jeka/ansible-openwrt-hirkn
1
0
Fork 0
mirror of https://github.com/itdoginfo/ansible-openwrt-hirkn.git synced 2025-12-23 23:53:40 +05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8 from itdoginfo/role

Browse Source 
Role added
This commit is contained in:
itdoginfo
2024-04-17 12:26:17 +03:00
committed by GitHub
parent 8ca4fb08d6 651cd86519
commit 1435819b34
12 changed files with 964 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
.github/workflows/public-galaxy.yml vendored Normal file
View File

@@ -0,0 +1,21 @@
name: Public to Ansible Galaxy
on:
push:
branches: [ "role" ]
paths:
- .github/**
- domain-routing-openwrt/**
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- name: galaxy
uses: robertdebock/galaxy-action@1.2.0
with:
galaxy_api_key: ${{ secrets.galaxy_api_key }}
path: domain-routing-openwrt
git_branch: role

104
domain-routing-openwrt/README.md Normal file
View File

@@ -0,0 +1,104 @@
Domain routing OpenWrt
=========
Configuring domain routing on Openwrt router.
Role Variables
--------------
Lists
```
country: russia-inside|russia-outside|ukraine
list_domains: true|falase
list_subnet: false|true
list_ip: false|true
list_community: false|true
```
Tunnel
```
tunnel: wg|openvpn|singbox|tun2socks
```
DoH or DoT
```
dns_encrypt: false|dnscrypt|stubby
```
Nano package
```
nano: true|false
```
Acces from wg network to router
```
wg_access: false|true
```
If wireguard is used:
```
wg_server_address: wg-server-host
wg_private_key: privatekey-client
wg_public_key: publickey-client
#wg_preshared_key: presharedkey-client
wg_client_port: 51820
wg_client_address: ip-client
wg_access_network: wg-network
```
Dependencies
------------
[gekmihesg.openwrt](https://github.com/gekmihesg/ansible-openwrt)
Example Playbook
----------------
The inventory file must contain the group `[openwrt]` where your router will be located.
Wireguard, only domains, stubby, Russia, acces from wg network, host 192.168.1.1
```
- hosts: 192.168.1.1
remote_user: root
roles:
- domain-routing-openwrt
vars:
tunnel: wg
dns_encrypt: stubby
country: russia-inside
wg_access: true
wg_server_address: wg-server-host
wg_private_key: privatekey-client
wg_public_key: publickey-client
wg_preshared_key: presharedkey-client
wg_listen_port: 51820
wg_client_port: 51820
wg_client_address: ip-client
wg_access_network: wg-network
```
Sing-box, stubby, Russia
```
- hosts: 192.168.1.1
remote_user: root
roles:
- domain-routing-openwrt
vars:
tunnel: singbox
dns_encrypt: stubby
country: russia-inside
```
License
-------
GNU General Public License v3.0

12
domain-routing-openwrt/defaults/main.yml Normal file
View File

@@ -0,0 +1,12 @@
---
list_domains: true
list_subnet: false
list_ip: false
list_community: false
tunnel: wg
dns_encrypt: false
country: russia-inside
nano: true
wg_access: false
wg_listen_port: 51820

26
domain-routing-openwrt/handlers/main.yml Normal file
View File

@@ -0,0 +1,26 @@
---
- name: Restart network
service:
name: network
state: restarted
- name: Restart firewall
service:
name: firewall
state: restarted
- name: Run getdomains script
service:
name: getdomains
state: restarted
- name: Restart dnscrypt-proxy
service:
name: dnscrypt-proxy
state: restarted
enabled: yes
- name: Restart dnsmasq
service:
name: dnsmasq
state: restarted

19
domain-routing-openwrt/meta/main.yml Normal file
View File

@@ -0,0 +1,19 @@
galaxy_info:
author: itdog
description: Configuring domain routing on Openwrt router
issue_tracker_url: https://github.com/itdoginfo/domain-routing-openwrt/issues
license: GPL-3.0
min_ansible_version: 2.10.8
platforms:
- name: OpenWrt
galaxy_tags:
- openwrt
- dnsmasq
- ipset
- wireguard
- sing-box
- openvpn
- bypass
- routing
dependencies:
- role: gekmihesg.openwrt

