Uplink support
As the WAN port of a node will be connected to a user’s private network, it is essential that the node only uses the WAN when it is absolutely necessary. There are two cases in which the WAN port is used:
Mesh VPN (package
gluon-mesh-vpn-fastd)DNS to resolve the VPN servers’ addresses (package
gluon-wan-dnsmasq)
After the VPN connection has been established, the node should be able to reach the mesh’s DNS servers and use these for all other name resolution.
If a device has only a single Ethernet port (or group of ports), it will be
used as an uplink port even when it is not labelled as “WAN” by default. This
behavior can be controlled using the interfaces.single.default_roles
site.conf option. It is also possible to alter the interface assignment after
installation by modifying /etc/config/gluon and running
gluon-reconfigure.
Routing tables
As a node may get IPv6 default routes both over the WAN and the mesh, Gluon
uses two routing tables for IPv6. As all normal traffic should go over the mesh,
the mesh routes are added to the default table (table 0). All routes on the WAN interface
are put into table 1 (see /lib/gluon/upgrade/110-network in gluon-core).
There is also an ip -6 rule which routes all IPv6 traffic with a packet mark with the bit 1 set though table 1.
libpacketmark
libpacketmark is a library which can be loaded with LD_PRELOAD and will set the packet mark of all
sockets created by a process in accordance with the LIBPACKETMARK_MARK environment variable. This allows setting
the packet mark for processes which don’t support this themselves. The process must run as root (or at least
with CAP_NET_ADMIN) for this to work.
Unfortunately there’s no nice way to set the packet mark via iptables for outgoing packets. The iptables will run after the packet has been created, to even when the packet mark is changed and the packet is re-routed, the source address won’t be rewritten to the default source address of the newly chosen route. libpacketmark avoids this issue as the packet mark will already be set when the packet is created.
gluon-wan-dnsmasq
To separate the DNS servers in the mesh from the ones on the WAN, the gluon-wan-dnsmasq package provides
a secondary DNS daemon which runs on 127.0.0.1:54. It will automatically use all DNS servers explicitly
configured in /etc/config/gluon-wan-dnsmasq or received via DNS/RA on the WAN port. It is important that
no DNS servers for the WAN interface are configured in /etc/config/network and that peerdns is set to 0
so the WAN DNS servers aren’t leaked to the primary DNS daemon.
libpacketmark is used to make the secondary DNS daemon send its requests over the WAN interface.
The package gluon-mesh-vpn-fastd provides an iptables rule which will redirect all DNS requests from processes running
with the primary group gluon-mesh-vpn to 127.0.0.1:54, thus making fastd use the secondary DNS daemon.