update..
This commit is contained in:
@ -132,190 +132,61 @@
|
||||
- Restart IPv4 Firewall
|
||||
|
||||
|
||||
# ===
|
||||
# Add some Code Block.
|
||||
# ===
|
||||
|
||||
|
||||
# ---
|
||||
# FreeIPA Service
|
||||
# Add additional SMTP ports OUT
|
||||
# ---
|
||||
|
||||
- name: Check if String 'freeipa_udp_in_ports..' (IPv4) is present
|
||||
shell: grep -q -E "^#?freeipa_udp_in_ports=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: freeipa_udp_in_ports_ipv4_present
|
||||
- name: Check if String 'smtpd_additional_outgoung_ports..' (IPv4) is present
|
||||
shell: grep -q -E "^#?smtpd_additional_outgoung_ports=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: smtpd_additional_outgoung_ports_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "freeipa_udp_in_ports_ipv4_present.rc > 1"
|
||||
changed_when: "freeipa_udp_in_ports_ipv4_present.rc > 0"
|
||||
failed_when: "smtpd_additional_outgoung_ports_ipv4_present.rc > 1"
|
||||
changed_when: "smtpd_additional_outgoung_ports_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (FreeIPA Service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*snmp_trap_port'
|
||||
insertafter: '^#?\s*mail_user_ports'
|
||||
block: |
|
||||
|
||||
# ======
|
||||
# - FreeIPA Service
|
||||
# ======
|
||||
|
||||
# - FreeIPA services local Networks
|
||||
# -
|
||||
freeipa_server_ips=""
|
||||
|
||||
# - FreeIPA (in) Ports
|
||||
# -
|
||||
freeipa_tcp_in_ports="$standard_freeipa_tcp_in_ports"
|
||||
freeipa_udp_in_ports="$standard_freeipa_udp_in_ports"
|
||||
# Additional Ports for outgoing smtp traffic
|
||||
#
|
||||
# blank separated list of ports
|
||||
#
|
||||
smtpd_additional_outgoung_ports=""
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (FreeIPA Service)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- freeipa_udp_in_ports_ipv4_present is changed
|
||||
- smtpd_additional_outgoung_ports_ipv4_present is changed
|
||||
|
||||
|
||||
- name: Check if String 'freeipa_udp_in_ports..' (IPv6) is present
|
||||
shell: grep -q -E "^#?freeipa_udp_in_ports=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: freeipa_udp_in_ports_ipv6_present
|
||||
- name: Check if String 'smtpd_additional_outgoung_ports..' (IPv6) is present
|
||||
shell: grep -q -E "^#?smtpd_additional_outgoung_ports=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: smtpd_additional_outgoung_ports_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "freeipa_udp_in_ports_ipv6_present.rc > 1"
|
||||
changed_when: "freeipa_udp_in_ports_ipv6_present.rc > 0"
|
||||
failed_when: "smtpd_additional_outgoung_ports_ipv6_present.rc > 1"
|
||||
changed_when: "smtpd_additional_outgoung_ports_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (FreeIPA Service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*vpn_out_ports='
|
||||
insertafter: '^#?\s*mail_user_ports='
|
||||
block: |
|
||||
|
||||
# ======
|
||||
# - FreeIPA Service
|
||||
# ======
|
||||
|
||||
# - FreeIPA services local Networks
|
||||
# -
|
||||
freeipa_server_ips=""
|
||||
|
||||
# - FreeIPA (in) Ports
|
||||
# -
|
||||
freeipa_tcp_in_ports="$standard_freeipa_tcp_in_ports"
|
||||
freeipa_udp_in_ports="$standard_freeipa_udp_in_ports"
|
||||
# Additional Ports for outgoing smtp traffic
|
||||
#
|
||||
# blank separated list of ports
|
||||
#
|
||||
smtpd_additional_outgoung_ports=""
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (FreeIPA Service)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- freeipa_udp_in_ports_ipv6_present is changed
|
||||
|
||||
|
||||
# ---
|
||||
# Restrict VPN Networks
|
||||
# ---
|
||||
|
||||
- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv4) is present
|
||||
shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: restrict_vpn_net_to_local_service_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 1"
|
||||
changed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (restrict_vpn_net_to_local_service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*vpn_out_ports='
