new net with nat64

33 files changed, 463 insertions, 314 deletions

diff --git a/group_vars/fastd b/group_vars/fastd
index 21708ae..518834d 100644
--- a/group_vars/fastd
+++ b/group_vars/fastd
@@ -7,3 +7,4 @@ wireguard_bb_peers:
     pub_key: 'LobyJ67+/rGkTcFSchnJMz76MGVBAz5FrFypYq9GnzQ='
     ipv4: '10.222.0.212'
     port: 10151
+dns_ip: '2a03:2260:1016::53'
diff --git a/host_vars/ff-niyawe1 b/host_vars/ff-niyawe1
index c3d4942..df9ad3f 100644
--- a/host_vars/ff-niyawe1
+++ b/host_vars/ff-niyawe1
@@ -244,6 +244,19 @@ wireguard_bb_pub_key: 'zGubrJd9Wfa1Yo9I5xyJArdvX1bj7OS2VFth289PdlU='
 wireguard_bb_ipv4: '10.222.0.11'
 wireguard_bb_ipv6: 'fe80::ffbb:ffbb:11'
 wireguard_bb_port: 10111
+wireguard_vpn_port: 10010
+wireguard_vpn_priv_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          34313130643739316461343031626565323930303465623238356636636531656630396433383036
+          6337386336633165636633353139323366323563333464380a393438343365363661633331356438
+          62326531336666326662323535366463333265313130343430653162646461383230363064366264
+          6431663833633537660a343830623735633330643935363232366532346664353834623636326462
+          33393133363464313665623963393534306235653239636438343537366533306166623535663336
+          3864646261313135386563613637613330343935333636633434
+wireguard_vpn_address: 'fe80::7e:adff:fefc:0b8c'
+wireguard_vpn_client_range: '2a03:2260:1016:1000::/52'
+tayga_ipv4: 10.1.0.1
+tayga_pool: 10.1.0.0/16
 ffrl_ip4: '185.66.194.56'
 ffrl_peers:
   - name: 'bbaakber'
diff --git a/host_vars/ff-niyawe2 b/host_vars/ff-niyawe2
index 99f2c8f..2c639dc 100644
--- a/host_vars/ff-niyawe2
+++ b/host_vars/ff-niyawe2
@@ -244,6 +244,19 @@ wireguard_bb_pub_key: 'ctSz9JjaPWM4Se39rSsbr39wXWfA1LJDF1OwwBui0VY='
 wireguard_bb_ipv4: '10.222.0.12'
 wireguard_bb_ipv6: 'fe80::ffbb:ffbb:12'
 wireguard_bb_port: 10112
+wireguard_vpn_port: 10010
+wireguard_vpn_priv_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          36623962663931636165643834636338373230623438306431316338633765333434626462626636
+          6330346538316361376531353932666363303431313737640a333931366638326164333937656566
+          32393639376561396161313365343563383132663338363437376563653930643835303230613336
+          6232616639643564360a613333666165623036613866383236323335383233376439386463333535
+          32616431393965313839613264326137633063366530336461643534623833306466653330373666
+          6364666534323361663937613837313031356262363338386563
+wireguard_vpn_address: 'fe80::ce:30ff:fe37:94da'
+wireguard_vpn_client_range: '2a03:2260:1016:2000::/52'
+tayga_ipv4: 10.2.0.1
+tayga_pool: 10.2.0.0/16
 ffrl_ip4: '185.66.194.57'
 ffrl_peers:
   - name: 'bbafra2fra'
diff --git a/roles/configure_aurto_repo/tasks/main.yml b/roles/configure_aurto_repo/tasks/main.yml
new file mode 100644
index 0000000..e8ab37e
--- /dev/null
+++ b/roles/configure_aurto_repo/tasks/main.yml
@@ -0,0 +1,19 @@
+---
+- name: add aurto repo (1/3)
+  ansible.builtin.lineinfile:
+      path: /etc/pacman.conf
+      line: "[aurto]"
+
+- name: add aurto repo (2/3)
+  ansible.builtin.lineinfile:
+      path: /etc/pacman.conf
+      line: "SigLevel = Optional TrustAll"
+
+- name: add aurto repo (3/3)
+  ansible.builtin.lineinfile:
+      path: /etc/pacman.conf
+      line: "Server = https://aur.niyawe.de/"
+
+- name: update pacman cache
+  pacman:
+      update_cache: yes
diff --git a/roles/configure_iptables/templates/ip6tables.rules b/roles/configure_iptables/templates/ip6tables.rules
index 80e8b30..51287c0 100644
--- a/roles/configure_iptables/templates/ip6tables.rules
+++ b/roles/configure_iptables/templates/ip6tables.rules
@@ -52,6 +52,8 @@ COMMIT
 -A INPUT -p udp -m udp --dport 10010:10023 -j ACCEPT
 # respondd
 -A INPUT -i bat+ -p udp -m udp --dport 1001 -j ACCEPT
