From dfcee00232bc1e0db67f6732d80917e5c610a44b Mon Sep 17 00:00:00 2001
From: Dmitry <ada.dmitry@gmail.com>
Date: Thu, 3 Sep 2026 09:50:01 +0300
Subject: [PATCH] fix(openvpn-phone): open FORWARD for road-warrior traffic
 into the LAN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The phone tunnel established fine (TLS peer-fingerprint OK) but no traffic
reached the LAN: ru-vps has policy FORWARD DROP and only per-service game
ACCEPTs. The site tunnel never needed a FORWARD rule because it carries
ru-vps's own traffic, not forwarded packets; the road-warrior instance is
the first forwarded path.

Add a `ufw route allow` (tun2 -> tun0, 10.80.0.0/30 -> 192.168.1.0/24). ufw
route rules survive `ufw reload`, unlike a raw `iptables -I FORWARD` which
would sit before the ufw chains and be flushed on reload. Return traffic is
covered by the global RELATED,ESTABLISHED accept in ufw-before-forward.

Verified on ru-vps: `ufw status` shows "192.168.1.0/24 on tun0 ALLOW FWD
10.80.0.0/30 on tun2"; make openvpn-phone idempotent.

Same gap exists in openvpn-laptop.yml (tun1) — still not deployed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG
---
 ansible/playbooks/openvpn-phone.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/ansible/playbooks/openvpn-phone.yml b/ansible/playbooks/openvpn-phone.yml
index c43e0a7..6560e6e 100644
--- a/ansible/playbooks/openvpn-phone.yml
+++ b/ansible/playbooks/openvpn-phone.yml
@@ -177,6 +177,20 @@
       changed_when: "'Rule added' in ufw_allow_phone_openvpn.stdout or 'Rules updated' in ufw_allow_phone_openvpn.stdout"
       failed_when: false
 
+    # Road-warrior трафик tun2 -> tun0 ФОРВАРДИТСЯ через ru-vps, а policy
+    # FORWARD = DROP. Сайт-тоннель этого правила не требовал (он несёт
+    # собственный трафик ru-vps, не forward). ufw route allow переживает
+    # `ufw reload`, в отличие от сырого iptables -I FORWARD. Обратное
+    # направление покрыто глобальным RELATED,ESTABLISHED в ufw-before-forward.
+    - name: Allow forwarding phone VPN traffic into the LAN
+      community.general.ufw:
+        route: true
+        rule: allow
+        interface_in: "{{ phone_openvpn_interface }}"
+        interface_out: "{{ phone_openvpn_site_interface }}"
+        src: "{{ phone_openvpn_network_cidr }}"
+        dest: "{{ homelab_lan_cidr }}"
+
     - name: Render phone OpenVPN server config
       ansible.builtin.copy:
         dest: "{{ phone_openvpn_config }}"