|
||||
block: |
|
||||
|
||||
# -----
|
||||
# - Restrict VPN Network to local Service
|
||||
# -----#
|
||||
|
||||
# - restrict_vpn_net_to_local_service
|
||||
# -
|
||||
# - allow_ext_net_to_local_service="vpn-net:local-address:port:protocol [vpn-net:local-address:port:protocol] [..]"
|
||||
# -
|
||||
# - Note:
|
||||
# - =====
|
||||
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
|
||||
# -
|
||||
# - Example:
|
||||
# - restrict_vpn_net_to_local_service="
|
||||
# - 10.100.112.0/24:192.168.112.192/27:80:tcp
|
||||
# - 10.100.112.0/24:192.168.112.192/27:443:tcp
|
||||
# - "
|
||||
# -
|
||||
# - Blank separated list
|
||||
# -
|
||||
restrict_vpn_net_to_local_service=""
|
||||
|
||||
|
||||
# -----
|
||||
# - Restrict VPN Network to local (Sub) network
|
||||
# -----
|
||||
|
||||
# - restrict_vpn_net_to_local_subnet
|
||||
# -
|
||||
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>:<dst-local-net> [<src-vpn-net>:<dst-local-net>} [..]
|
||||
# -
|
||||
# - Example:
|
||||
# - restrict_vpn_net_to_local_subnet="
|
||||
# - 10.100.112.0/24:192.168.112.192/27
|
||||
# - "
|
||||
# -
|
||||
# - Blank separated list
|
||||
# -
|
||||
restrict_vpn_net_to_local_subnet=""
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- restrict_vpn_net_to_local_service_ipv4_present is changed
|
||||
|
||||
|
||||
- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv6) is present
|
||||
shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: restrict_vpn_net_to_local_service_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 1"
|
||||
changed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (restrict_vpn_net_to_local_service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*vpn_out_ports='
|
||||
block: |
|
||||
|
||||
# -----
|
||||
# - Restrict VPN Network to local Service
|
||||
# -----#
|
||||
|
||||
# - restrict_vpn_net_to_local_service
|
||||
# -
|
||||
# - allow_ext_net_to_local_service="vpn-net,local-address,port,protocol [vpn-net,local-address,port,protocol] [..]"
|
||||
# -
|
||||
# - Note:
|
||||
# - =====
|
||||
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
|
||||
# -
|
||||
# - Example:
|
||||
# - restrict_vpn_net_to_local_service="
|
||||
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,80,tcp
|
||||
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,443,tcp
|
||||
# - "
|
||||
# -
|
||||
# - Blank separated list
|
||||
# -
|
||||
restrict_vpn_net_to_local_service=""
|
||||
|
||||
|
||||
# -----
|
||||
# - Restrict VPN Network to local (Sub) network
|
||||
# -----
|
||||
|
||||
# - restrict_vpn_net_to_local_subnet
|
||||
# -
|
||||
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>,<dst-local-net> [<src-vpn-net>,<dst-local-net>} [..]
|
||||
# -
|
||||
# - Example:
|
||||
# - restrict_vpn_net_to_local_subnet="
|
||||
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64
|
||||
# - "
|
||||
# -
|
||||
# - Blank separated list
|
||||
# -
|
||||
restrict_vpn_net_to_local_subnet=""
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- restrict_vpn_net_to_local_service_ipv6_present is changed
|
||||
- smtpd_additional_outgoung_ports_ipv6_present is changed
|
||||
|
||||
|
||||
# ---
|
||||
|
||||
@ -99,103 +99,67 @@
|
||||
# ===
|
||||
|
||||
# ---
|
||||
# Add Prometheus Services
|
||||
# Add additional SMTP ports (OUT and IN)
|
||||
# ---
|
||||
|
||||
- name: Check if String 'prometheus_local_server_ips=..' is present
|
||||
shell: grep -q -E "^prometheus_local_server_ips=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: prometheus_local_server_ips_ipv4_present
|
||||
- name: Check if String 'smtpd_additional_listen_ports=..' is present
|
||||
shell: grep -q -E "^smtpd_additional_listen_ports=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: smtpd_additional_listen_ports_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "prometheus_local_server_ips_ipv4_present.rc > 1"
|
||||
changed_when: "prometheus_local_server_ips_ipv4_present.rc > 0"
|
||||
failed_when: "smtpd_additional_listen_ports_ipv4_present.rc > 1"
|
||||
changed_when: "smtpd_additional_listen_ports_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (prometheus_local_server_ips)
