Add TAP networking for transparent VPN routing

apps/rego-tunnel/build/setup-network.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# Setup TAP/Bridge networking for QEMU VM
+# Bridge: 100.100.0.1/24
+# VM will be: 100.100.0.2/24
+
+set -e
+
+# Create bridge if not exists
+if ! ip link show br0 &>/dev/null; then
+    ip link add br0 type bridge
+    ip addr add 100.100.0.1/24 dev br0
+    ip link set br0 up
+    echo "Bridge br0 created with IP 100.100.0.1/24"
+fi
+
+# Create TAP device if not exists
+if ! ip link show tap0 &>/dev/null; then
+    ip tuntap add tap0 mode tap
+    ip link set tap0 master br0
+    ip link set tap0 up
+    echo "TAP device tap0 created and attached to br0"
+fi
+
+# Enable IP forwarding
+echo 1 > /proc/sys/net/ipv4/ip_forward
+
+# Setup NAT/masquerade for outbound traffic from VM
+iptables -t nat -C POSTROUTING -s 100.100.0.0/24 -o eth0 -j MASQUERADE 2>/dev/null ||     iptables -t nat -A POSTROUTING -s 100.100.0.0/24 -o eth0 -j MASQUERADE
+
+# Forward traffic destined for VPN networks to VM (10.35.33.230 = IBM i)
+# The VM will route this through its VPN tunnel
+iptables -C FORWARD -d 10.35.33.230 -j ACCEPT 2>/dev/null ||     iptables -A FORWARD -d 10.35.33.230 -j ACCEPT
+iptables -C FORWARD -s 10.35.33.230 -j ACCEPT 2>/dev/null ||     iptables -A FORWARD -s 10.35.33.230 -j ACCEPT
+
+# Route to IBM i through VM
+ip route add 10.35.33.230 via 100.100.0.2 2>/dev/null || true
+
+echo "Network setup complete"
+echo "Bridge: br0 = 100.100.0.1/24"
+echo "TAP: tap0 attached to br0"
+echo "Route: 10.35.33.230 via 100.100.0.2 (VM)"