added homeassistant

inventory/host_vars/beDebianMain.yml

@@ -1,6 +1,19 @@
 _speedup_bitwarden_hetzner_record: "{{ bitwarden_records_urmel_services['Hetzner'] }}"
 _speedup_bitwarden_hetzner_fields: "{{ dict(_speedup_bitwarden_hetzner_record.fields|map(attribute='name')|zip(_speedup_bitwarden_hetzner_record.fields|map(attribute='value'))) }}"
 
+
+traefik_override:
+  main_domain: "be.urmel.de"
+  http_port: "8080"
+  https_port: "8443"
+
+  include_external_services:
+    homeassistant:
+      url: "{{ ansible_facts.default_ipv4.address }}"
+
+  hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
+  basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}"
+
 ddns_override:
   domains:
     - provider: "hetznercloud"
@@ -20,17 +33,21 @@ ddns_override:
       ip_version: "ipv6"
       token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
 
-traefik_override:
-  main_domain: "be.urmel.de"
-  http_port: "8080"
-  https_port: "8443"
-
-  hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
-  basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}"
-
 dns_override:
   api_key: "{{ bitwarden_records_urmel_services['Pihole'].login.password }}"
   domain: "pihole.arpa.be.urmel.de"
   local_domain: "be.urmel.de"
   domain_host: 192.168.1.2
   domain_host_v6: fd00:0000:1000::2
+
+homeassistant_override:
+  url: "home.be.urmel.de"
+  proxy_ip: 172.16.0.0/12
+  mqtt:
+    zigbee2mqtt:
+      zigbee_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0"
+      version: latest
+      domain: "mqtt.arpa.be.urmel.de"
+      auth_token: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'mqtt_auth_token') | first).value }}"
+  mariadb:
+    password: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'mariadb_password') | first).value }}"

playbooks/homeassistant.yml

@@ -0,0 +1,6 @@
+---
+- hosts: beDebianMain
+  pre_tasks:
+    - include_tasks: _lazy_lookup_workaround.yml
+  roles:
+    - homeassistant

roles/base_server/tasks/main.yml

@@ -16,6 +16,7 @@
   package:
     name:
       - vim
+      - curl
     state: latest
 
 - name: copy docker deamon.json

roles/homeassistant/README.md

@@ -0,0 +1,3 @@
+# homeassistant
+
+Note: Homeassistant sometimes expectes .yaml NOT .yml

roles/homeassistant/defaults/main.yml

@@ -0,0 +1,18 @@
+path: /srv/{{ role_name }}
+
+homeassistant_override: {}
+homeassistant_defaults:
+  url: ""
+  version: latest
+  proxy_ip: ""
+  mqtt:
+    zigbee2mqtt:
+      version: latest
+      domain: ""
+      auth_token: ""
+      zigbee_adapter_id: ""
+    mosquitto:
+      version: latest
+      allow_anonymous: true
+  mariadb:
+    password: ""

roles/homeassistant/handlers/main.yml

@@ -0,0 +1,8 @@
+- name: restart container
+  community.docker.docker_compose_v2:
+    project_src: "{{ path }}"
+    project_name: "{{ role_name }}"
+    recreate: "always"
+    services: ["homeassistant"]
+    state: "restarted"
+  when: not _homeassistant_already_restarted

roles/homeassistant/meta/main.yml

@@ -0,0 +1,20 @@
+---
+galaxy_info:
+  author: "Niklas Freese <niklas@urmel.de>"
+  description: homeassistant
+  company: "Urmel Services"
+  license: AGPL-3.0-or-later
+  min_ansible_version: 2.1
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies:
+ - role: traefik