+# wg_prefix_provider
+-A INPUT -i wgmyk -s fe80::/64 -p tcp -m tcp --dport 9999 -j ACCEPT
 # wireguard_mesh
 {% for site in sites %}
 -A INPUT -s 2a03:2260:1016::/48 -p udp -m udp --dport {{ site.wireguard_mesh_port }} -j DROP
diff --git a/roles/configure_static_routes/files/ffmyk-iproute.sh b/roles/configure_static_routes/files/ffmyk-iproute.sh
index 831d30d..83cb5aa 100755
--- a/roles/configure_static_routes/files/ffmyk-iproute.sh
+++ b/roles/configure_static_routes/files/ffmyk-iproute.sh
@@ -2,7 +2,11 @@
 #Alles, was mit 0x1 markiert wird gehört zu Tabelle ffmyk
 ip -4 rule add from all fwmark 0x1 table ffmyk priority 10
 ip -6 rule add from all fwmark 0x1 table ffmyk priority 10
+ip -4 rule add iif nat64 table ffmyk priority 10
+ip -6 rule add iif nat64 table ffmyk priority 10
 
+ip -4 rule add to 10.1.0.0/16 table ffmyk priority 10
+ip -4 rule add to 10.2.0.0/16 table ffmyk priority 10
 #Alles mit Freifunk-IP - woher auch immer - gehört zu Tabelle ffmyk
 ip -4 rule add to 10.222.1.0/24 table ffmyk priority 10
 ip -4 rule add to 10.222.2.0/23 table ffmyk priority 10
@@ -16,3 +20,6 @@ ip -6 rule add to 2001:470:cd45:ff00::/56 table ffmyk priority 10
 ip -6 rule add to 2a03:2260:1016::/48 table ffmyk priority 10
 ip -6 rule add to 64:ff9b::/96 table ffmyk priority 10
 ip -6 rule add to fd62:44e1:da::/48 table ffmyk priority 10
+
+ip -4 rule add from all iif nat64 type unreachable priority 200
+ip -6 rule add from all iif nat64 type unreachable priority 200
diff --git a/roles/install_babeld/tasks/main.yml b/roles/install_babeld/tasks/main.yml
index a8299da..94b3ce5 100644
--- a/roles/install_babeld/tasks/main.yml
+++ b/roles/install_babeld/tasks/main.yml
@@ -1,5 +1,5 @@
 ---
-- name: install fastd
+- name: install babeld
   pacman:
       name: babeld
       state: present
diff --git a/roles/install_bind/tasks/main.yml b/roles/install_bind/tasks/main.yml
index a7391e5..a11d247 100644
--- a/roles/install_bind/tasks/main.yml
+++ b/roles/install_bind/tasks/main.yml
@@ -11,6 +11,16 @@
       owner: named
       group: named
 
+- name: create systemd-folder
+  file:
+    path: /etc/systemd/system/named.service.d
+    state: directory
+
+- name: bind ip override
+  template:
+      src: ipv6.conf.j2
+      dest: /etc/systemd/system/named.service.d/ipv6.conf
+
 - name: bind config
   template:
       src: named.conf.j2
diff --git a/roles/install_bind/templates/ipv6.conf.j2 b/roles/install_bind/templates/ipv6.conf.j2
new file mode 100644
index 0000000..0bc8416
--- /dev/null
+++ b/roles/install_bind/templates/ipv6.conf.j2
@@ -0,0 +1,2 @@
+[Service]
+ExecStartPre=/usr/bin/ip addr replace {{ dns_ip }}/128 dev lo
diff --git a/roles/install_bind/templates/named.conf.j2 b/roles/install_bind/templates/named.conf.j2
index 25d3470..352c1fa 100644
--- a/roles/install_bind/templates/named.conf.j2
+++ b/roles/install_bind/templates/named.conf.j2
@@ -10,6 +10,7 @@ options {
     auth-nxdomain no;    # conform to RFC1035
 
     listen-on-v6 {
+        2a03:2260:1016::53;
 {% for site in sites %}
         {{ site.bat_ipv6 }};
 {% endfor %}
diff --git a/roles/install_monitoring/files/munin/munin_fastd_peers b/roles/install_monitoring/files/munin/munin_fastd_peers
deleted file mode 100644
index 17a0084..0000000
--- a/roles/install_monitoring/files/munin/munin_fastd_peers
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/perl -w
-# -*- perl -*-
-
-=head1 NAME
-
-fastd_peers_ - Plugin to monitor fastd peers
-
-=head1 CONFIGURATION
-
-Set user and group to have access to the socket
-Set path to socketfile if not /tmp/fastd.sock
-
-    [fastd_peers_*]
-    user fastd
-    group fastd
-    env.socketfile /tmp/fastd.sock
-
-=head1 USAGE
-
-Link this plugin to /etc/munin/plugins/
-
-After creating the links, restart munin-node. Don't forget to configure the plugin!
