update..

roles/modify-ipt-gateway/tasks/main.yml

@@ -108,6 +108,7 @@
   notify:
     - Restart IPv6 Firewall
 
+
 # ---
 # allow_ms_skype_teams_out
 # ---
@@ -355,6 +356,118 @@
     - alfaview_video_conference_out_ipv6_present is changed
 
 
+# ---
+# Remote VPN ports
+# ---
+
+- name: Check if String '# Remote VPN ports..' (IPv4) is present
+  shell: grep -q -E "^# Remote VPN ports" /etc/ipt-firewall/main_ipv4.conf
+  register: vpn_out_ports_ipv4_present
+  when: main_ipv4_exists.stat.exists
+  failed_when: "vpn_out_ports_ipv4_present.rc > 1"
+  changed_when: "vpn_out_ports_ipv4_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (Remote VPN ports)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv4.conf
+    insertafter: '^#?\s*vpn_local_net_ports'
+    block: |
+
+      # Remote VPN ports
+      #
+      vpn_out_ports="$standard_vpn_port"
+    marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
+  when: 
+    - main_ipv4_exists.stat.exists
+    - vpn_out_ports_ipv4_present is changed
+
+- name: Check if String '# Remote VPN ports..' (IPv6) is present
+  shell: grep -q -E "^# Remote VPN ports" /etc/ipt-firewall/main_ipv6.conf
+  register: vpn_out_ports_ipv6_present
+  when: main_ipv6_exists.stat.exists
+  failed_when: "vpn_out_ports_ipv6_present.rc > 1"
+  changed_when: "vpn_out_ports_ipv6_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (Remote VPN ports)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv6.conf
+    insertafter: '^#?\s*vpn_local_net_ports'
+    block: |
+
+      # Remote VPN ports
+      #
+      vpn_out_ports="$standard_vpn_port"
+    marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
+  when: 
+    - main_ipv6_exists.stat.exists
+    - vpn_out_ports_ipv6_present is changed
+  notify:
+    - Restart IPv6 Firewall
+
+
+# ---
+# u.a. Cisco VPN
+# ---
+
+- name: Check if String '# Remote WireGuard Ports..' (IPv4) is present
+  shell: grep -q -E "^# Remote WireGuard Ports" /etc/ipt-firewall/main_ipv4.conf
+  register: wg_out_ports_ipv4_present
+  when: main_ipv4_exists.stat.exists
+  failed_when: "wg_out_ports_ipv4_present.rc > 1"
+  changed_when: "wg_out_ports_ipv4_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (Cisco VPN)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv4.conf
+    insertafter: '^#?\s*wg_local_net_ports'
+    block: |
+      # Remote WireGuard Ports
+      #
+      wg_out_ports="$standard_wg_port"
+
+
+      # ======
+      # - Cisco VPN
+      # ======
+
+      cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+      cisco_vpn_out_protocol="esp"
+    marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
+  when: 
+    - main_ipv4_exists.stat.exists
+    - wg_out_ports_ipv4_present is changed
+
+- name: Check if String '# Remote WireGuard Ports..' (IPv6) is present
+  shell: grep -q -E "^# Remote WireGuard Ports" /etc/ipt-firewall/main_ipv6.conf
+  register: wg_out_ports_ipv6_present
+  when: main_ipv6_exists.stat.exists
+  failed_when: "wg_out_ports_ipv6_present.rc > 1"
+  changed_when: "wg_out_ports_ipv6_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (Cisco VPN)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv6.conf
+    insertafter: '^#?\s*wg_local_net_ports'
+    block: |
+      # Remote WireGuard Ports
+      #
+      wg_out_ports="$standard_wg_port"
+
+
+      # ======
+      # - Cisco VPN
+      # ======
+
+      cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+      cisco_vpn_out_protocol="esp"
+    marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
+  when: 
+    - main_ipv6_exists.stat.exists
+    - wg_out_ports_ipv6_present is changed
+  notify:
+    - Restart IPv6 Firewall
+
+
 # ---
 # WireGuard Service
 # ---
@@ -1381,6 +1494,9 @@
   when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
   loop:
      - default_ports.conf
+     - default_ipv4.conf
+     - default_ipv6.conf
+     - default_basic_behavior.conf
      - include_functions.conf
      - load_modules_ipv4.conf
      - load_modules_ipv6.conf
@@ -1393,6 +1509,9 @@
   command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
   loop:
      - default_ports.conf
+     - default_ipv4.conf
+     - default_ipv6.conf
+     - default_basic_behavior.conf
      - include_functions.conf
      - load_modules_ipv4.conf
      - load_modules_ipv6.conf