roles/homeassistant/tasks/ensure_configuration.yml

@@ -0,0 +1,30 @@
+- name: Find Home Assistant configuration templates locally
+  ansible.builtin.set_fact:
+    ha_templates: "{{ query('ansible.builtin.fileglob', role_path + '/templates/homeassistant_configuration/*.yaml.j2') }}"
+
+- name: Template Home Assistant configuration files
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/srv/homeassistant/config/homeassistant/{{ item | basename | regex_replace('\\.j2$', '') }}"
+    mode: "0644"
+  loop: "{{ ha_templates }}"
+  loop_control:
+    label: "{{ item | basename }}"
+
+- name: Ensure Home Assistant configuration.yaml exists
+  ansible.builtin.file:
+    path: "/srv/homeassistant/config/homeassistant/configuration.yaml"
+    state: touch
+    mode: "0644"
+    modification_time: preserve
+    access_time: preserve
+
+- name: Add Home Assistant configuration includes
+  ansible.builtin.blockinfile:
+    path: "/srv/homeassistant/config/homeassistant/configuration.yaml"
+    marker: "# {mark} ANSIBLE MANAGED CONFIGURATION INCLUDES"
+    insertafter: EOF
+    block: |
+      {% for item in ha_templates | sort %}
+      {{ item | basename | regex_replace('\.yaml\.j2$', '') }}: !include {{ item | basename | regex_replace('\.j2$', '') }}
+      {% endfor %}

roles/homeassistant/tasks/main.yml

@@ -0,0 +1,64 @@
+---
+- name: "set local variables from overrides and defaults"
+  set_fact:
+    homeassistant: "{{ (homeassistant_defaults | combine(homeassistant_override, recursive=True)) if homeassistant_override else homeassistant_defaults }}"
+
+- name: ensure that path exists
+  file:
+    path: "{{ path }}/config/homeassistant"
+    state: directory
+
+- name: ensure that mosquitto config path exists
+  file:
+    path: "{{ path }}/config/mosquitto"
+    state: directory
+
+- name: ensure that mosquitto data path exists
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: "1883"
+    group: "1883"
+  loop:
+    - "{{ path }}/data/mosquitto"
+    - "{{ path }}/data/mosquitto/log"
+
+- name: ensure that zigbee2mqtt data path exists
+  file:
+    path: "{{ path }}/data/zigbee2mqtt"
+    state: directory
+
+- name: template docker-compose
+  template:
+    src: compose.yml.j2
+    dest: "{{ path }}/compose.yml"
+
+- name: template .env
+  template:
+    src: .env.j2
+    dest: "{{ path }}/.env"
+
+- name: template mosquitto config
+  template:
+    src: mosquitto.conf.j2
+    dest: "{{ path }}/config/mosquitto/mosquitto.conf"
+    mode: "0644"
+
+- name: template zigbee2mqtt config
+  template:
+    src: zigbee2mqtt/configuration.yaml.j2
+    dest: "{{ path }}/data/zigbee2mqtt/configuration.yaml"
+    mode: "0644"
+
+- name: Do configuration
+  include_tasks: ensure_configuration.yml
+
+- name: ensure container is running
+  community.docker.docker_compose_v2:
+    project_src: "{{ path }}"
+    project_name: "{{ role_name }}"
+    state: "present"
+    pull: "always"
+    wait: true
+    services: ["mariadb", "mosquitto", "homeassistant", "zigbee2mqtt"]
+  register: _compose_result

roles/homeassistant/templates/.env.j2

@@ -0,0 +1 @@
+SUBNET=172.31.254

roles/homeassistant/templates/compose.yml.j2

@@ -0,0 +1,100 @@
+version: '3'
+
+services:
+  homeassistant:
+    image: homeassistant/home-assistant:{{ homeassistant.version }}
+    volumes:
+        # We do not yes manage configs with ansible
+      - ./config/homeassistant:/config
+      - /etc/localtime:/etc/localtime:ro
+    restart: unless-stopped
+    environment:
+      TZ: Europe/Berlin
+    network_mode: "host"
+#    networks:
+#      local_network:
+#        ipv4_address: ${SUBNET}.2
+    depends_on:
+      - zigbee2mqtt
+      - mariadb
+      - mosquitto
+    extra_hosts:
+      - "zwave:${SUBNET}.3"
+      - "zigbee2mqtt:${SUBNET}.6"
+      - "mariadb:${SUBNET}.4"
+      - "mosquitto:${SUBNET}.5"
+#    ports:
+#      - 8123:8123
+#      - 1400:1400
+#      - 1401:1401
+
+{% if homeassistant.mqtt.zigbee2mqtt.zigbee_adapter_id %}
+  zigbee2mqtt:
+    # 8080
+    image: ghcr.io/koenkk/zigbee2mqtt:{{ homeassistant.mqtt.zigbee2mqtt.version }}
+    restart: unless-stopped
+    volumes:
+        - ./data/zigbee2mqtt:/app/data
+        - /run/udev:/run/udev:ro
+    environment:
+        - TZ=Europe/Berlin
+    networks:
+      local_network:
+        ipv4_address: ${SUBNET}.6
+      exposed:
+    devices:
+        # Make sure this matched your adapter location
+        - /dev/serial/by-id/{{ homeassistant.mqtt.zigbee2mqtt.zigbee_adapter_id }}:/dev/ttyUSB0
+    labels:
+      traefik.enable: true
+
+      traefik.http.routers.homeassistant-mqtt.entrypoints: https
+      traefik.http.routers.homeassistant-mqtt.rule: Host(`{{ homeassistant.mqtt.zigbee2mqtt.domain }}`)
+      traefik.http.services.homeassistant-mqtt.loadbalancer.server.port: 8080
+      traefik.http.routers.homeassistant-mqtt.tls: "true"
+      traefik.http.routers.homeassistant-mqtt.tls.certresolver: hetzner
+      traefik.http.routers.homeassistant-mqtt.middlewares: local-only@file
+{% endif %}
+
+  mosquitto:
+    image: eclipse-mosquitto:{{ homeassistant.mqtt.mosquitto.version }}
+    restart: unless-stopped
+    user: "1883:1883"
+    volumes:
+      - ./config/mosquitto:/mosquitto/config:ro
+      - ./data/mosquitto:/mosquitto/data
+      - ./data/mosquitto/log:/mosquitto/log
+    environment:
+      - TZ=Europe/Berlin
+    networks:
+      local_network:
+        ipv4_address: ${SUBNET}.5
+
+  mariadb:
+    image: mariadb:10.11.2
+    volumes:
+      - ./data/mariadb:/var/lib/mysql
+      - ./config/mariadb:/etc/mysql/conf.d
+      - /etc/localtime:/etc/localtime:ro
+
+    restart: unless-stopped
+    environment:
+      MARIADB_ROOT_PASSWORD: {{ homeassistant.mariadb.password }}
+      MARIADB_MYSQL_LOCALHOST_USER: "yes"
+      MARIADB_MYSQL_LOCALHOST_GRANTS: "yes"
+      MARIADB_AUTO_UPGRADE: "yes"
+      MARIADB_DISABLE_UPGRADE_BACKUP: "yes"
+      TZ: Europe/Berlin
+    networks:
+      local_network:
+        ipv4_address: ${SUBNET}.4
+
+networks:
+    local_network:
+      ipam:
+        driver: default
+        config:
+          - subnet: ${SUBNET}.0/24
+    exposed:
+            name: traefik_exposed
+            external: true

roles/homeassistant/templates/homeassistant_configuration/http.yaml.j2

@@ -0,0 +1,5 @@
+use_x_forwarded_for: true
+trusted_proxies:
+- {{ homeassistant.proxy_ip }}
+
+# DOSE NOT WORK, MUST BE SET MANUALY AT FIRST BOOT

roles/homeassistant/templates/mosquitto.conf.j2

@@ -0,0 +1,9 @@
+# Ansible managed
+persistence true
+persistence_location /mosquitto/data/
+log_dest file /mosquitto/log/mosquitto.log
+
+listener 1883
+protocol mqtt
+
+allow_anonymous {{ 'true' if homeassistant.mqtt.mosquitto.allow_anonymous else 'false' }}

roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2

@@ -0,0 +1,13 @@
+# Ansible managed
+homeassistant: true
+mqtt:
+  base_topic: zigbee2mqtt
+  server: 'mqtt://mosquitto:1883'
+serial:
+  port: /dev/ttyUSB0
+advanced:
+  log_level: info
+frontend:
+    enabled: true
+    auth_token: {{ homeassistant.mqtt.zigbee2mqtt.auth_token }}
+version: 5