-
-=head1 AUTHORS
-
-Dominique Goersch <mail@dgoersch.info>
-Niklas Yann Wettengel <niyawe@niyawe.de>
-
-=head1 LICENSE
-
-GPLv2
-
-=head1 MAGIC MARKERS
-
- #%# family=manual
-
-=cut
-
-
-use strict;
-use warnings;
-use File::Basename;
-use IO::Socket::UNIX qw( SOCK_STREAM );
-use JSON;
-
-if ($ARGV[0] and $ARGV[0] eq "config") {                                                #config graph
-	print "graph_title fastd peers\n";
-	print "graph_info This graph shows the peers of the fastd on this supernode\n";
-	print "graph_args -l 0\n";
-	print "graph_scale no\n";
-	print "graph_vlabel peers count\n";
-	print "graph_category fastd\n";
-	print "peers.label peers\n";
-	print "peers.draw AREA\n";
-    exit 0;
-}
-
-
-my $statusfile = exists $ENV{'socketfile'} ? $ENV{'socketfile'} : "/tmp/fastd.sock";    #get path to socket from environment or use default
-my $socket = IO::Socket::UNIX->new(Type => SOCK_STREAM,Peer => $statusfile)             #open socket
-   or die("Can't connect to server: $!\n");
-
-my $fastdstatus = "";
-foreach my $line (<$socket>) {$fastdstatus .= $line;}                                   #read contents from socket
-my $json = decode_json($fastdstatus);                                                   #decode json
-
-#my $fastd_peers      = scalar(keys(%{$json->{peers}}));                                 #get number of peers from json
-my $fastd_peers = 0;
-for my $key (keys(%{$json->{peers}})) {
-	$fastd_peers = $fastd_peers + ($json->{peers}{$key}{connection}? 1 : 0);
-}
-
-print "peers.value $fastd_peers\n";                                                 #return number of peers
diff --git a/roles/install_monitoring/files/munin/munin_fastd_plugin b/roles/install_monitoring/files/munin/munin_fastd_plugin
deleted file mode 100755
index 35ad65d..0000000
--- a/roles/install_monitoring/files/munin/munin_fastd_plugin
+++ /dev/null
@@ -1,124 +0,0 @@
-#!/usr/bin/perl -w
-# -*- perl -*-
-
-=head1 NAME
-
-fastd_ - Plugin to monitor fastd uptime, peers and traffic
-
-=head1 CONFIGURATION
-
-Set user and group to have access to the socket
-Set path to socketfile if not /tmp/fastd.sock
-
-    [fastd_*]
-    user fastd
-    group fastd
-    env.socketfile /tmp/fastd.sock
-
-=head1 USAGE
-
-Link this plugin to /etc/munin/plugins/ with the type of graph (uptime, peers, traffic)
-append to the linkname, ie: /etc/munin/plugins/fastd_peers
-
-After creating the links, restart munin-node. Don't forget to configure the plugin!
-
-=head1 AUTHORS
-
-Dominique Goersch <mail@dgoersch.info>
-
-=head1 LICENSE
-
-GPLv2
-
-=head1 MAGIC MARKERS
-
- #%# family=manual
- #%# capabilities=suggest
-
-=cut
-
-
-use strict;
-use warnings;
-use File::Basename;
-use IO::Socket::UNIX qw( SOCK_STREAM );
-use JSON;
-
-my $mode = basename($0);                                                                #get basename
-$mode =~ s/fastd_//;                                                                    #and strip 'fastd_' to get the mode
-
-if ($ARGV[0] and $ARGV[0] eq "config") {                                                #config graph
-    if ($mode eq 'uptime') {                                                            #for uptime
-        print "graph_title fastd Uptime\n";
-        print "graph_info This graph shows the uptime of the fastd on this supernode\n";
-        print "graph_args -l 0\n";
-        print "graph_scale no\n";
-        print "graph_vlabel uptime in days\n";
-        print "graph_category fastd\n";
-        print "uptime.label uptime\n";
-        print "uptime.draw AREA\n";
-    }
-    elsif ($mode eq 'peers') {                                                          #for peers
-        print "graph_title fastd peers\n";
-        print "graph_info This graph shows the peers of the fastd on this supernode\n";
-        print "graph_args -l 0\n";
-        print "graph_scale no\n";
-        print "graph_vlabel peers count\n";
-        print "graph_category fastd\n";
-        print "peers.label peers\n";
-        print "peers.draw AREA\n";
-    }
-    elsif ($mode eq 'traffic') {                                                        #for traffic
-        print "graph_order down up\n";
-        print "graph_title fastd traffic\n";
-        print "graph_args --base 1000\n";
-        print "graph_vlabel bits in (-) / out (+) per second\n";
-        print "graph_category fastd\n";
-        print "graph_info This graph shows the traffic of fast.\n";
-        print "down.label received\n";
