update..

2022-02-09 20:03:08 +01:00
parent a0208e6e78
commit 1b48684942
3 changed files with 238 additions and 8 deletions
--- a/15
+++ b/15
@@ -37,7 +37,6 @@ gw-irights.oopen.de
 gw-km.oopen.de
 gw-mbr.oopen.de
 gw-opp.oopen.de
-gw-ro.oopen.de
 gw-spr.oopen.de
 gw-kb.oopen.de

@@ -45,7 +44,6 @@ bbb-server.b3-bornim.netz

 gw-replacement.local.netz
 gw-replacement2.local.netz
-gw-replacement3.local.netz

 k1371.dyndns.org

@@ -79,6 +77,7 @@ cloud-giz.warenform.de
 nd.warenform.de
 nd-archiv.warenform.de
 nd-live.warenform.de
+nd-epaper.warenform.de

 #server23.warenform.de
 vvn-shop.warenform.de
@@ -210,7 +209,6 @@ gw-km.oopen.de
 gw-irights.oopen.de
 gw-mbr.oopen.de
 gw-opp.oopen.de
-gw-ro.oopen.de
 gw-km.oopen.de
 gw-spr.oopen.de

@@ -222,7 +220,6 @@ gw-ckubu.local.netz

 gw-replacement.local.netz
 gw-replacement2.local.netz
-gw-replacement3.local.netz

 k1371.dyndns.org

@@ -252,6 +249,7 @@ server22.warenform.de
 nd.warenform.de
 nd-archiv.warenform.de
 nd-live.warenform.de
+nd-epaper.warenform.de

 # server23
 server23.warenform.de
@@ -532,6 +530,7 @@ cloud-giz.warenform.de
 nd.warenform.de
 nd-archiv.warenform.de
 nd-live.warenform.de
+nd-epaper.warenform.de

 # server23
 vvn-shop.warenform.de
@@ -574,6 +573,7 @@ gw-ckubu.local.netz
 nd.warenform.de
 nd-archiv.warenform.de
 nd-live.warenform.de
+nd-epaper.warenform.de

 # server23
 vvn-shop.warenform.de
@@ -1009,6 +1009,7 @@ cloud-giz.warenform.de

 server22.warenform.de
 nd-live.warenform.de
+nd-epaper.warenform.de
 nd-archiv.warenform.de
 nd.warenform.de

@@ -1281,6 +1282,7 @@ cloud-giz.warenform.de
 nd.warenform.de
 nd-archiv.warenform.de
 nd-live.warenform.de
+nd-epaper.warenform.de

 # - server23
 dns0.warenform.de
@@ -1472,7 +1474,6 @@ gw-irights.oopen.de
 gw-km.oopen.de
 gw-mbr.oopen.de
 gw-opp.oopen.de
-gw-ro.oopen.de
 gw-spr.oopen.de

 gw-kb.oopen.de
@@ -1492,7 +1493,6 @@ gw-d11.oopen.de
 gw-flr.oopen.de
 gw-replacement.local.netz
 gw-replacement2.local.netz
-gw-replacement3.local.netz


 [gateway_server_ro]
@@ -1517,7 +1517,6 @@ gw-irights.oopen.de
 gw-km.oopen.de
 gw-mbr.oopen.de
 gw-opp.oopen.de
-gw-ro.oopen.de
 gw-spr.oopen.de

 gw-kb.oopen.de
@@ -1529,7 +1528,6 @@ ga-st-gw.oopen.de
 ga-al-gw.oopen.de
 ga-nh-gw.oopen.de

-gw-replacement3.local.netz


 [warenform_server]
@@ -1551,6 +1549,7 @@ server22.warenform.de
 nd.warenform.de
 nd-archiv.warenform.de
 nd-live.warenform.de
+nd-epaper.warenform.de

 # - server23
 server23.warenform.de
--- a/roles/modify-ipt-gateway-ro/tasks/main.yml
+++ b/roles/modify-ipt-gateway-ro/tasks/main.yml
@@ -295,6 +295,112 @@
    - alfaview_video_conference_out_ipv6_present is changed


