Added wg_access and fixed dnsmasq check issue

README.md

@@ -28,7 +28,7 @@ wget https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/ge
 
 - OpenWrt 21.02.7
 - OpenWrt 22.03.5
-- OpenWrt 23.05.0
+- OpenWrt 23.05.2
 
 ### Выбор туннеля
 - Wireguard настраивается автоматически через переменные
@@ -56,6 +56,8 @@ wget https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/ge
 
 Остальное можно менять, в зависимости от того, как настроен wireguard сервер
 
+**wg_access** и **wg_access_network** для доступа к роутеру через WG
+
 ### Шифрование DNS
 Если ваш провайдер не подменяет DNS-запросы, ничего устанавливать не нужно.
 
@@ -70,6 +72,8 @@ wget https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/ge
 - russia-outside
 - ukraine
 
+### 
+
 ### Списки IP-адресов и домены
 Переменные **list_** обозначают, какие списки нужно установить. true - установить, false - не устанавливать и удалить, если уже есть
 

getdomains-install.sh

@@ -18,7 +18,7 @@ EOF
 cat << EOF > /etc/hotplug.d/iface/30-rknroute
 #!/bin/sh
 
-sleep 5
+sleep 10
 ip route add table vpn default dev tun0
 EOF
     fi
@@ -107,9 +107,9 @@ add_tunnel() {
 
         read -r -p "Enter the public key (from [Peer]):"$'\n' WG_PUBLIC_KEY
         read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' WG_PRESHARED_KEY
-        read -r -p "Enter Enpoint host without port (Domain or IP) (from [Peer]):"$'\n' WG_ENDPOINT
+        read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' WG_ENDPOINT
 
-        read -r -p "Enter Enpoint host port (from [Peer]) [51820]:"$'\n' WG_ENDPOINT_PORT
+        read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' WG_ENDPOINT_PORT
         WG_ENDPOINT_PORT=${WG_ENDPOINT_PORT:-51820}
         if [ "$WG_ENDPOINT_PORT" = '51820' ]; then
             echo $WG_ENDPOINT_PORT

playbooks/hirkn.yml

@@ -16,6 +16,7 @@
     tunnel: wg
     dns_encrypt: false
     country: russia-inside
+    nano: true
 
     wg_server_address: wg-server-host
     wg_private_key: privatekey-client
@@ -24,6 +25,8 @@
     wg_listen_port: 51820
     wg_client_port: 51820
     wg_client_address: ip-client
+    wg_access: false
+    wg_access_network: wg-network (for example: 192.168.10.0/24)
 
   tasks:
 # Dnsmasq version check
@@ -63,13 +66,20 @@
         - sing-box
     when: tunnel == "singbox" and ansible_distribution_major_version >= "23"
 
-  - name: install curl and nano
+  - name: install curl
     opkg:
       name: "{{ item }}"
       state: present
     loop:
         - curl
+
+  - name: install nano
+    opkg:
+      name: "{{ item }}"
+      state: present
+    loop:
         - nano
+    when: nano
 
   - name: install ipset
     opkg:
@@ -121,56 +131,6 @@
       
 # Configure route table
 
-  # - name: Create vpn0 interface
-  #   uci:
-  #     command: section
-  #     config: network
-  #     type: interface
-  #     find_by:
-  #       name: vpn0
-  #     name: vpn0
-  #     value:
-  #       name: vpn0
-  #       proto: none
-  #       auto: 1
-  #       device: tun0
-  #   when: tunnel == "openvpn" or tunnel == "singbox" or tunnel == "tun2socks"
-  #   notify:
-  #     - Restart network
-
-  # - name: tunnel routing. tun0
-  #   uci:
-  #     command: section
-  #     config: network
-  #     type: route
-  #     find_by:
-  #       name: vpn_route
-  #     name: vpn_route
-  #     value:
-  #       name: vpn_route
-  #       interface: vpn0
-  #       table: vpn
-  #       target: 0.0.0.0/0
-  #   when: tunnel == "openvpn" or tunnel == "singbox" or tunnel == "tun2socks"
-  #   notify:
-  #     - Restart network
-
-  # - name: tunnel routing. wg0
-  #   uci:
-  #     command: section
-  #     config: network
-  #     type: route
-  #     find_by:
-  #       name: vpn
-  #     name: vpn_route
-  #     value:
-  #       interface: wg0
-  #       table: vpn
-  #       target: 0.0.0.0/0
-  #   when: tunnel == "wg"
-  #   notify:
-  #     - Restart network
-
   - name: Route for vpn table
     template:
       src: "{{ ansible_template_dir }}openwrt-30-rknroute.j2"
@@ -483,7 +443,6 @@
        value:
          match: dst_net
          storage: hash
-    failed_when: ansible_distribution_major_version < "22" and list_domains and not dnsmasqfull_version.stdout
     when: ansible_distribution_major_version < "22" and list_domains
 
   - name: add nfset for domains (>=22). If failed, repeat playbook. If failed is repeated check dnsmasq-full.
@@ -495,7 +454,6 @@
          name: vpn_domains
        value:
          match: dst_net
-    failed_when: ansible_distribution_major_version >= "22" and list_domains and (not dnsmasqfull_version.stdout or dnsmasqfull_version.stdout < "2.87")
     when: ansible_distribution_major_version >= "22" and list_domains
 
   - name: add mark rule vpn_subnet
@@ -564,7 +522,30 @@
          set_mark: "0x1"
          target: MARK
          family: ipv4
-    when: (ansible_distribution_major_version < "22" and list_domains and dnsmasqfull_version.stdout) or (ansible_distribution_major_version >= "22" and list_domains and dnsmasqfull_version.stdout >= "2.87")
+    when: (ansible_distribution_major_version < "22" and list_domains) or (ansible_distribution_major_version >= "22" and list_domains)
+
+  - name: wg access route
+    uci:
+      command: section
+      config: network
+      type: route
+      find_by:
+        name: wg_access_route
+      value:
+        interface: wg0
+        target: "{{ wg_access_network }}"
+    when: wg_access
+
+  - name: set WG firewall zone 
+    uci:
+      command: section
+      config: firewall
+      type: zone
+      find_by:
+        name: wg
+      value:
+        input: ACCEPT
+    when: wg_access
 
 # Remove unused rules and ipset
   - name: Remove ipset for ip

templates/openwrt-30-rknroute.j2

@@ -3,6 +3,6 @@
 {% if tunnel == "wg" %}
 ip route add table vpn default dev wg0
 {% elif (tunnel == "openvpn") or (tunnel == "singbox") or (tunnel == "tun2socks") %}
-sleep 5
+sleep 10
 ip route add table vpn default dev tun0
 {% endif %}