-        print "down.type DERIVE\n";
-        print "down.graph no\n";
-        print "down.cdef down,8,*\n";
-        print "down.min 0\n";
-        print "up.label bps\n";
-        print "up.type DERIVE\n";
-        print "up.negative down\n";
-        print "up.cdef up,8,*\n";
-        print "up.min 0\n";
-    }
-    exit 0;
-}
-
-if ($ARGV[0] and $ARGV[0] eq "suggest") {                                               #tell munin about our graphs
-    print "uptime\n";
-    print "peers\n";
-    print "traffic\n";
-}
-
-
-
-my $statusfile = exists $ENV{'socketfile'} ? $ENV{'socketfile'} : "/tmp/fastd.sock";    #get path to socket from environment or use default
-my $socket = IO::Socket::UNIX->new(Type => SOCK_STREAM,Peer => $statusfile)             #open socket
-   or die("Can't connect to server: $!\n");
-
-my $fastdstatus = "";
-foreach my $line (<$socket>) {$fastdstatus .= $line;}                                   #read contents from socket
-my $json = decode_json($fastdstatus);                                                   #decode json
-
-my $fastd_uptime     = $json->{uptime};                                                 #get the uptime from json
-#my $fastd_peers      = scalar(keys(%{$json->{peers}}));                                 #get number of peers from json
-my $fastd_peers = 0;
-for my $key (keys(%{$json->{peers}})) {
-	$fastd_peers = $fastd_peers + ($json->{peers}{$key}{connection}? 1 : 0);
-}
-my $fastd_rx_bytes   = $json->{statistics}->{rx}->{bytes};                              #get recieved bytes from json
-my $fastd_tx_bytes   = $json->{statistics}->{tx}->{bytes};                              #get transmittetd bytes from json
-
-if ( $mode eq 'uptime' ) {
-    printf "uptime.value %.0f\n",$fastd_uptime/86400000;                                #return uptime in seconds
-} elsif ($mode eq 'peers') {
-    print "peers.value $fastd_peers\n";                                                 #return number of peers
-} elsif ($mode eq 'traffic') {
-    print "up.value $fastd_tx_bytes\n";                                                 #return transmitted bytes
-    print "down.value $fastd_rx_bytes\n";                                               #and recieved bytes
-}
diff --git a/roles/install_monitoring/files/munin/munin_fastd_traffic b/roles/install_monitoring/files/munin/munin_fastd_traffic
deleted file mode 100644
index 6b60a94..0000000
--- a/roles/install_monitoring/files/munin/munin_fastd_traffic
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/perl -w
-# -*- perl -*-
-
-=head1 NAME
-
-fastd_traffic_ - Plugin to monitor fastd traffic
-
-=head1 CONFIGURATION
-
-Set user and group to have access to the socket
-Set path to socketfile if not /tmp/fastd.sock
-
-    [fastd_traffic_*]
-    user fastd
-    group fastd
-    env.socketfile /tmp/fastd.sock
-
-=head1 USAGE
-
-Link this plugin to /etc/munin/plugins/ 
-
-After creating the links, restart munin-node. Don't forget to configure the plugin!
-
-=head1 AUTHORS
-
-Dominique Goersch <mail@dgoersch.info>
-Niklas Yann Wettengel <niyawe@niyawe.de>
-
-=head1 LICENSE
-
-GPLv2
-
-=head1 MAGIC MARKERS
-
- #%# family=manual
-
-=cut
-
-
-use strict;
-use warnings;
-use File::Basename;
-use IO::Socket::UNIX qw( SOCK_STREAM );
-use JSON;
-
-if ($ARGV[0] and $ARGV[0] eq "config") {                                                #config graph
-	print "graph_order down up\n";
-	print "graph_title fastd traffic\n";
-	print "graph_args --base 1000\n";
-	print "graph_vlabel bits in (-) / out (+) per second\n";
-	print "graph_category fastd\n";
-	print "graph_info This graph shows the traffic of fast.\n";
-	print "down.label received\n";
-	print "down.type DERIVE\n";
-	print "down.graph no\n";
-	print "down.cdef down,8,*\n";
-	print "down.min 0\n";
-	print "up.label bps\n";
-	print "up.type DERIVE\n";
-	print "up.negative down\n";
-	print "up.cdef up,8,*\n";
-	print "up.min 0\n";
-    exit 0;
-}
-
-
-my $statusfile = exists $ENV{'socketfile'} ? $ENV{'socketfile'} : "/tmp/fastd.sock";    #get path to socket from environment or use default
-my $socket = IO::Socket::UNIX->new(Type => SOCK_STREAM,Peer => $statusfile)             #open socket
-   or die("Can't connect to server: $!\n");
-
-my $fastdstatus = "";
-foreach my $line (<$socket>) {$fastdstatus .= $line;}                                   #read contents from socket
-my $json = decode_json($fastdstatus);                                                   #decode json
-