663
domain-routing-openwrt/tasks/main.yml Normal file
View File

@@ -0,0 +1,663 @@
---
# Dnsmasq version check
- name: Get dnsmasq version
shell: opkg list-installed | grep dnsmasq-full | awk '{print $3}'
register: dnsmasqfull_version
- name: debug
debug:
var: ansible_distribution_major_version
# Packages installation
- name: install wg
opkg:
name: "{{ item }}"
state: present
loop:
- kmod-wireguard
- wireguard-tools
when: tunnel == "wg"
- name: install openvpn
opkg:
name: "{{ item }}"
state: present
loop:
- openvpn-openssl
when: tunnel == "openvpn"
- name: install singbox
opkg:
name: "{{ item }}"
state: present
loop:
- sing-box
when: tunnel == "singbox" and ansible_distribution_major_version >= "23"
- name: install curl
opkg:
name: "{{ item }}"
state: present
loop:
- curl
- name: install nano
opkg:
name: "{{ item }}"
state: present
loop:
- nano
when: nano
- name: install ipset
opkg:
name: ipset
state: present
when: ansible_distribution_major_version < "22"
- name: install dnsmasq-full (23)
shell: opkg update && cd /tmp/ && opkg download dnsmasq-full && opkg remove dnsmasq && opkg install dnsmasq-full --cache /tmp/ && [ -f /etc/config/dhcp-opkg ] && cp etc/config/dhcp /etc/config/dhcp-old && mv /etc/config/dhcp-opkg /etc/config/dhcp
when: ansible_distribution_major_version >= "23" and list_domains and not dnsmasqfull_version.stdout
ignore_errors: true
# Getdomains script configure
- name: getdomains script copy
template:
src: "openwrt-getdomains.j2"
dest: "/etc/init.d/getdomains"
mode: a+x
trim_blocks: false
notify:
- Run getdomains script
- name: create simplink in rc.d
file:
src: "/etc/init.d/getdomains"
dest: "/etc/rc.d/S99getdomains"
state: link
notify:
- Run getdomains script
- name: check string in crontab
shell: grep "getdomains" /etc/crontabs/root
register: check_cron
ignore_errors: true
- name: add script to cron
lineinfile:
path: /etc/crontabs/root
create: yes
line: "0 4 * * * /etc/init.d/getdomains start"
when: check_cron.stdout == ""
- name: enable and start crontab
service:
name: cron
state: started
enabled: yes
# Configure route table
- name: Route for vpn table
template:
src: "openwrt-30-vpnroute.j2"
dest: "/etc/hotplug.d/iface/30-vpnroute"
mode: 0644
- name: Check string in rt_tables
shell: grep "99 vpn" /etc/iproute2/rt_tables
register: check_rt_tables
ignore_errors: true
- name: add route table
lineinfile:
path: /etc/iproute2/rt_tables
line: "99 vpn"
when: check_rt_tables.stdout == ""
notify:
- Restart network
# Configure WG
- name: add wg interface
uci:
command: add
config: network
type: interface
name: wg0
when: tunnel == "wg"
- name: configure wg interface
uci:
command: set
key: network.wg0
value:
proto: wireguard
private_key: "{{ wg_private_key }}"
listen_port: "{{ wg_listen_port }}"
addresses:
- "{{ wg_client_address }}"
when: tunnel == "wg"
notify:
- Restart network
- name: set wg client without wg_preshared_key
uci:
command: section
config: network
type: wireguard_wg0
find_by:
name: wg0_client
value:
public_key: "{{ wg_public_key }}"
route_allowed_ips: 0
persistent_keepalive: 25
endpoint_host: "{{ wg_server_address }}"
allowed_ips: 0.0.0.0/0
endpoint_port: "{{ wg_client_port }}"
when: wg_preshared_key is undefined and tunnel == "wg"
notify:
- Restart network
- name: set wg client with wg_preshared_key
uci:
command: section
config: network
type: wireguard_wg0
find_by:
name: wg0_client
value:
public_key: "{{ wg_public_key }}"
preshared_key: "{{ wg_preshared_key }}"
route_allowed_ips: 0
persistent_keepalive: 25
endpoint_host: "{{ wg_server_address }}"
allowed_ips: 0.0.0.0/0
endpoint_port: "{{ wg_client_port }}"
when: wg_preshared_key is defined and tunnel == "wg"
- name: set WG firewall zone
uci:
command: section
config: firewall
type: zone
find_by:
name: wg
value:
forward: REJECT
output: ACCEPT
name: wg
input: REJECT
masq: 1
mtu_fix: 1
network: wg0
family: ipv4
when: tunnel == "wg"
- name: add WG forwarding
