set interfaces wireguard wg42 description 'OCI AMD / DN42 internal transport'
set interfaces wireguard wg42 address '172.21.111.161/32'
set interfaces wireguard wg42 address 'fdd0:98df:15b0:ffff::2/64'
set interfaces wireguard wg42 mtu '1380'
set interfaces wireguard wg42 port '51820'
set interfaces wireguard wg42 peer amd address '129.225.176.134'
set interfaces wireguard wg42 peer amd port '51820'
set interfaces wireguard wg42 peer amd public-key '{{ hostvars.oci_amd.wg_public_key.stdout | trim }}'
set interfaces wireguard wg42 peer amd persistent-keepalive '25'
set interfaces wireguard wg42 peer amd allowed-ips '10.255.254.1/32'
set interfaces wireguard wg42 peer amd allowed-ips '10.0.0.0/24'
set interfaces wireguard wg42 peer amd allowed-ips '172.21.111.162/32'
set interfaces wireguard wg42 peer amd allowed-ips 'fdd0:98df:15b0::/48'
set interfaces loopback lo address 'fdd0:98df:15b0::1/128'
set protocols static route 172.21.111.160/27 blackhole distance '254'
set protocols static route6 fdd0:98df:15b0::/48 blackhole distance '254'
set protocols bgp system-as '{{ dn42_asn }}'
set protocols bgp parameters router-id '172.21.111.161'
{% for p in ['10.0.0.0/24', '172.21.111.162/32', '172.20.0.0/14'] %}
set policy prefix-list OCI-SITE-IN rule {{ loop.index * 10 }} action 'permit'
set policy prefix-list OCI-SITE-IN rule {{ loop.index * 10 }} prefix '{{ p }}'
{% endfor %}
{% for p in wg_home_prefixes + [dn42_ipv4] %}
set protocols bgp address-family ipv4-unicast network '{{ p }}'
set policy prefix-list OCI-SITE-OUT rule {{ loop.index * 10 }} action 'permit'
set policy prefix-list OCI-SITE-OUT rule {{ loop.index * 10 }} prefix '{{ p }}'
{% endfor %}
set protocols bgp address-family ipv6-unicast network '{{ dn42_ipv6 }}'
set policy prefix-list6 OCI-SITE6-IN rule 10 action 'permit'
set policy prefix-list6 OCI-SITE6-IN rule 10 prefix 'fdd0:98df:15b0::2/128'
set policy prefix-list6 OCI-SITE6-OUT rule 10 action 'permit'
set policy prefix-list6 OCI-SITE6-OUT rule 10 prefix '{{ dn42_ipv6 }}'
set policy prefix-list OCI-TO-OSPF rule 10 action 'permit'
set policy prefix-list OCI-TO-OSPF rule 10 prefix '10.0.0.0/24'
set policy route-map OCI-TO-OSPF rule 10 action 'permit'
set policy route-map OCI-TO-OSPF rule 10 match ip address prefix-list 'OCI-TO-OSPF'
set protocols ospf redistribute bgp route-map 'OCI-TO-OSPF'
set protocols ospf redistribute bgp metric-type '1'
set policy prefix-list DN42-TO-OSPF rule 10 action 'permit'
set policy prefix-list DN42-TO-OSPF rule 10 prefix '{{ dn42_ipv4 }}'
set policy route-map DN42-TO-OSPF rule 10 action 'permit'
set policy route-map DN42-TO-OSPF rule 10 match ip address prefix-list 'DN42-TO-OSPF'
set protocols ospf redistribute static route-map 'DN42-TO-OSPF'
set protocols ospf redistribute static metric-type '1'
set interfaces wireguard wg42 peer amd allowed-ips 'fe80::/64'

set interfaces wireguard wg42 peer amd allowed-ips '172.20.0.0/14'
set interfaces wireguard wg42 peer amd allowed-ips 'fd00::/8'
set policy prefix-list6 OCI-SITE6-IN rule 20 action 'permit'
set policy prefix-list6 OCI-SITE6-IN rule 20 prefix 'fd00::/8'
set policy prefix-list OCI-TO-OSPF rule 20 action 'permit'
set policy prefix-list OCI-TO-OSPF rule 20 prefix '172.20.0.0/14'

set interfaces wireguard wg42 address 'fe80::1811:1/64'
set protocols bgp neighbor fe80::1811:2 remote-as '{{ dn42_asn }}'
set protocols bgp neighbor fe80::1811:2 description 'OCI AMD internal MP-BGP'
set protocols bgp neighbor fe80::1811:2 interface source-interface 'wg42'
set protocols bgp neighbor fe80::1811:2 update-source 'fe80::1811:1'
set protocols bgp neighbor fe80::1811:2 capability extended-nexthop
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast prefix-list import 'OCI-SITE-IN'
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast prefix-list export 'OCI-SITE-OUT'
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast prefix-list import 'OCI-SITE6-IN'
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast prefix-list export 'OCI-SITE6-OUT'

{% for path in vyos_retired_paths %}
{% if vyos_retired_present.results[loop.index0].rc == 0 %}
delete {{ path }}
{% endif %}
{% endfor %}
set nat source rule 18100 description 'Exclude local DN42 allocation'
set nat source rule 18100 outbound-interface name 'wg42'
set nat source rule 18100 destination address '172.21.111.160/27'
set nat source rule 18100 exclude
{% for prefix in wg_home_prefixes %}
set nat source rule {{ 18100 + loop.index * 10 }} description 'LAN to DN42 masquerade'
set nat source rule {{ 18100 + loop.index * 10 }} outbound-interface name 'wg42'
set nat source rule {{ 18100 + loop.index * 10 }} source address '{{ prefix }}'
set nat source rule {{ 18100 + loop.index * 10 }} destination address '172.20.0.0/14'
set nat source rule {{ 18100 + loop.index * 10 }} translation address 'masquerade'
{% endfor %}
set policy route-map OCI-MP-IN rule 10 action 'permit'
set policy route-map OCI-MP-IN rule 10 set ipv6-next-hop prefer-global
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast route-map import 'OCI-MP-IN'
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast route-map import 'OCI-MP-IN'