-my $fastd_rx_bytes   = $json->{statistics}->{rx}->{bytes};                              #get recieved bytes from json
-my $fastd_tx_bytes   = $json->{statistics}->{tx}->{bytes};                              #get transmittetd bytes from json
-
-print "up.value $fastd_tx_bytes\n";                                                 #return transmitted bytes
-print "down.value $fastd_rx_bytes\n";                                               #and recieved bytes
diff --git a/roles/install_monitoring/tasks/install_munin.yml b/roles/install_monitoring/tasks/install_munin.yml
index c843bfe..b17b0f9 100644
--- a/roles/install_monitoring/tasks/install_munin.yml
+++ b/roles/install_monitoring/tasks/install_munin.yml
@@ -15,42 +15,6 @@
       name: perl-json
       state: present
 
-- name: copy fastd peers plugin
-  copy:
-      src: munin/munin_fastd_peers
-      dest: /usr/lib/munin/plugins/fastd_peers_
-      mode: 0755
-  notify: restart munin-node
-
-- name: copy fastd traffic plugin
-  copy:
-      src: munin/munin_fastd_traffic
-      dest: /usr/lib/munin/plugins/fastd_traffic_
-      mode: 0755
-  notify: restart munin-node
-
-- name: enable munin plugins for fastd peers
-  file:
-      path: /etc/munin/plugins/fastd_peers_ff{{ item.name }}
-      src: /usr/lib/munin/plugins/fastd_peers_
-      state: link
-  with_items: "{{ sites }}"
-  notify: restart munin-node
-
-- name: enable munin plugins for fastd traffic
-  file:
-      path: /etc/munin/plugins/fastd_traffic_ff{{ item.name }}
-      src: /usr/lib/munin/plugins/fastd_traffic_
-      state: link
-  with_items: "{{ sites }}"
-  notify: restart munin-node
-
-- name: copy fastd plugin config
-  template:
-      src: munin_fastd_conf.j2
-      dest: /etc/munin/plugin-conf.d/fastd
-  notify: restart munin-node
-
 - name: copy wg peers plugin
   copy:
       src: munin/munin_wg_peers
diff --git a/roles/install_respondd_poller/files/requirements.txt b/roles/install_respondd_poller/files/requirements.txt
new file mode 100644
index 0000000..83bb832
--- /dev/null
+++ b/roles/install_respondd_poller/files/requirements.txt
@@ -0,0 +1,2 @@
+wgnlpy
+requests
diff --git a/roles/install_respondd_poller/files/respondd_poller.py b/roles/install_respondd_poller/files/respondd_poller.py
new file mode 100644
index 0000000..1eb98a1
--- /dev/null
+++ b/roles/install_respondd_poller/files/respondd_poller.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env python
+
+import socket
+import ipaddress
+import threading
+import time
+import zlib
+import json
+import os.path
+import sys
+from wgnlpy import WireGuard
+import requests
+from xml.etree import ElementTree
+
+if not os.path.exists("/etc/respondd_poller.json"):
+    print("/etc/respondd_poller.json missing")
+    sys.exit(1)
+
+interface = None
+prefix = None
+yanic_addr = None
+request = None
+
+with open("/etc/respondd_poller.json", "r") as f:
+    config = json.load(f)
+    if "interface" in config:
+        interface = config["interface"]
+    if "prefix" in config:
+        prefix = ipaddress.IPv6Network(config["prefix"])
+    if "yanic_addr" in config and "yanic_port" in config:
+        yanic_addr = (config["yanic_addr"], int(config["yanic_port"]))
+    if "request" in config:
+        request = config["request"].encode("ascii")
+
+wg = WireGuard()
+sock = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+last_request = dict()
+last_response = dict()
+
+def get_wg_peers():
+    wgpeers = wg.get_interface(interface).peers
+    for peer in wgpeers:
+        for ip in wgpeers[peer].allowedips:
+            if ip.subnet_of(prefix):
+                yield ip
+
+def inflate(data):
+    decompress = zlib.decompressobj(-zlib.MAX_WBITS)
+    inflated = decompress.decompress(data)
+    inflated += decompress.flush()
+    return inflated.decode()
+
+def cleanup():
+    while True:
+        time.sleep(60)
+        old = time.monotonic() - 360
+        ips = []
+        macs = []
+        for ip in last_request:
+            if last_response[ip] < old:
+                ips.append(ip)
+        for ip in ips:
+            del last_response[ip]
+            del last_request[ip]
+
+def recv():
+    global sock
+    while True:
+        data, addr = sock.recvfrom(1500)
+        sock.sendto(data, yanic_addr)
+        j = json.loads(inflate(data))
+        last_response[ipaddress.IPv6Address(addr[0])] = time.monotonic()
+
+def send(ip):
+    global request
+    try:
+        sock.sendto(request, (bytearray(str(ip).encode('ascii')), 1001))
+    except:
+        print("failed to send packet to", ip)