uci:
command: section
config: firewall
type: forwarding
find_by:
name: wg-lan
value:
dest: wg
src: lan
family: ipv4
when: tunnel == "wg"
# Configure Sing-box
- name: set sing-box firewall zone. Only >=22
uci:
command: section
config: firewall
type: zone
find_by:
name: tun
value:
forward: ACCEPT
output: ACCEPT
name: tun
input: ACCEPT
masq: 1
mtu_fix: 1
device: tun0
family: ipv4
when: tunnel == "singbox"
failed_when: ansible_distribution_major_version < "22"
notify:
- Restart firewall
- name: template for sing-box.json
template:
src: "sing-box-json.j2"
dest: "/etc/sing-box/config.json"
mode: 0644
when: tunnel == "singbox"
failed_when: ansible_distribution_major_version < "22"
- name: template for config/sing-box
template:
src: "config-sing-box.j2"
dest: "/etc/config/sing-box"
mode: 0600
when: tunnel == "singbox"
failed_when: ansible_distribution_major_version < "22"
# Configure OpenVPN, tun2socks
- name: set {{ tunnel }} firewall zone
uci:
command: section
config: firewall
type: zone
find_by:
name: tun
value:
forward: REJECT
output: ACCEPT
name: tun
input: REJECT
masq: 1
mtu_fix: 1
device: tun0
family: ipv4
when: tunnel == "openvpn" or tunnel == "tun2socks"
notify:
- Restart firewall
- name: add {{ tunnel }} forwarding
uci:
command: section
config: firewall
type: forwarding
find_by:
name: lan-tun
value:
dest: tun
src: lan
family: ipv4
when: tunnel == "openvpn" or tunnel == "tun2socks" or tunnel == "singbox"
notify:
- Restart firewall
# Configure network
- name: set rule mark0x1
uci:
command: section
config: network
type: rule
find_by:
name: mark0x1
value:
mark: "0x1"
priority: 100
lookup: vpn
- name: set disable dns for wan
uci:
command: set
key: network.wan
value:
peerdns: 0
when: ansible_distribution_major_version < "22"
- name: uci commit firewall
uci:
command: commit
config: firewall
notify:
- Restart firewall
- name: uci commit network
uci:
command: commit
config: network
notify:
- Restart network
# Configure firewall
- name: add ipset for subnet (<22)
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_subnets
value:
match: dst_net
storage: hash
loadfile: /tmp/lst/subnet.lst
when: ansible_distribution_major_version < "22" and list_subnet
- name: add ipset for ip (<22)
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_ip
value:
match: dst_net
storage: hash
loadfile: /tmp/lst/ip.lst
hashsize: 9900000
maxelem: 9900000
when: ansible_distribution_major_version < "22" and list_ip
- name: add ipset for community (<22)
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_community
value:
match: dst_net
storage: hash
loadfile: /tmp/lst/community.lst
hashsize: 9900000
maxelem: 9900000
when: ansible_distribution_major_version < "22" and list_community
- name: add nfset for subnet (22)
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_subnets
value:
match: dst_net
loadfile: /tmp/lst/subnet.lst
when: ansible_distribution_major_version >= "22" and list_subnet
- name: add nfset for ip (22)
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_ip
value:
match: dst_net
loadfile: /tmp/lst/ip.lst
when: ansible_distribution_major_version >= "22" and list_ip
- name: add nfset for community (22)
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_community
value:
match: dst_net
loadfile: /tmp/lst/community.lst
when: ansible_distribution_major_version >= "22" and list_community
- name: add ipset for domains (<22). If failed, repeat playbook. If failed is repeated check dnsmasq-full.
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_domains
value:
match: dst_net
storage: hash
when: ansible_distribution_major_version < "22" and list_domains
- name: add nfset for domains (>=22). If failed, repeat playbook. If failed is repeated check dnsmasq-full.
uci:
command: section
config: firewall
type: ipset
find_by:
name: vpn_domains
value:
match: dst_net
when: ansible_distribution_major_version >= "22" and list_domains
- name: add mark rule vpn_subnet
