Defer configuration by default and manage vpn-router.conf with ucf

Add platform = none as the shipped default so installing the package
changes nothing on the machine until a platform is chosen. Add a mode
setting (manual/interfaces/auto) controlling how much of the network
configuration is supplied versus detected from the system. Manage
/etc/vpn-router/vpn-router.conf with ucf instead of writing it once,
so dpkg-reconfigure can safely reapply debconf answers without
clobbering local edits. Extend NAT/forward rules to all local subnets,
not just the first.

debian-package/src/usr/lib/vpn-router/setup

@@ -150,14 +150,13 @@ def filter_block(ctx):
         lines += ['# P2S DNS RULES END']
 
     if vpnrouter.routing_ready(ctx):
-        subnet = ctx['local_subnet']
-        lines += [
-            '',
-            '# ROUTER FORWARD RULES START',
-            f'-A ufw-before-forward -s {subnet} -o {ctx["wan_iface"]} -j ACCEPT',
-            f'-A ufw-before-forward -d {subnet} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT',
-            '# ROUTER FORWARD RULES END',
-        ]
+        lines += ['', '# ROUTER FORWARD RULES START']
+        for subnet in ctx['local_cidr_list']:
+            lines += [
+                f'-A ufw-before-forward -s {subnet} -o {ctx["wan_iface"]} -j ACCEPT',
+                f'-A ufw-before-forward -d {subnet} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT',
+            ]
+        lines += ['# ROUTER FORWARD RULES END']
 
     return ''.join(line + '\n' for line in lines)
 
@@ -166,7 +165,8 @@ def nat_and_mangle_block(ctx):
     lines = []
 
     if vpnrouter.routing_ready(ctx):
-        subnet = ctx['local_subnet']
+        subnets = ctx['local_cidr_list']
+        remote = [c.strip() for c in ctx['remote_cidrs'].split(',') if c.strip()]
         lines += [
             '',
             '# ROUTER NAT RULES START',
@@ -174,13 +174,15 @@ def nat_and_mangle_block(ctx):
             ':POSTROUTING ACCEPT [0:0]',
             '-F POSTROUTING',
         ]
-        for cidr in [c.strip() for c in ctx['remote_cidrs'].split(',') if c.strip()]:
-            lines.append(f'-A POSTROUTING -s {subnet} -d {cidr} -j RETURN')
-        lines += [
-            f'-A POSTROUTING -s {subnet} -o {ctx["wan_iface"]} -j MASQUERADE',
-            'COMMIT',
-            '# ROUTER NAT RULES END',
-        ]
+        # Every RETURN precedes every MASQUERADE, so tunnel-bound traffic
+        # escapes NAT whichever local subnet it came from.
+        for subnet in subnets:
+            for cidr in remote:
+                lines.append(f'-A POSTROUTING -s {subnet} -d {cidr} -j RETURN')
+        for subnet in subnets:
+            lines.append(
+                f'-A POSTROUTING -s {subnet} -o {ctx["wan_iface"]} -j MASQUERADE')
+        lines += ['COMMIT', '# ROUTER NAT RULES END']
 
     lines += [
         '',
@@ -301,6 +303,11 @@ def main():
     cfg = vpnrouter.load_config()
     ctx, changed = vpnrouter.configure(cfg)
 
+    if ctx is None:
+        print('vpn-router: platform is none, configuration deferred; '
+              'set general.platform in /etc/vpn-router/vpn-router.conf')
+        return 0
+
     if vpnrouter.routing_ready(ctx):
         apply_routes(ctx)