update..
This commit is contained in:
parent
33e9a313ee
commit
11f5c3fcb6
@ -16,6 +16,7 @@
|
|||||||
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
# ===
|
||||||
# Some Checks
|
# Some Checks
|
||||||
# ===
|
# ===
|
||||||
@ -46,6 +47,7 @@
|
|||||||
register: munin_node_exists
|
register: munin_node_exists
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
# ===
|
||||||
# Adjust/Correct some values..
|
# Adjust/Correct some values..
|
||||||
# ===
|
# ===
|
||||||
@ -91,6 +93,7 @@
|
|||||||
- Restart IPv6 Firewall
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
# ===
|
||||||
# Add some Code Block.
|
# Add some Code Block.
|
||||||
# ===
|
# ===
|
||||||
@ -149,155 +152,6 @@
|
|||||||
- Restart IPv6 Firewall
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv4.conf
|
|
||||||
shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
register: lxc_guest_ips_interfaces_ipv4_present
|
|
||||||
when: interfaces_ipv4_exists.stat.exists
|
|
||||||
failed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 1"
|
|
||||||
changed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (lxc_guest_ips)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
insertafter: '^#?\s*local_3_ip'
|
|
||||||
block: |
|
|
||||||
local_ips="$local_1_ip $local_2_ip $local_3_ip"
|
|
||||||
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# --- IP-Addresses LXC Guest sSystems
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done
|
|
||||||
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_1_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_2_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_3_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_4_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_5_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_6_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_7_ip=""
|
|
||||||
|
|
||||||
lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)"
|
|
||||||
when:
|
|
||||||
- interfaces_ipv4_exists.stat.exists
|
|
||||||
- lxc_guest_ips_interfaces_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv6.conf
|
|
||||||
shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
register: lxc_guest_ips_interfaces_ipv6_present
|
|
||||||
when: interfaces_ipv6_exists.stat.exists
|
|
||||||
failed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 1"
|
|
||||||
changed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (lxc_guest_ips)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
insertafter: '^#?\s*local_3_ip'
|
|
||||||
block: |
|
|
||||||
local_ips="$local_1_ip $local_2_ip $local_3_ip"
|
|
||||||
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# --- IP-Addresses LXC Guest sSystems
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done
|
|
||||||
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_1_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_2_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_3_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_4_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_5_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_6_ip=""
|
|
||||||
# NOT IN USE
|
|
||||||
lxc_guest_7_ip=""
|
|
||||||
|
|
||||||
lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)"
|
|
||||||
when:
|
|
||||||
- interfaces_ipv6_exists.stat.exists
|
|
||||||
- lxc_guest_ips_interfaces_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'do_not_firewall_lx_guest_systems=..' is present
|
|
||||||
shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
register: wireguard_service_ipv4_present
|
|
||||||
when: main_ipv4_exists.stat.exists
|
|
||||||
failed_when: "wireguard_service_ipv4_present.rc > 1"
|
|
||||||
changed_when: "wireguard_service_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (do_not_firewall_lx_guest_systems)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
insertafter: '^#?\s*do_not_firewall_bridged_traffic'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# --- Do not firewall traffic from and to LX Gust Systems
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# - Traffic to hosted LX containers are not firewalled here.
|
|
||||||
# -
|
|
||||||
do_not_firewall_lx_guest_systems=false
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
|
||||||
when:
|
|
||||||
- main_ipv4_exists.stat.exists
|
|
||||||
- wireguard_service_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'do_not_firewall_lx_guest_systems=..' is present
|
|
||||||
shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
register: wireguard_service_ipv6_present
|
|
||||||
when: main_ipv6_exists.stat.exists
|
|
||||||
failed_when: "wireguard_service_ipv6_present.rc > 1"
|
|
||||||
changed_when: "wireguard_service_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (do_not_firewall_lx_guest_systems)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
insertafter: '^#?\s*do_not_firewall_bridged_traffic'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# --- Do not firewall traffic from and to LX Gust Systems
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# - Traffic to hosted LX containers are not firewalled here.
