[embtom]

No description provided.

[Copilot]

🟡 Changes recommended

Unresolved DNS defaults, DHCPv6 filtering, and LAN interface ownership conflicts can disrupt connectivity.

3 open issues

• Firewall blocks DHCPv6 server replies · New
• Default DNS advertises unreachable resolver · New
• NetworkManager conflicts with networkd on LAN interface · New

What changed in this PR

Adds a default workstation firewall and an optional IPv4 router role.

Changes:

• Adds nftables input filtering and service management.
• Adds opt-in LAN DHCP, forwarding, and NAT.
• Documents configuration and exposes role tags in VS Code.

File	Description
README.md	Documents firewall and router configuration.
ansible/​roles/​router/​templates/​20-router.nft.j2	Adds LAN access, forwarding, and NAT rules.
ansible/​roles/​router/​templates/​10-router-lan.network.j2	Configures LAN addressing and DHCP.
ansible/​roles/​router/​tasks/​main.yml	Provisions optional routing services and configuration.
ansible/​roles/​router/​handlers/​main.yml	Applies network and forwarding changes.
ansible/​roles/​router/​defaults/​main.yml	Defines router and DHCP defaults.
ansible/​roles/​nftables/​templates/​10-filter.nft.j2	Defines default-drop input filtering.
ansible/​roles/​nftables/​tasks/​main.yml	Installs and configures the firewall.
ansible/​roles/​nftables/​handlers/​main.yml	Restarts nftables after changes.
ansible/​playbooks/​workstation.yml	Integrates firewall and router roles.
.vscode/​tasks.json	Adds firewall and router tag choices.

_{Review effort: Balanced}