shelf/be.urmel.md

@@ -1,11 +1,41 @@
 # Proxmox WLAN IP-Tables
 ### V4
 ```
-# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
+# Generated by iptables-save v1.8.11 on Wed Sep  9 03:31:03 2026
+*nat
+:PREROUTING ACCEPT [607:102422]
+:INPUT ACCEPT [226:15893]
+:OUTPUT ACCEPT [237:16252]
+:POSTROUTING ACCEPT [2202:155522]
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
+-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
+-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING ! -s 192.168.250.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
+-A PREROUTING ! -s 192.168.250.0/24 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
+-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
+COMMIT
+# Completed on Wed Sep  9 03:31:03 2026
+# Generated by iptables-save v1.8.11 on Wed Sep  9 03:31:03 2026
+*raw
+:PREROUTING ACCEPT [91865:11405819]
+:OUTPUT ACCEPT [10786:3643869]
+-A PREROUTING -i fwbr+ -j CT --zone 1
+-A PREROUTING -i fwbr+ -j CT --zone 100
+COMMIT
+# Completed on Wed Sep  9 03:31:03 2026
+# Generated by iptables-save v1.8.11 on Wed Sep  9 03:31:03 2026
 *filter
-:INPUT ACCEPT [479923:96015305]
+:INPUT ACCEPT [12340:2837091]
-:FORWARD ACCEPT [309996:354561575]
+:FORWARD ACCEPT [34550:5062071]
-:OUTPUT ACCEPT [475252:104246097]
+:OUTPUT ACCEPT [10728:3637989]
 -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 51820 -j ACCEPT
 -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 51820 -j ACCEPT
 -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 80 -j ACCEPT
@@ -16,59 +46,15 @@
 -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8080 -j ACCEPT
 -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8443 -j ACCEPT
 -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8443 -j ACCEPT
-# -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT
-# -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT
 -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 67 -j ACCEPT
-
 COMMIT
-# Completed on Sun Jul 26 18:26:48 2026
+# Completed on Wed Sep  9 03:31:03 2026
-# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
-*raw
-:PREROUTING ACCEPT [936759:484955391]
-:OUTPUT ACCEPT [475255:104246408]
--A PREROUTING -i fwbr+ -j CT --zone 1
--A PREROUTING -i fwbr+ -j CT --zone 100
--A PREROUTING -i fwbr+ -j CT --zone 1
--A PREROUTING -i fwbr+ -j CT --zone 100
--A PREROUTING -i fwbr+ -j CT --zone 100
--A PREROUTING -i fwbr+ -j CT --zone 1
--A PREROUTING -i fwbr+ -j CT --zone 1
--A PREROUTING -i fwbr+ -j CT --zone 1
-COMMIT
-# Completed on Sun Jul 26 18:26:48 2026
-# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
-*nat
-:PREROUTING ACCEPT [157187:35876890]
-:INPUT ACCEPT [9697:1450815]
-:OUTPUT ACCEPT [12692:835211]
-:POSTROUTING ACCEPT [12719:836855]
--A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
--A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
--A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
--A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
--A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
--A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
--A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
--A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
--A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
--A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
-
-# -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
-# -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.250.2:53
--A PREROUTING -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67
-
--A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
--A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j SNAT --to-source 192.168.1.2
--A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
-
-COMMIT
-# Completed on Sun Jul 26 18:26:48 2026
 ```
 
 ### V6
 ```
-# /etc/iptables/rules.v6
-
 *filter
 :INPUT ACCEPT [0:0]
 :FORWARD ACCEPT [0:0]
@@ -91,36 +77,32 @@ COMMIT
 
 COMMIT
 
-
 *raw
 :PREROUTING ACCEPT [0:0]
 :OUTPUT ACCEPT [0:0]
 
--A PREROUTING -i fwbr+ -j CT --zone 1
-
 COMMIT
 
-
 *nat
 :PREROUTING ACCEPT [0:0]
 :INPUT ACCEPT [0:0]
 :OUTPUT ACCEPT [0:0]
 :POSTROUTING ACCEPT [0:0]
 
--A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
+-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
--A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
+-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
 
--A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
--A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
 
--A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
--A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
 
--A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
--A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
 
--A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+-A PREROUTING ! -s fd00:0:ffff::/64 -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
--A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+-A PREROUTING ! -s fd00:0:ffff::/64 -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
 
 -A POSTROUTING -s fd00:0:ffff::/64 -o wlp2s0 -j MASQUERADE