Fix WireGuard service start failure

- ip6tables nat commands now redirect stderr to /dev/null so missing
  ip6table_nat module doesn't fail PostUp and kill the service
- Pre-load ip6table_nat kernel module (ignore_errors for minimal kernels)
- Collapse PostUp/PostDown to single-line semicolon-chained commands
  (avoids any heredoc whitespace or multi-line parsing issues)
- Remove comments from inside wg0.conf config body

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/vpn/tasks/configure.yml

@@ -19,45 +19,26 @@
   args:
     creates: /etc/wireguard/clients/client1_private.key
 
+- name: Ensure ip6tables nat module is available
+  modprobe:
+    name: ip6table_nat
+    state: present
+  ignore_errors: true
+
 - name: Build WireGuard server config
   shell: |
     SERVER_PRIVKEY=$(cat /etc/wireguard/server_private.key)
     IFACE={{ primary_interface.stdout | trim }}
+    SUBNET="{{ wg_subnet }}"
 
-    cat > /etc/wireguard/wg0.conf << 'WGEOF'
+    cat > /etc/wireguard/wg0.conf << EOF
     [Interface]
-    WGEOF
-
-    # Write dynamic values separately to avoid heredoc variable issues
-    cat >> /etc/wireguard/wg0.conf << EOF
     Address = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '.1/24') }}
     ListenPort = {{ wg_port }}
     PrivateKey = ${SERVER_PRIVKEY}
     SaveConfig = false
-
+    PostUp = iptables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT; iptables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -o ${IFACE} -s ${SUBNET} -j MASQUERADE; ip6tables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT 2>/dev/null; ip6tables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; ip6tables -t nat -A POSTROUTING -o ${IFACE} -j MASQUERADE 2>/dev/null; iptables -I INPUT -i wg0 -p tcp --dport 22 -j DROP; iptables -I INPUT -i wg0 -p tcp --dport 80 -j DROP; iptables -I INPUT -i wg0 -p tcp --dport 443 -j DROP
-    # IPv4: forward VPN traffic to internet, masquerade source
+    PostDown = iptables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT; iptables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -D POSTROUTING -o ${IFACE} -s ${SUBNET} -j MASQUERADE; ip6tables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT 2>/dev/null; ip6tables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; ip6tables -t nat -D POSTROUTING -o ${IFACE} -j MASQUERADE 2>/dev/null; iptables -D INPUT -i wg0 -p tcp --dport 22 -j DROP; iptables -D INPUT -i wg0 -p tcp --dport 80 -j DROP; iptables -D INPUT -i wg0 -p tcp --dport 443 -j DROP
-    PostUp = iptables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT
-    PostUp = iptables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-    PostUp = iptables -t nat -A POSTROUTING -o ${IFACE} -s {{ wg_subnet }} -j MASQUERADE
-    # IPv6: same rules to prevent leaks
-    PostUp = ip6tables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT
-    PostUp = ip6tables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-    PostUp = ip6tables -t nat -A POSTROUTING -o ${IFACE} -j MASQUERADE
-    # Block VPN clients from accessing server-local services (except DNS if local)
-    PostUp = iptables -I INPUT -i wg0 -p tcp --dport 22 -j DROP
-    PostUp = iptables -I INPUT -i wg0 -p tcp --dport 80 -j DROP
-    PostUp = iptables -I INPUT -i wg0 -p tcp --dport 443 -j DROP
-
-    PostDown = iptables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT
-    PostDown = iptables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-    PostDown = iptables -t nat -D POSTROUTING -o ${IFACE} -s {{ wg_subnet }} -j MASQUERADE
-    PostDown = ip6tables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT
-    PostDown = ip6tables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-    PostDown = ip6tables -t nat -D POSTROUTING -o ${IFACE} -j MASQUERADE
-    PostDown = iptables -D INPUT -i wg0 -p tcp --dport 22 -j DROP
-    PostDown = iptables -D INPUT -i wg0 -p tcp --dport 80 -j DROP
-    PostDown = iptables -D INPUT -i wg0 -p tcp --dport 443 -j DROP
-
     EOF
 
     for i in $(seq 1 {{ wg_clients }}); do
@@ -66,11 +47,9 @@
       cat >> /etc/wireguard/wg0.conf << EOF
 
     [Peer]
-    # Client ${i}
     PublicKey = ${CLIENT_PUBKEY}
     PresharedKey = ${CLIENT_PSK}
     AllowedIPs = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '') }}.$(( i + 1 ))/32
-
     EOF
     done
 
@@ -102,7 +81,6 @@
     PersistentKeepalive = 25
     EOF
 
-      # Generate QR code
       qrencode -t ansiutf8 < /etc/wireguard/clients/client${i}.conf > /etc/wireguard/clients/client${i}_qr.txt 2>/dev/null || true
     done
   args: