Reserved device [reserved_device LAN-side networking variable]

roles/network/tasks/computed_network.yml

@@ -128,19 +128,6 @@
     iiab_lan_iface: "{{ user_lan_iface }}"
   when: not (user_lan_iface == "auto")
 
-- name: Record IIAB_WAN_DEVICE={{ iiab_wan_iface }} to {{ iiab_env_file }}
-  lineinfile:
-    path: "{{ iiab_env_file }}"
-    regexp: '^IIAB_WAN_DEVICE=*'
-    line: 'IIAB_WAN_DEVICE={{ iiab_wan_iface }}'
-
-- name: Record IIAB_LAN_DEVICE={{ iiab_lan_iface }} to {{ iiab_env_file }}
-  lineinfile:
-    path: "{{ iiab_env_file }}"
-    regexp: '^IIAB_LAN_DEVICE=*'
-    line: 'IIAB_LAN_DEVICE={{ iiab_lan_iface }}'
-    state: present
-
 - name: Add 'computed_network' variable values to {{ iiab_ini_file }}
   ini_file:
     dest: "{{ iiab_ini_file }}"

roles/network/tasks/enable_services.yml

@@ -196,7 +196,24 @@
     enabled: no
   when: (wondershaper_install or wondershaper_installed is defined) and not wondershaper_enabled
 
-# check-LAN should be iptables.yml remove later
+- name: Setting LAN fact to reserved_device
+  set_fact:
+    iiab_lan_iface: "{{ reserved_device }}"
+  when: reserved_device is defined
+
+- name: Record IIAB_WAN_DEVICE={{ iiab_wan_iface }} to {{ iiab_env_file }}
+  lineinfile:
+    path: "{{ iiab_env_file }}"
+    regexp: '^IIAB_WAN_DEVICE=*'
+    line: 'IIAB_WAN_DEVICE={{ iiab_wan_iface }}'
+
+- name: Record IIAB_LAN_DEVICE={{ iiab_lan_iface }} to {{ iiab_env_file }}
+  lineinfile:
+    path: "{{ iiab_env_file }}"
+    regexp: '^IIAB_LAN_DEVICE=*'
+    line: 'IIAB_LAN_DEVICE={{ iiab_lan_iface }}'
+    state: present
+
 - name: Install clean copy of /usr/bin/iiab-gen-iptables from template
   template:
     src: gateway/iiab-gen-iptables

roles/network/templates/gateway/iiab-gen-iptables

@@ -179,17 +179,17 @@ if [ "$wan" != "none" ]; then
     if [ "$lan" != "none" ]; then
         # Typically False, to keep client machines (e.g. students) off the Internet
         if [ "$iiab_gateway_enabled" == "True" ]; then
+            # 3 or 4 IP forwarding rules
             $IPTABLES -A POSTROUTING -t nat -o $wan -j MASQUERADE
+            $IPTABLES -A FORWARD -i $wan -o $lan -m state --state ESTABLISHED,RELATED -j ACCEPT
+            # Allow outgoing connections from the LAN side
+            $IPTABLES -A FORWARD -i $lan -o $wan -j ACCEPT
         fi
 
-        # 3 or 4 IP forwarding rules
-        $IPTABLES -A FORWARD -i $wan -o $lan -m state --state ESTABLISHED,RELATED -j ACCEPT
         # Block https traffic except if directed at server
         if [ "$gw_block_https" == "True" ]; then
             $IPTABLES -A FORWARD -p tcp ! -d {{ lan_ip }} --dport 443 -j DROP
         fi
-        # Allow outgoing connections from the LAN side
-        $IPTABLES -A FORWARD -i $lan -o $wan -j ACCEPT
         # Don't forward from the outside to the inside
         $IPTABLES -A FORWARD -i $wan -o $lan -j DROP
         # Enable routing (kernel IP forwarding)