+# ---
+# Remote VPN ports
+# ---
+
+- name: Check if String '# Remote VPN ports..' (IPv4) is present
+  shell: grep -q -E "^# Remote VPN ports=" /ro/etc/ipt-firewall/main_ipv4.conf
+  register: vpn_out_ports_ipv4_present
+  when: main_ipv4_exists.stat.exists
+  failed_when: "vpn_out_ports_ipv4_present.rc > 1"
+  changed_when: "vpn_out_ports_ipv4_present.rc > 0"
+
+- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (Remote VPN ports)
+  blockinfile:
+    path: /ro/etc/ipt-firewall/main_ipv4.conf
+    insertafter: '^#?\s*vpn_local_net_ports'
+    block: |
+      # Remote VPN ports
+      #
+      vpn_out_ports="$standard_vpn_port"
+    marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
+  when: 
+    - main_ipv4_exists.stat.exists
+    - vpn_out_ports_ipv4_present is changed
+
+- name: Check if String '# Remote VPN ports..' (IPv6) is present
+  shell: grep -q -E "^# Remote VPN ports=" /ro/etc/ipt-firewall/main_ipv6.conf
+  register: vpn_out_ports_ipv6_present
+  when: main_ipv6_exists.stat.exists
+  failed_when: "vpn_out_ports_ipv6_present.rc > 1"
+  changed_when: "vpn_out_ports_ipv6_present.rc > 0"
+
+- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (Remote VPN ports)
+  blockinfile:
+    path: /ro/etc/ipt-firewall/main_ipv6.conf
+    insertafter: '^#?\s*vpn_local_net_ports'
+    block: |
+      # Remote VPN ports
+      #
+      vpn_out_ports="$standard_vpn_port"
+    marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
+  when: 
+    - main_ipv6_exists.stat.exists
+    - vpn_out_ports_ipv6_present is changed
+
+
+# ---
+# u.a. Cisco VPN
+# ---
+
+- name: Check if String '# Remote WireGuard Ports..' (IPv4) is present
+  shell: grep -q -E "^# Remote WireGuard Ports" /ro/etc/ipt-firewall/main_ipv4.conf
+  register: wg_out_ports_ipv4_present
+  when: main_ipv4_exists.stat.exists
+  failed_when: "wg_out_ports_ipv4_present.rc > 1"
+  changed_when: "wg_out_ports_ipv4_present.rc > 0"
+
+- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (Cisco VPN)
+  blockinfile:
+    path: /ro/etc/ipt-firewall/main_ipv4.conf
+    insertafter: '^#?\s*wg_local_net_ports'
+    block: |
+      # Remote WireGuard Ports
+      #
+      wg_out_ports="$standard_wg_port"
+
+
+      # ======
+      # - Cisco VPN
+      # ======
+
+      cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+      cisco_vpn_out_protocol="esp"
+    marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
+  when: 
+    - main_ipv4_exists.stat.exists
+    - wg_out_ports_ipv4_present is changed
+
+- name: Check if String '# Remote WireGuard Ports..' (IPv6) is present
+  shell: grep -q -E "^# Remote WireGuard Ports" /ro/etc/ipt-firewall/main_ipv6.conf
+  register: wg_out_ports_ipv6_present
+  when: main_ipv6_exists.stat.exists
+  failed_when: "wg_out_ports_ipv6_present.rc > 1"
+  changed_when: "wg_out_ports_ipv6_present.rc > 0"
+
+- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (Cisco VPN)
+  blockinfile:
+    path: /ro/etc/ipt-firewall/main_ipv6.conf
+    insertafter: '^#?\s*wg_local_net_ports'
+    block: |
+      # Remote WireGuard Ports
+      #
+      wg_out_ports="$standard_wg_port"
+
+
+      # ======
+      # - Cisco VPN
+      # ======
+
+      cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+      cisco_vpn_out_protocol="esp"
+    marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
+  when: 
+    - main_ipv6_exists.stat.exists
+    - wg_out_ports_ipv6_present is changed
+
+
 # ---
 # WireGuard Service
 # ---
@@ -1244,6 +1350,9 @@
  when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
  loop:
     - default_ports.conf
+     - default_ipv4.conf
+     - default_ipv6.conf
+     - default_basic_behavior.conf
     - include_functions.conf
     - load_modules_ipv4.conf
     - load_modules_ipv6.conf
@@ -1256,6 +1365,9 @@
  command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }}
  loop:
     - default_ports.conf
+     - default_ipv4.conf
+     - default_ipv6.conf
+     - default_basic_behavior.conf
     - include_functions.conf
     - load_modules_ipv4.conf
     - load_modules_ipv6.conf
--- a/roles/modify-ipt-gateway/tasks/main.yml
+++ b/roles/modify-ipt-gateway/tasks/main.yml
@@ -108,6 +108,7 @@
  notify:
    - Restart IPv6 Firewall