+        return
+
+def get_http_nodeinfo(ip):
+    global last_request
+    now = time.monotonic()
+    try:
+        status = requests.get('http://[' + str(ip) + ']/cgi-bin/status')
+    except:
+        return
+    status_tree = ElementTree.fromstring(status.content)
+    mesh_ifs = []
+    interface_list = status_tree.findall(".//*[@data-interface]")
+    for interface in interface_list:
+        mesh_ifs.append(interface.attrib["data-interface"])
+    for mesh_if in mesh_ifs:
+        try:
+            nodeinfo = requests.get('http://[' + str(ip) + ']/cgi-bin/dyn/neighbours-nodeinfo?' + mesh_if)
+        except:
+            return
+        for line in nodeinfo.content.split(b'\n'):
+            if line.startswith(b'data: {'):
+                data = line.split(b': ', maxsplit=1)[1]
+                data = json.loads(data)
+                if "network" in data and "addresses" in data["network"]:
+                    for address in data["network"]["addresses"]:
+                        if ipaddress.IPv6Network(address).subnet_of(prefix):
+                            node_ip = ipaddress.IPv6Address(address)
+                            if node_ip not in last_request:
+                                last_request[node_ip] = now
+                                last_response[node_ip] = now
+
+def scan_wg_peers():
+    global last_request
+    while True:
+        print("scanning wg peers")
+        request_threads = []
+        now = time.monotonic()
+        for net in get_wg_peers():
+            ip = ipaddress.IPv6Address(str(net.network_address) + "1")
+            if ip not in last_request:
+                last_request[ip] = now
+                last_response[ip] = now
+            request_thread = threading.Thread(target=get_http_nodeinfo, args=(ip,))
+            request_thread.start()
+            request_threads.append(request_thread)
+            if len(request_threads) > 10:
+                for thread in request_threads:
+                    thread.join()
+                request_threads = []
+        time.sleep(60)
+
+
+listen_thread = threading.Thread(target=recv)
+listen_thread.start()
+cleanup_thread = threading.Thread(target=cleanup)
+cleanup_thread.start()
+scan_thread = threading.Thread(target=scan_wg_peers)
+scan_thread.start()
+
+last_wg_time = 0
+
+while True:
+    now = time.monotonic()
+    for ip in last_request:
+        if now - last_request[ip] > 15:
+            last_request[ip] = now
+            send(ip)
+    time.sleep(1)
diff --git a/roles/install_respondd_poller/files/respondd_poller.service b/roles/install_respondd_poller/files/respondd_poller.service
new file mode 100644
index 0000000..96e309c
--- /dev/null
+++ b/roles/install_respondd_poller/files/respondd_poller.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=respondd_poller
+After=network.target
+
+[Service]
+ExecStart=/opt/respondd_poller/venv/bin/python -u /opt/respondd_poller/respondd_poller.py
+Restart=always
+WorkingDirectory=/opt/respondd_poller
+Environment=PYTHONPATH=/opt/respondd_poller
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/install_respondd_poller/tasks/main.yml b/roles/install_respondd_poller/tasks/main.yml
new file mode 100644
index 0000000..aa03558
--- /dev/null
+++ b/roles/install_respondd_poller/tasks/main.yml
@@ -0,0 +1,48 @@
+---
+- name: install respondd_poller dependencies
+  pacman:
+      name:
+          - git
+          - python-virtualenv
+          - python-setuptools
+      state: present
+
+- name: create venv
+  command:
+    cmd: "python -m venv /opt/respondd_poller/venv"
+    creates: /opt/respondd_poller/venv
+
+- name: install respondd_poller requirements
+  copy:
+      src: requirements.txt
+      dest: /opt/respondd_poller/requirements.txt
+      mode: 0644
+
+- name: install respondd_poller script
+  copy:
+      src: respondd_poller.py
+      dest: /opt/respondd_poller/respondd_poller.py
+      mode: 0644
+
+- name: install requirements
+  pip:
+    requirements: /opt/respondd_poller/requirements.txt
+    virtualenv: /opt/respondd_poller/venv
+
+- name: install respondd_poller config
+  template:
+      src: respondd_poller.json.j2
+      dest: /etc/respondd_poller.json
+      mode: 0644
+
+- name: create respondd_poller service
+  copy:
+      src: respondd_poller.service
+      dest: /etc/systemd/system/respondd_poller.service
+      mode: 0644
+
+- name: start and enable respondd_poller service
+  systemd:
+      name: respondd_poller