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (smtpd_additional_listen_ports)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*tftp_server_ips'
|
||||
insertafter: '^#?\s*forward_smtpd_ips'
|
||||
block: |
|
||||
# Additional Ports on which SMTP Service should lsiten
|
||||
#
|
||||
# blank separated list of ports
|
||||
#
|
||||
smtpd_additional_listen_ports=""
|
||||
|
||||
# - Prometheus Monitoring - local Server
|
||||
# -
|
||||
# - blank separated list of IPv4 addresses
|
||||
# -
|
||||
prometheus_local_server_ips=""
|
||||
|
||||
# - (Remote) prometheus ports
|
||||
# -
|
||||
# - !! comma separated list of ports
|
||||
# -
|
||||
prometheus_remote_client_ports="$standard_prometheus_ports"
|
||||
|
||||
|
||||
# - Prometheus Monitoring - local Client
|
||||
# -
|
||||
# - blank separated list of IPv4 addresses
|
||||
# -
|
||||
prometheus_local_client_ips=""
|
||||
|
||||
# - Local prometheus ports
|
||||
# -
|
||||
# - !! comma separated list of ports
|
||||
# -
|
||||
prometheus_local_client_ports="$standard_prometheus_ports"
|
||||
|
||||
# - blank separated list of IPv4 addresses
|
||||
# -
|
||||
prometheus_remote_server_ips=""
|
||||
marker: "# Marker set by modify-ipt-server.yml (prometheus_local_server_ips)"
|
||||
# Additional Ports for outgoing smtp traffic
|
||||
#
|
||||
# blank separated list of ports
|
||||
#
|
||||
smtpd_additional_outgoung_ports=""
|
||||
marker: "# Marker set by modify-ipt-server.yml (smtpd_additional_listen_ports)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- prometheus_local_server_ips_ipv4_present is changed
|
||||
- smtpd_additional_listen_ports_ipv4_present is changed
|
||||
notify:
|
||||
- Restart IPv4 Firewall
|
||||
|
||||
|
||||
- name: Check if String 'prometheus_local_server_ips=..' is present
|
||||
shell: grep -q -E "^prometheus_local_server_ips=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: prometheus_local_server_ips_ipv6_present
|
||||
- name: Check if String 'smtpd_additional_listen_ports=..' is present
|
||||
shell: grep -q -E "^smtpd_additional_listen_ports=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: smtpd_additional_listen_ports_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "prometheus_local_server_ips_ipv6_present.rc > 1"
|
||||
changed_when: "prometheus_local_server_ips_ipv6_present.rc > 0"
|
||||
failed_when: "smtpd_additional_listen_ports_ipv6_present.rc > 1"
|
||||
changed_when: "smtpd_additional_listen_ports_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (prometheus_local_server_ips)
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (smtpd_additional_listen_ports)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*tftp_server_ips'
|
||||
insertafter: '^#?\s*forward_smtpd_ips'
|
||||
block: |
|
||||
# Additional Ports on which SMTP Service should lsiten
|
||||
#
|
||||
# blank separated list of ports
|
||||
#
|
||||
smtpd_additional_listen_ports=""
|
||||
|
||||
# - Prometheus Monitoring - local Server
|
||||
# -
|
||||
# - blank separated list of IPv6 addresses
|
||||
# -
|
||||
prometheus_local_server_ips=""
|
||||
|
||||
# - (Remote) prometheus ports
|
||||
# -
|
||||
# - !! comma separated list of ports
|
||||
# -
|
||||
prometheus_remote_client_ports="$standard_prometheus_ports"
|
||||
|
||||
|
||||
# - Prometheus Monitoring - local Client
|
||||
# -
|
||||
# - blank separated list of IPv6 addresses
|
||||
# -
|
||||
prometheus_local_client_ips=""
|
||||
|
||||
# - Local prometheus ports
|
||||
# -
|
||||
# - !! comma separated list of ports
|
||||
# -
|
||||
prometheus_local_client_ports="$standard_prometheus_ports"
|
||||
|
||||
# - blank separated list of IPv6 addresses
|
||||
# -
|
||||
prometheus_remote_server_ips=""
|
||||
marker: "# Marker set by modify-ipt-server.yml (prometheus_local_server_ips)"
|
||||
# Additional Ports for outgoing smtp traffic
|
||||
#
|
||||
# blank separated list of ports
|
||||
#
|
||||
smtpd_additional_outgoung_ports=""
|
||||
marker: "# Marker set by modify-ipt-server.yml (smtpd_additional_listen_ports)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- prometheus_local_server_ips_ipv6_present is changed
|
||||
- smtpd_additional_listen_ports_ipv6_present is changed
|
||||
notify:
|
||||
- Restart IPv6 Firewall
|
||||
|
||||
|
||||
Reference in New Issue
Block a user