+
 # ---
 # allow_ms_skype_teams_out
 # ---
@@ -355,6 +356,118 @@
    - alfaview_video_conference_out_ipv6_present is changed


+# ---
+# Remote VPN ports
+# ---
+
+- name: Check if String '# Remote VPN ports..' (IPv4) is present
+  shell: grep -q -E "^# Remote VPN ports" /etc/ipt-firewall/main_ipv4.conf
+  register: vpn_out_ports_ipv4_present
+  when: main_ipv4_exists.stat.exists
+  failed_when: "vpn_out_ports_ipv4_present.rc > 1"
+  changed_when: "vpn_out_ports_ipv4_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (Remote VPN ports)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv4.conf
+    insertafter: '^#?\s*vpn_local_net_ports'
+    block: |
+
+      # Remote VPN ports
+      #
+      vpn_out_ports="$standard_vpn_port"
+    marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
+  when: 
+    - main_ipv4_exists.stat.exists
+    - vpn_out_ports_ipv4_present is changed
+
+- name: Check if String '# Remote VPN ports..' (IPv6) is present
+  shell: grep -q -E "^# Remote VPN ports" /etc/ipt-firewall/main_ipv6.conf
+  register: vpn_out_ports_ipv6_present
+  when: main_ipv6_exists.stat.exists
+  failed_when: "vpn_out_ports_ipv6_present.rc > 1"
+  changed_when: "vpn_out_ports_ipv6_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (Remote VPN ports)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv6.conf
+    insertafter: '^#?\s*vpn_local_net_ports'
+    block: |
+
+      # Remote VPN ports
+      #
+      vpn_out_ports="$standard_vpn_port"
+    marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
+  when: 
+    - main_ipv6_exists.stat.exists
+    - vpn_out_ports_ipv6_present is changed
+  notify:
+    - Restart IPv6 Firewall
+
+
+# ---
+# u.a. Cisco VPN
+# ---
+
+- name: Check if String '# Remote WireGuard Ports..' (IPv4) is present
+  shell: grep -q -E "^# Remote WireGuard Ports" /etc/ipt-firewall/main_ipv4.conf
+  register: wg_out_ports_ipv4_present
+  when: main_ipv4_exists.stat.exists
+  failed_when: "wg_out_ports_ipv4_present.rc > 1"
+  changed_when: "wg_out_ports_ipv4_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (Cisco VPN)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv4.conf
+    insertafter: '^#?\s*wg_local_net_ports'
+    block: |
+      # Remote WireGuard Ports
+      #
+      wg_out_ports="$standard_wg_port"
+
+
+      # ======
+      # - Cisco VPN
+      # ======
+
+      cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+      cisco_vpn_out_protocol="esp"
+    marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
+  when: 
+    - main_ipv4_exists.stat.exists
+    - wg_out_ports_ipv4_present is changed
+
+- name: Check if String '# Remote WireGuard Ports..' (IPv6) is present
+  shell: grep -q -E "^# Remote WireGuard Ports" /etc/ipt-firewall/main_ipv6.conf
+  register: wg_out_ports_ipv6_present
+  when: main_ipv6_exists.stat.exists
+  failed_when: "wg_out_ports_ipv6_present.rc > 1"
+  changed_when: "wg_out_ports_ipv6_present.rc > 0"
+
+- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (Cisco VPN)
+  blockinfile:
+    path: /etc/ipt-firewall/main_ipv6.conf
+    insertafter: '^#?\s*wg_local_net_ports'
+    block: |
+      # Remote WireGuard Ports
+      #
+      wg_out_ports="$standard_wg_port"
+
+
+      # ======
+      # - Cisco VPN
+      # ======
+
+      cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+      cisco_vpn_out_protocol="esp"
+    marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
+  when: 
+    - main_ipv6_exists.stat.exists
+    - wg_out_ports_ipv6_present is changed
+  notify:
+    - Restart IPv6 Firewall
+
+
 # ---
 # WireGuard Service
 # ---
@@ -1381,6 +1494,9 @@
  when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
  loop:
     - default_ports.conf
+     - default_ipv4.conf
+     - default_ipv6.conf
+     - default_basic_behavior.conf
     - include_functions.conf
     - load_modules_ipv4.conf
     - load_modules_ipv6.conf
@@ -1393,6 +1509,9 @@
  command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
  loop:
     - default_ports.conf
+     - default_ipv4.conf
+     - default_ipv6.conf
+     - default_basic_behavior.conf
     - include_functions.conf
     - load_modules_ipv4.conf
     - load_modules_ipv6.conf