uci:
command: section
config: firewall
type: rule
find_by:
name: mark_subnet
value:
src: lan
dest: "*"
proto: all
ipset: vpn_subnets
set_mark: "0x1"
target: MARK
family: ipv4
when: list_subnet
- name: add mark rule vpn_ip
uci:
command: section
config: firewall
type: rule
find_by:
name: mark_ip
value:
src: lan
dest: "*"
proto: all
ipset: vpn_ip
set_mark: "0x1"
target: MARK
family: ipv4
when: list_ip
- name: add mark rule vpn_community
uci:
command: section
config: firewall
type: rule
find_by:
name: mark_community
value:
src: lan
dest: "*"
proto: all
ipset: vpn_community
set_mark: "0x1"
target: MARK
family: ipv4
when: list_community
- name: add mark rule vpn_domains
uci:
command: section
config: firewall
type: rule
find_by:
name: mark_domains
value:
src: lan
dest: "*"
proto: all
ipset: vpn_domains
set_mark: "0x1"
target: MARK
family: ipv4
when: (ansible_distribution_major_version < "22" and list_domains) or (ansible_distribution_major_version >= "22" and list_domains)
- name: wg access route
uci:
command: section
config: network
type: route
find_by:
name: wg_access_route
value:
interface: wg0
target: "{{ wg_access_network }}"
when: wg_access
- name: set WG firewall zone
uci:
command: section
config: firewall
type: zone
find_by:
name: wg
value:
input: ACCEPT
when: wg_access
# Remove unused rules and ipset
- name: Remove ipset for ip
uci:
command: absent
config: firewall
type: ipset
find_by:
name: vpn_ip
when: not list_ip
- name: Remove rule for ip
uci:
command: absent
config: firewall
type: rule
find_by:
name: mark_ip
when: not list_ip
- name: Remove ipset for subnet
uci:
command: absent
config: firewall
type: ipset
find_by:
name: vpn_subnets
when: not list_subnet
- name: Remove rule for subnet
uci:
command: absent
config: firewall
type: rule
find_by:
name: mark_subnet
when: not list_subnet
- name: Remove ipset for community
uci:
command: absent
config: firewall
type: ipset
find_by:
name: vpn_community
when: not list_community
- name: Remove rule for community
uci:
command: absent
config: firewall
type: rule
find_by:
name: mark_community
when: not list_community
- name: Remove ipset for domains
uci:
command: absent
config: firewall
type: ipset
find_by:
name: vpn_domains
when: not list_domains
- name: Remove rule for domains
uci:
command: absent
config: firewall
type: rule
find_by:
name: mark_domains
when: not list_domains
# Configure DNS resolver
- name: install dnscrypt-proxy2
opkg:
name: dnscrypt-proxy2
state: present
when: dns_encrypt == "dnscrypt"
- name: check string in dnscrypt-proxy.toml
shell: grep "# server_names" /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
register: check_server_names
ignore_errors: true
when: dns_encrypt == "dnscrypt"
- name: dnscrypt2 enable exact servers
lineinfile:
path: /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
regexp: "# server_names ="
line: "server_names = ['google', 'cloudflare', 'scaleway-fr', 'yandex']"
when: dns_encrypt == "dnscrypt" and check_server_names.stdout
notify:
- Restart dnscrypt-proxy
- name: edit dhcp config. add localhost server
lineinfile:
path: /etc/config/dhcp
firstmatch: "true"
insertafter: "option leasefile '/tmp/dhcp.leases'"
line: "{{ item }}"
with_items:
- " list server '127.0.0.53#53'"
- " option noresolv '1'"
notify:
- Restart dnsmasq
when: dns_encrypt == "dnscrypt"
- name: install stubby
opkg:
name: stubby
state: present
when: dns_encrypt == "stubby"
- name: edit dhcp config. add localhost server
lineinfile:
path: /etc/config/dhcp
firstmatch: "true"
insertafter: "option leasefile '/tmp/dhcp.leases'"
line: "{{ item }}"
with_items:
- " list server '127.0.0.1#5453'"
- " option noresolv '1'"
notify:
- Restart dnsmasq
when: dns_encrypt == "stubby"
# Commit
- name: uci commit firewall
uci:
command: commit
config: firewall
notify:
- Restart firewall
- name: uci commit network
uci:
command: commit
config: network
notify:
- Restart network

