistant --- inventory/host_vars/beDebianMain.yml | 33 ++++-- playbooks/homeassistant.yml | 6 + roles/base_server/tasks/main.yml | 1 + roles/homeassistant/README.md | 3 + roles/homeassistant/defaults/main.yml | 18 +++ roles/homeassistant/handlers/main.yml | 8 ++ roles/homeassistant/meta/main.yml | 20 ++++ .../tasks/ensure_configuration.yml | 30 +++++ roles/homeassistant/tasks/main.yml | 64 ++++++++++ roles/homeassistant/templates/.env.j2 | 1 + roles/homeassistant/templates/compose.yml.j2 | 100 ++++++++++++++++ .../homeassistant_configuration/http.yaml.j2 | 5 + .../homeassistant/templates/mosquitto.conf.j2 | 9 ++ .../zigbee2mqtt/configuration.yaml.j2 | 13 ++ shelf/be.urmel.md | 112 ++++++++---------- 15 files changed, 350 insertions(+), 73 deletions(-) create mode 100644 playbooks/homeassistant.yml create mode 100644 roles/homeassistant/README.md create mode 100644 roles/homeassistant/defaults/main.yml create mode 100644 roles/homeassistant/handlers/main.yml create mode 100644 roles/homeassistant/meta/main.yml create mode 100644 roles/homeassistant/tasks/ensure_configuration.yml create mode 100644 roles/homeassistant/tasks/main.yml create mode 100644 roles/homeassistant/templates/.env.j2 create mode 100644 roles/homeassistant/templates/compose.yml.j2 create mode 100644 roles/homeassistant/templates/homeassistant_configuration/http.yaml.j2 create mode 100644 roles/homeassistant/templates/mosquitto.conf.j2 create mode 100644 roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2 diff --git a/inventory/host_vars/beDebianMain.yml b/inventory/host_vars/beDebianMain.yml index 57d7852..917a59e 100644 --- a/inventory/host_vars/beDebianMain.yml +++ b/inventory/host_vars/beDebianMain.yml @@ -1,6 +1,19 @@ _speedup_bitwarden_hetzner_record: "{{ bitwarden_records_urmel_services['Hetzner'] }}" _speedup_bitwarden_hetzner_fields: "{{ dict(_speedup_bitwarden_hetzner_record.fields|map(attribute='name')|zip(_speedup_bitwarden_hetzner_record.fields|map(attribute='value'))) }}" + +traefik_override: + main_domain: "be.urmel.de" + http_port: "8080" + https_port: "8443" + + include_external_services: + homeassistant: + url: "{{ ansible_facts.default_ipv4.address }}" + + hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" + basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}" + ddns_override: domains: - provider: "hetznercloud" @@ -20,17 +33,21 @@ ddns_override: ip_version: "ipv6" token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" -traefik_override: - main_domain: "be.urmel.de" - http_port: "8080" - https_port: "8443" - - hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" - basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}" - dns_override: api_key: "{{ bitwarden_records_urmel_services['Pihole'].login.password }}" domain: "pihole.arpa.be.urmel.de" local_domain: "be.urmel.de" domain_host: 192.168.1.2 domain_host_v6: fd00:0000:1000::2 + +homeassistant_override: + url: "home.be.urmel.de" + proxy_ip: 172.16.0.0/12 + mqtt: + zigbee2mqtt: + zigbee_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0" + version: latest + domain: "mqtt.arpa.be.urmel.de" + auth_token: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'mqtt_auth_token') | first).value }}" + mariadb: + password: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'mariadb_password') | first).value }}" diff --git a/playbooks/homeassistant.yml b/playbooks/homeassistant.yml new file mode 100644 index 0000000..0e3c037 --- /dev/null +++ b/playbooks/homeassistant.yml @@ -0,0 +1,6 @@ +--- +- hosts: beDebianMain + pre_tasks: + - include_tasks: _lazy_lookup_workaround.yml + roles: + - homeassistant diff --git a/roles/base_server/tasks/main.yml b/roles/base_server/tasks/main.yml index 00ab13b..504052c 100644 --- a/roles/base_server/tasks/main.yml +++ b/roles/base_server/tasks/main.yml @@ -16,6 +16,7 @@ package: name: - vim + - curl state: latest - name: copy docker deamon.json diff --git a/roles/homeassistant/README.md b/roles/homeassistant/README.md new file mode 100644 index 0000000..b92e34f --- /dev/null +++ b/roles/homeassistant/README.md @@ -0,0 +1,3 @@ +# homeassistant + +Note: Homeassistant sometimes expectes .yaml NOT .yml diff --git a/roles/homeassistant/defaults/main.yml b/roles/homeassistant/defaults/main.yml new file mode 100644 index 0000000..af1a869 --- /dev/null +++ b/roles/homeassistant/defaults/main.yml @@ -0,0 +1,18 @@ +path: /srv/{{ role_name }} + +homeassistant_override: {} +homeassistant_defaults: + url: "" + version: latest + proxy_ip: "" + mqtt: + zigbee2mqtt: + version: latest + domain: "" + auth_token: "" + zigbee_adapter_id: "" + mosquitto: + version: latest + allow_anonymous: true + mariadb: + password: "" diff --git a/roles/homeassistant/handlers/main.yml b/roles/homeassistant/handlers/main.yml new file mode 100644 index 0000000..e7f32dc --- /dev/null +++ b/roles/homeassistant/handlers/main.yml @@ -0,0 +1,8 @@ +- name: restart container + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + recreate: "always" + services: ["homeassistant"] + state: "restarted" + when: not _homeassistant_already_restarted diff --git a/roles/homeassistant/meta/main.yml b/roles/homeassistant/meta/main.yml new file mode 100644 index 0000000..8db596d --- /dev/null +++ b/roles/homeassistant/meta/main.yml @@ -0,0 +1,20 @@ +--- +galaxy_info: + author: "Niklas Freese " + description: homeassistant + company: "Urmel Services" + license: AGPL-3.0-or-later + min_ansible_version: 2.1 + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: + - role: traefik diff --git a/roles/homeassistant/tasks/ensure_configuration.yml b/roles/homeassistant/tasks/ensure_configuration.yml new file mode 100644 index 0000000..fb3fd7d --- /dev/null +++ b/roles/homeassistant/tasks/ensure_configuration.yml @@ -0,0 +1,30 @@ +- name: Find Home Assistant configuration templates locally + ansible.builtin.set_fact: + ha_templates: "{{ query('ansible.builtin.fileglob', role_path + '/templates/homeassistant_configuration/*.yaml.j2') }}" + +- name: Template Home Assistant configuration files + ansible.builtin.template: + src: "{{ item }}" + dest: "/srv/homeassistant/config/homeassistant/{{ item | basename | regex_replace('\\.j2$', '') }}" + mode: "0644" + loop: "{{ ha_templates }}" + loop_control: + label: "{{ item | basename }}" + +- name: Ensure Home Assistant configuration.yaml exists + ansible.builtin.file: + path: "/srv/homeassistant/config/homeassistant/configuration.yaml" + state: touch + mode: "0644" + modification_time: preserve + access_time: preserve + +- name: Add Home Assistant configuration includes + ansible.builtin.blockinfile: + path: "/srv/homeassistant/config/homeassistant/configuration.yaml" + marker: "# {mark} ANSIBLE MANAGED CONFIGURATION INCLUDES" + insertafter: EOF + block: | + {% for item in ha_templates | sort %} + {{ item | basename | regex_replace('\.yaml\.j2$', '') }}: !include {{ item | basename | regex_replace('\.j2$', '') }} + {% endfor %} diff --git a/roles/homeassistant/tasks/main.yml b/roles/homeassistant/tasks/main.yml new file mode 100644 index 0000000..abdf5fc --- /dev/null +++ b/roles/homeassistant/tasks/main.yml @@ -0,0 +1,64 @@ +--- +- name: "set local variables from overrides and defaults" + set_fact: + homeassistant: "{{ (homeassistant_defaults | combine(homeassistant_override, recursive=True)) if homeassistant_override else homeassistant_defaults }}" + +- name: ensure that path exists + file: + path: "{{ path }}/config/homeassistant" + state: directory + +- name: ensure that mosquitto config path exists + file: + path: "{{ path }}/config/mosquitto" + state: directory + +- name: ensure that mosquitto data path exists + file: + path: "{{ item }}" + state: directory + owner: "1883" + group: "1883" + loop: + - "{{ path }}/data/mosquitto" + - "{{ path }}/data/mosquitto/log" + +- name: ensure that zigbee2mqtt data path exists + file: + path: "{{ path }}/data/zigbee2mqtt" + state: directory + +- name: template docker-compose + template: + src: compose.yml.j2 + dest: "{{ path }}/compose.yml" + +- name: template .env + template: + src: .env.j2 + dest: "{{ path }}/.env" + +- name: template mosquitto config + template: + src: mosquitto.conf.j2 + dest: "{{ path }}/config/mosquitto/mosquitto.conf" + mode: "0644" + +- name: template zigbee2mqtt config + template: + src: zigbee2mqtt/configuration.yaml.j2 + dest: "{{ path }}/data/zigbee2mqtt/configuration.yaml" + mode: "0644" + +- name: Do configuration + include_tasks: ensure_configuration.yml + +- name: ensure container is running + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + state: "present" + pull: "always" + wait: true + services: ["mariadb", "mosquitto", "homeassistant", "zigbee2mqtt"] + register: _compose_result diff --git a/roles/homeassistant/templates/.env.j2 b/roles/homeassistant/templates/.env.j2 new file mode 100644 index 0000000..5a175b6 --- /dev/null +++ b/roles/homeassistant/templates/.env.j2 @@ -0,0 +1 @@ +SUBNET=172.31.254 diff --git a/roles/homeassistant/templates/compose.yml.j2 b/roles/homeassistant/templates/compose.yml.j2 new file mode 100644 index 0000000..c025e35 --- /dev/null +++ b/roles/homeassistant/templates/compose.yml.j2 @@ -0,0 +1,100 @@ +version: '3' + +services: + homeassistant: + image: homeassistant/home-assistant:{{ homeassistant.version }} + volumes: + # We do not yes manage configs with ansible + - ./config/homeassistant:/config + - /etc/localtime:/etc/localtime:ro + restart: unless-stopped + environment: + TZ: Europe/Berlin + network_mode: "host" +# networks: +# local_network: +# ipv4_address: ${SUBNET}.2 + depends_on: + - zigbee2mqtt + - mariadb + - mosquitto + extra_hosts: + - "zwave:${SUBNET}.3" + - "zigbee2mqtt:${SUBNET}.6" + - "mariadb:${SUBNET}.4" + - "mosquitto:${SUBNET}.5" +# ports: +# - 8123:8123 +# - 1400:1400 +# - 1401:1401 + +{% if homeassistant.mqtt.zigbee2mqtt.zigbee_adapter_id %} + zigbee2mqtt: + # 8080 + image: ghcr.io/koenkk/zigbee2mqtt:{{ homeassistant.mqtt.zigbee2mqtt.version }} + restart: unless-stopped + volumes: + - ./data/zigbee2mqtt:/app/data + - /run/udev:/run/udev:ro + environment: + - TZ=Europe/Berlin + networks: + local_network: + ipv4_address: ${SUBNET}.6 + exposed: + devices: + # Make sure this matched your adapter location + - /dev/serial/by-id/{{ homeassistant.mqtt.zigbee2mqtt.zigbee_adapter_id }}:/dev/ttyUSB0 + labels: + traefik.enable: true + + traefik.http.routers.homeassistant-mqtt.entrypoints: https + traefik.http.routers.homeassistant-mqtt.rule: Host(`{{ homeassistant.mqtt.zigbee2mqtt.domain }}`) + traefik.http.services.homeassistant-mqtt.loadbalancer.server.port: 8080 + traefik.http.routers.homeassistant-mqtt.tls: "true" + traefik.http.routers.homeassistant-mqtt.tls.certresolver: hetzner + traefik.http.routers.homeassistant-mqtt.middlewares: local-only@file +{% endif %} + + mosquitto: + image: eclipse-mosquitto:{{ homeassistant.mqtt.mosquitto.version }} + restart: unless-stopped + user: "1883:1883" + volumes: + - ./config/mosquitto:/mosquitto/config:ro + - ./data/mosquitto:/mosquitto/data + - ./data/mosquitto/log:/mosquitto/log + environment: + - TZ=Europe/Berlin + networks: + local_network: + ipv4_address: ${SUBNET}.5 + + mariadb: + image: mariadb:10.11.2 + volumes: + - ./data/mariadb:/var/lib/mysql + - ./config/mariadb:/etc/mysql/conf.d + - /etc/localtime:/etc/localtime:ro + + restart: unless-stopped + environment: + MARIADB_ROOT_PASSWORD: {{ homeassistant.mariadb.password }} + MARIADB_MYSQL_LOCALHOST_USER: "yes" + MARIADB_MYSQL_LOCALHOST_GRANTS: "yes" + MARIADB_AUTO_UPGRADE: "yes" + MARIADB_DISABLE_UPGRADE_BACKUP: "yes" + TZ: Europe/Berlin + networks: + local_network: + ipv4_address: ${SUBNET}.4 + +networks: + local_network: + ipam: + driver: default + config: + - subnet: ${SUBNET}.0/24 + exposed: + name: traefik_exposed + external: true diff --git a/roles/homeassistant/templates/homeassistant_configuration/http.yaml.j2 b/roles/homeassistant/templates/homeassistant_configuration/http.yaml.j2 new file mode 100644 index 0000000..9a6d1f8 --- /dev/null +++ b/roles/homeassistant/templates/homeassistant_configuration/http.yaml.j2 @@ -0,0 +1,5 @@ +use_x_forwarded_for: true +trusted_proxies: +- {{ homeassistant.proxy_ip }} + +# DOSE NOT WORK, MUST BE SET MANUALY AT FIRST BOOT diff --git a/roles/homeassistant/templates/mosquitto.conf.j2 b/roles/homeassistant/templates/mosquitto.conf.j2 new file mode 100644 index 0000000..71ce37d --- /dev/null +++ b/roles/homeassistant/templates/mosquitto.conf.j2 @@ -0,0 +1,9 @@ +# Ansible managed +persistence true +persistence_location /mosquitto/data/ +log_dest file /mosquitto/log/mosquitto.log + +listener 1883 +protocol mqtt + +allow_anonymous {{ 'true' if homeassistant.mqtt.mosquitto.allow_anonymous else 'false' }} diff --git a/roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2 b/roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2 new file mode 100644 index 0000000..c2f71a4 --- /dev/null +++ b/roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2 @@ -0,0 +1,13 @@ +# Ansible managed +homeassistant: true +mqtt: + base_topic: zigbee2mqtt + server: 'mqtt://mosquitto:1883' +serial: + port: /dev/ttyUSB0 +advanced: + log_level: info +frontend: + enabled: true + auth_token: {{ homeassistant.mqtt.zigbee2mqtt.auth_token }} +version: 5 diff --git a/shelf/be.urmel.md b/shelf/be.urmel.md index 687ef1c..85d9632 100644 --- a/shelf/be.urmel.md +++ b/shelf/be.urmel.md @@ -1,11 +1,41 @@ # Proxmox WLAN IP-Tables ### V4 ``` -# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026 +# Generated by iptables-save v1.8.11 on Wed Sep 9 03:31:03 2026 +*nat +:PREROUTING ACCEPT [607:102422] +:INPUT ACCEPT [226:15893] +:OUTPUT ACCEPT [237:16252] +:POSTROUTING ACCEPT [2202:155522] +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443 +-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53 +-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443 +-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53 +-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE +COMMIT +# Completed on Wed Sep 9 03:31:03 2026 +# Generated by iptables-save v1.8.11 on Wed Sep 9 03:31:03 2026 +*raw +:PREROUTING ACCEPT [91865:11405819] +:OUTPUT ACCEPT [10786:3643869] +-A PREROUTING -i fwbr+ -j CT --zone 1 +-A PREROUTING -i fwbr+ -j CT --zone 100 +COMMIT +# Completed on Wed Sep 9 03:31:03 2026 +# Generated by iptables-save v1.8.11 on Wed Sep 9 03:31:03 2026 *filter -:INPUT ACCEPT [479923:96015305] -:FORWARD ACCEPT [309996:354561575] -:OUTPUT ACCEPT [475252:104246097] +:INPUT ACCEPT [12340:2837091] +:FORWARD ACCEPT [34550:5062071] +:OUTPUT ACCEPT [10728:3637989] -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 51820 -j ACCEPT -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 51820 -j ACCEPT -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 80 -j ACCEPT @@ -16,59 +46,15 @@ -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8080 -j ACCEPT -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8443 -j ACCEPT -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8443 -j ACCEPT -# -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT -# -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 67 -j ACCEPT - COMMIT -# Completed on Sun Jul 26 18:26:48 2026 -# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026 -*raw -:PREROUTING ACCEPT [936759:484955391] -:OUTPUT ACCEPT [475255:104246408] --A PREROUTING -i fwbr+ -j CT --zone 1 --A PREROUTING -i fwbr+ -j CT --zone 100 --A PREROUTING -i fwbr+ -j CT --zone 1 --A PREROUTING -i fwbr+ -j CT --zone 100 --A PREROUTING -i fwbr+ -j CT --zone 100 --A PREROUTING -i fwbr+ -j CT --zone 1 --A PREROUTING -i fwbr+ -j CT --zone 1 --A PREROUTING -i fwbr+ -j CT --zone 1 -COMMIT -# Completed on Sun Jul 26 18:26:48 2026 -# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026 -*nat -:PREROUTING ACCEPT [157187:35876890] -:INPUT ACCEPT [9697:1450815] -:OUTPUT ACCEPT [12692:835211] -:POSTROUTING ACCEPT [12719:836855] --A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820 --A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820 --A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080 --A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080 --A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443 --A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443 --A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080 --A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.250.2:8080 --A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443 --A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.250.2:8443 - -# -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53 -# -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.250.2:53 --A PREROUTING -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67 - --A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE --A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j SNAT --to-source 192.168.1.2 --A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE - -COMMIT -# Completed on Sun Jul 26 18:26:48 2026 +# Completed on Wed Sep 9 03:31:03 2026 ``` ### V6 ``` -# /etc/iptables/rules.v6 - *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] @@ -91,36 +77,32 @@ COMMIT COMMIT - *raw :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] --A PREROUTING -i fwbr+ -j CT --zone 1 - COMMIT - *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] --A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820 --A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820 +-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820 +-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820 --A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080 --A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080 +-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080 +-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080 --A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 --A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 +-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 +-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 --A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080 --A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080 +-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080 +-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080 --A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 --A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 +-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 +-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 -A POSTROUTING -s fd00:0:ffff::/64 -o wlp2s0 -j MASQUERADE