|
|
||||||
# -
|
|
||||||
do_not_firewall_lx_guest_systems=false
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
|
||||||
when:
|
|
||||||
- main_ipv6_exists.stat.exists
|
|
||||||
- wireguard_service_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# Mattermost (MM) Service (add a block)
|
# Mattermost (MM) Service (add a block)
|
||||||
# ---
|
# ---
|
||||||
@ -365,48 +219,6 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# Per IP Connection Limit (add a line)
|
|
||||||
# ---
|
|
||||||
|
|
||||||
- name: Check if String 'per_IP_connection_limit=..' is present
|
|
||||||
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
register: per_ip_connection_limit_settings_ipv4_present
|
|
||||||
when: main_ipv4_exists.stat.exists
|
|
||||||
failed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 1"
|
|
||||||
changed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
insertafter: '^#?\s*limit_connections_per_source_IP'
|
|
||||||
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
|
||||||
when:
|
|
||||||
- main_ipv4_exists.stat.exists
|
|
||||||
- per_ip_connection_limit_settings_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'per_IP_connection_limit=..' is present
|
|
||||||
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
register: per_ip_connection_limit_settings_ipv6_present
|
|
||||||
when: main_ipv6_exists.stat.exists
|
|
||||||
failed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 1"
|
|
||||||
changed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
insertafter: '^#?\s*limit_connections_per_source_IP'
|
|
||||||
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
|
||||||
when:
|
|
||||||
- main_ipv6_exists.stat.exists
|
|
||||||
- per_ip_connection_limit_settings_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
# ===
|
||||||
# Remove Marker set by blockinfile
|
# Remove Marker set by blockinfile
|
||||||
# ===
|
# ===
|
||||||
@ -449,6 +261,56 @@
|
|||||||
when:
|
when:
|
||||||
- interfaces_ipv6_exists.stat.exists
|
- interfaces_ipv6_exists.stat.exists
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Add Code Line.
|
||||||
|
# ===
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# Per IP Connection Limit (add a line)
|
||||||
|
# ---
|
||||||
|
|
||||||
|
- name: Check if String 'per_IP_connection_limit=..' is present
|
||||||
|
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
register: per_ip_connection_limit_settings_ipv4_present
|
||||||
|
when: main_ipv4_exists.stat.exists
|
||||||
|
failed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 1"
|
||||||
|
changed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
insertafter: '^#?\s*limit_connections_per_source_IP'
|
||||||
|
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
- per_ip_connection_limit_settings_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'per_IP_connection_limit=..' is present
|
||||||
|
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
register: per_ip_connection_limit_settings_ipv6_present
|
||||||
|
when: main_ipv6_exists.stat.exists
|
||||||
|
failed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 1"
|
||||||
|
changed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
insertafter: '^#?\s*limit_connections_per_source_IP'
|
||||||
|
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
- per_ip_connection_limit_settings_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
# ===
|
||||||
# Confiuration Files
|
# Confiuration Files
|
||||||
# ===
|
# ===
|
||||||
@ -490,6 +352,8 @@
|
|||||||
- Restart IPv4 Firewall
|
- Restart IPv4 Firewall
|
||||||
- Restart IPv6 Firewall
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
# ===
|
||||||
# Firewall scripts
|
# Firewall scripts
|
||||||
# ===
|
# ===
|
||||||
@ -521,3 +385,19 @@
|
|||||||
- Restart IPv4 Firewall
|
- Restart IPv4 Firewall
|
||||||
- Restart IPv6 Firewall
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Delete files that are no longer required
|
||||||
|
# ===
|
||||||
|
|
||||||
|
- name: Delete file '/etc/ipt-firewall/default_ports.conf' ..
|
||||||
|
file:
|
||||||
|
state: absent
|
||||||
|
path: /etc/ipt-firewall/default_ports.conf
|
||||||
|
|
||||||
|
- name: Delete file '/etc/ipt-firewall/ports.conf' ..
|
||||||
|
file:
|
||||||
|
state: absent
|
||||||
|
path: /etc/ipt-firewall/ports.conf
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user