5
domain-routing-openwrt/templates/config-sing-box.j2 Normal file
View File

@@ -0,0 +1,5 @@
config sing-box 'main'
option enabled '1'
option user 'root'
option conffile '/etc/sing-box/config.json'
option workdir '/usr/share/sing-box'

8
domain-routing-openwrt/templates/openwrt-30-vpnroute.j2 Normal file
View File

@@ -0,0 +1,8 @@
#!/bin/sh
{% if tunnel == "wg" %}
ip route add table vpn default dev wg0
{% elif (tunnel == "openvpn") or (tunnel == "singbox") or (tunnel == "tun2socks") %}
sleep 10
ip route add table vpn default dev tun0
{% endif %}

70
domain-routing-openwrt/templates/openwrt-getdomains.j2 Normal file
View File

@@ -0,0 +1,70 @@
#!/bin/sh /etc/rc.common
START=99
start () {
{% if ansible_distribution_major_version >= "22" and country == "russia-inside" %}
DOMAINS=https://raw.githubusercontent.com/itdoginfo/allow-domains/main/Russia/inside-dnsmasq-nfset.lst
{% endif %}
{% if ansible_distribution_major_version >= "22" and country == "russia-outside" %}
DOMAINS=https://raw.githubusercontent.com/itdoginfo/allow-domains/main/Russia/outside-dnsmasq-nfset.lst
{% endif %}
{% if ansible_distribution_major_version >= "22" and country == "ukraine" %}
DOMAINS=https://raw.githubusercontent.com/itdoginfo/allow-domains/main/Ukraine/inside-dnsmasq-nfset.lst
{% endif %}
{% if ansible_distribution_major_version < "22" and country == "russia-inside" %}
DOMAINS=https://raw.githubusercontent.com/itdoginfo/allow-domains/main/Russia/inside-dnsmasq-ipset.lst
{% endif %}
{% if ansible_distribution_major_version < "22" and country == "russia-outside" %}
DOMAINS=https://raw.githubusercontent.com/itdoginfo/allow-domains/main/Russia/outside-dnsmasq-ipset.lst
{% endif %}
{% if ansible_distribution_major_version < "22" and country == "ukraine" %}
DOMAINS=https://raw.githubusercontent.com/itdoginfo/allow-domains/main/Ukraine/inside-dnsmasq-ipset.lst
{% endif %}
count=0
while true; do
if curl -m 3 github.com; then
curl -f $DOMAINS --output /tmp/dnsmasq.d/domains.lst
break
else
echo "GitHub is not available. Check the internet availability [$count]"
count=$((count+1))
fi
done
if dnsmasq --conf-file=/tmp/dnsmasq.d/domains.lst --test 2>&1 | grep -q "syntax check OK"; then
/etc/init.d/dnsmasq restart
fi
{% if ansible_distribution_major_version >= "22" and (list_ip or list_community) %}
echo "Flush sets"
nft flush ruleset
{% endif %}
{% if list_subnet or list_ip or list_community %}
dir=/tmp/lst
mkdir -p $dir
count=0
while true; do
if curl -m 3 https://antifilter.download/; then
{% if list_subnet %}
curl -f -z $dir/subnet.lst https://antifilter.download/list/subnet.lst --output $dir/subnet.lst
{% endif %}
{% if list_ip %}
curl -f -z $dir/ip.lst https://antifilter.download/list/ip.lst --output $dir/ip.lst
{% endif %}
{% if list_community %}
curl -f -z $dir/community.lst https://community.antifilter.download/list/community.lst --output $dir/community.lst
{% endif %}
break
else
echo "antifilter.download is not available. Check the internet availability [$count]"
count=$((count+1))
fi
done
echo "Firewall restart"
/etc/init.d/firewall restart
{% endif %}
}

28
domain-routing-openwrt/templates/sing-box-json.j2 Normal file
View File

@@ -0,0 +1,28 @@
{
"log": {
"level": "debug"
},
"inbounds": [
{
"type": "tun",
"interface_name": "tun0",
"domain_strategy": "ipv4_only",
"inet4_address": "172.16.250.1/30",
"auto_route": false,
"strict_route": false,
"sniff": true
}
],
"outbounds": [
{
"type": "$TYPE",
"server": "$HOST",
"server_port": $PORT,
"method": "$METHOD",
"password": "$PASS"
}
],
"route": {
"auto_detect_interface": true
}
}

2
domain-routing-openwrt/tests/inventory Normal file
View File

@@ -0,0 +1,2 @@
[openwrt]
192.168.56.23

6
domain-routing-openwrt/tests/test.yml Normal file
View File

@@ -0,0 +1,6 @@
---
- hosts: openwrt
remote_user: root
roles:
- domain-routing-openwrt