+      state: started
+      enabled: yes
diff --git a/roles/install_respondd_poller/templates/respondd_poller.json.j2 b/roles/install_respondd_poller/templates/respondd_poller.json.j2
new file mode 100644
index 0000000..c3f6574
--- /dev/null
+++ b/roles/install_respondd_poller/templates/respondd_poller.json.j2
@@ -0,0 +1,7 @@
+{
+    "interface":"wgmyk",
+    "prefix":"2a03:2260:1016::/48",
+    "yanic_addr": "fe80::41:18ff:fec5:5041%wgmyk",
+    "yanic_port": 10001,
+    "request":"GET nodeinfo statistics neighbours"
+}
diff --git a/roles/install_tayga/handlers/main.yml b/roles/install_tayga/handlers/main.yml
new file mode 100644
index 0000000..38fc10b
--- /dev/null
+++ b/roles/install_tayga/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: restart tayga
+  systemd:
+      name: tayga.service
+      state: restarted
diff --git a/roles/install_tayga/tasks/main.yml b/roles/install_tayga/tasks/main.yml
new file mode 100644
index 0000000..0f38790
--- /dev/null
+++ b/roles/install_tayga/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+- name: install tayga
+  pacman:
+      name: tayga
+      state: present
+
+- name: tayga.conf
+  template:
+      src: tayga.conf.j2
+      dest: /etc/tayga.conf
+      mode: 0644
+  notify: restart tayga
+
+- name: systemd override.conf
+  template:
+      src: systemd_override.conf.j2
+      dest: /etc/systemd/system/tayga.service.d/override.conf
+      mode: 0644
+  notify: restart tayga
+
+- name: start and enable tayga service
+  systemd:
+      name: tayga.service
+      enabled: yes
+      state: started
diff --git a/roles/install_tayga/templates/systemd_override.conf.j2 b/roles/install_tayga/templates/systemd_override.conf.j2
new file mode 100644
index 0000000..a3e7229
--- /dev/null
+++ b/roles/install_tayga/templates/systemd_override.conf.j2
@@ -0,0 +1,10 @@
+[Service]
+ExecStart=
+ExecStartPre=/usr/bin/tayga --mktun --config /etc/tayga.conf
+ExecStartPre=/usr/bin/ip link set nat64 up
+ExecStartPre=/usr/bin/ip addr replace {{ tayga_ipv4 }}/32 dev nat64
+ExecStartPre=/usr/bin/ip addr replace 2a03:2260:1016::64/128 dev nat64
+ExecStartPre=/usr/bin/ip route replace {{ tayga_pool }} dev nat64 table ffmyk
+ExecStartPre=/usr/bin/ip -6 route replace 64:ff9b::/96 dev nat64 table ffmyk
+ExecStart=/usr/bin/tayga --nodetach --config /etc/tayga.conf
+Restart=always
diff --git a/roles/install_tayga/templates/tayga.conf.j2 b/roles/install_tayga/templates/tayga.conf.j2
new file mode 100644
index 0000000..8606dcb
--- /dev/null
+++ b/roles/install_tayga/templates/tayga.conf.j2
@@ -0,0 +1,6 @@
+tun-device nat64
+ipv4-addr {{ tayga_ipv4 }}
+ipv6-addr 2a03:2260:1016::64
+prefix 64:ff9b::/96
+dynamic-pool {{ tayga_pool }}
+data-dir /var/db/tayga
diff --git a/roles/install_wg_add_vpn/tasks/main.yml b/roles/install_wg_add_vpn/tasks/main.yml
new file mode 100644
index 0000000..40ed07c
--- /dev/null
+++ b/roles/install_wg_add_vpn/tasks/main.yml
@@ -0,0 +1,30 @@
+---
+- name: install wg_add dependencies
+  pacman:
+      name:
+          - git
+          - make
+          - gcc
+      state: present
+
+- name: clone wg_add repo
+  git:
+      repo: https://github.com/FreifunkMYK/wg_add.git
+      dest: /opt/wg_add_vpn
+      version: vpn
+
+- name: build wg_add
+  make:
+    chdir: /opt/wg_add_vpn
+
+- name: install wg_add service
+  template:
+      src: wg_add_vpn.service.j2
+      dest: /etc/systemd/system/wg_add_vpn.service
+      mode: 0644
+
+- name: start and enable wgkex service
+  systemd:
+      name: wg_add_vpn
+      state: started
+      enabled: yes
diff --git a/roles/install_wg_add_vpn/templates/wg_add_vpn.service.j2 b/roles/install_wg_add_vpn/templates/wg_add_vpn.service.j2
new file mode 100644
index 0000000..da1470d
--- /dev/null
+++ b/roles/install_wg_add_vpn/templates/wg_add_vpn.service.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=wg_add
+After=network.target
+
+[Service]
+ExecStart=/opt/wg_add_vpn/wg_add {{ ansible_default_ipv4.interface }} wgmyk
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/install_wg_prefix_provider/tasks/main.yml b/roles/install_wg_prefix_provider/tasks/main.yml
new file mode 100644
index 0000000..a155300
--- /dev/null
+++ b/roles/install_wg_prefix_provider/tasks/main.yml
@@ -0,0 +1,29 @@
+---
+- name: install wg_prefix_provider dependencies
+  pacman:
+      name:
+          - git
+          - make
+          - gcc
+      state: present
+
+- name: clone wg_prefix_provider repo
+  git:
+      repo: https://github.com/FreifunkMYK/wg_prefix_provider.git
+      dest: /opt/wg_prefix_provider
+
+- name: build wg_prefix_provider
+  make:
+    chdir: /opt/wg_prefix_provider
+
+- name: install wg_prefix_provider service
+  template:
+      src: wg_prefix_provider.service.j2
+      dest: /etc/systemd/system/wg_prefix_provider.service
+      mode: 0644
+
+- name: start and enable wg_prefix_provider service
+  systemd:
+      name: wg_prefix_provider
+      state: started
+      enabled: yes
diff --git a/roles/install_wg_prefix_provider/templates/wg_prefix_provider.service.j2 b/roles/install_wg_prefix_provider/templates/wg_prefix_provider.service.j2
new file mode 100644
index 0000000..485517a
--- /dev/null
+++ b/roles/install_wg_prefix_provider/templates/wg_prefix_provider.service.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=wg_prefix_provider
+After=network.target
+
+[Service]
+ExecStart=/opt/wg_prefix_provider/wg_prefix_provider wgmyk 9999 {{ wireguard_vpn_client_range }}
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/install_wireguard_vpn/tasks/main.yml b/roles/install_wireguard_vpn/tasks/main.yml
new file mode 100644
index 0000000..3ca9dcc
--- /dev/null
+++ b/roles/install_wireguard_vpn/tasks/main.yml
@@ -0,0 +1,24 @@
+---
+- name: create wireguard config for wgmyk
+  template:
+      src: wg.conf.j2
+      dest: /etc/wireguard/wgmyk.conf
+      mode: 0400
+
+- name: create wireguard up scripts for wgmyk
+  template:
+      src: up.sh.j2
+      dest: /etc/wireguard/upmyk.sh
+      mode: 0744
+
+- name: create wireguard down scripts for wgmyk
+  template:
+      src: down.sh.j2
+      dest: /etc/wireguard/downmyk.sh
+      mode: 0744
+
+- name: start and enable wireguard mesh
+  systemd:
+      name: wg-quick@wgmyk.service
+      enabled: yes
+      state: started
diff --git a/roles/install_wireguard_vpn/templates/down.sh.j2 b/roles/install_wireguard_vpn/templates/down.sh.j2
new file mode 100644
index 0000000..d33011f
--- /dev/null
+++ b/roles/install_wireguard_vpn/templates/down.sh.j2
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+ip -6 route del {{ wireguard_vpn_client_range }} table ffmyk dev wgmyk
+
+ip -6 rule del iif wgmyk
+ip -6 rule del from {{ wireguard_vpn_client_range }}
diff --git a/roles/install_wireguard_vpn/templates/up.sh.j2 b/roles/install_wireguard_vpn/templates/up.sh.j2
new file mode 100644
index 0000000..c57d16f
--- /dev/null
+++ b/roles/install_wireguard_vpn/templates/up.sh.j2
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+ip -6 rule add iif wgmyk table ffmyk priority 10
+ip -6 rule add from {{ wireguard_vpn_client_range }} table ffmyk priority 10
+
+ip -6 rule add from all iif wgmyk type unreachable priority 200
+
+ip -6 route add {{ wireguard_vpn_client_range }} table ffmyk dev wgmyk
+systemctl restart named.service
diff --git a/roles/install_wireguard_vpn/templates/wg.conf.j2 b/roles/install_wireguard_vpn/templates/wg.conf.j2
new file mode 100644
index 0000000..3e25549
--- /dev/null
+++ b/roles/install_wireguard_vpn/templates/wg.conf.j2
@@ -0,0 +1,7 @@
+[Interface]
+ListenPort = {{ wireguard_vpn_port }}
+PrivateKey = {{ wireguard_vpn_priv_key }}
+Address = {{ wireguard_vpn_address }}/128
+MTU = 1400
+PostUp = /etc/wireguard/upmyk.sh
+PreDown = /etc/wireguard/downmyk.sh
diff --git a/roles/setup_ffrl_tunnel/templates/bird.conf b/roles/setup_ffrl_tunnel/templates/bird.conf
index 2ba27c7..c609a5b 100644
--- a/roles/setup_ffrl_tunnel/templates/bird.conf
+++ b/roles/setup_ffrl_tunnel/templates/bird.conf
@@ -84,6 +84,7 @@ protocol static ffrl_uplink_hostroute4 {
 protocol static ffrl_public_routes6 {
     ipv6 { table ffrl6; };
     route 2a03:2260:1016::/48 reject;
+    route {{ wireguard_vpn_client_range }} reject;
 }
 
 # Wir legen die Transfernetze in die interne BIRD Routing Table
diff --git a/setup_fastd.yml b/setup_fastd.yml
index e55f267..3bcb077 100644
--- a/setup_fastd.yml
+++ b/setup_fastd.yml
@@ -3,6 +3,7 @@
   hosts: fastd
   user: root
   roles:
+      - configure_aurto_repo
       - configure_journald
       - configure_sysctl
       - configure_iptables
@@ -18,10 +19,14 @@
       - install_bind
       - install_wireguard
       - install_wireguard_mesh
+      - install_wireguard_vpn
       - install_wireguard_backbone
       - install_babeld
+      - install_tayga
       - install_wg_add
-      - install_fastd
+      - install_wg_add_vpn
+      - install_wg_prefix_provider
+      - install_respondd_poller
       - install_mesh-announce
       - install_monitoring
       - install_iperf3