From 3d6840ef3ad6df30fac5225e477c580e2602b6b2 Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 3 Nov 2026 00:50:03 +0100 Subject: [PATCH] Role ipt-server: allow IPv6-only overrides of shared variables; migrate nd, oolm-shop, web-01, web0. Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be overridden for IPv6 via _v6. extract-fw-host-vars.py emits these overrides when the IPv4 and IPv6 configs differ, instead of a warning. Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de and web0.warenform.de (fw_manage_config: true). Co-Authored-By: Claude Opus 5.5 --- extract-fw-host-vars.py | 35 ++- host_vars/nd.warenform.de/nd-ipt-server.yml | 43 ++++ .../oolm-shop-ipt-server.yml | 47 ++++ .../web-01.oopen.de/web-01-ipt-server.yml | 33 +++ .../web0.warenform.de/web0-ipt-server.yml | 33 +++ roles/ipt-server/README.md | 13 ++ .../etc/ipt-firewall/interfaces_ipv6.conf.j2 | 19 +- .../etc/ipt-firewall/main_ipv6.conf.j2 | 220 +++++++++--------- 8 files changed, 320 insertions(+), 123 deletions(-) create mode 100644 host_vars/nd.warenform.de/nd-ipt-server.yml create mode 100644 host_vars/oolm-shop.oopen.de/oolm-shop-ipt-server.yml create mode 100644 host_vars/web-01.oopen.de/web-01-ipt-server.yml create mode 100644 host_vars/web0.warenform.de/web0-ipt-server.yml diff --git a/extract-fw-host-vars.py b/extract-fw-host-vars.py index aa5f538..199fc3c 100755 --- a/extract-fw-host-vars.py +++ b/extract-fw-host-vars.py @@ -543,21 +543,33 @@ def build_host_vars(parsed_iface_v4, parsed_iface_v6, parsed_main_v4, parsed_mai if v and v != DEFAULTS.get(ansible_var, ""): result[ansible_var] = v + # IPv6 interface lists that differ from IPv4 -> fw_*_interfaces_v6 override + for prefix, ansible_var, v4_list in [("ext_if_", "fw_ext_interfaces", fw_ext_interfaces), + ("local_if_", "fw_local_interfaces", fw_local_interfaces)]: + v6_list = extract_list(parsed_iface_v6, prefix) + if v6_list != v4_list: + result[f"{ansible_var}_v6"] = v6_list + # --- Shared main variables (read from ipv4, fall back to ipv6) --- + # If IPv4 and IPv6 differ, the IPv6 value goes into _v6. + def to_value(raw): + raw = normalize_value(raw) + return coerce_bool(raw) if raw.lower() in ("true", "false") else raw + for bash_var, ansible_var in MAIN_SHARED.items(): raw_v4 = parsed_main_v4.get(bash_var) raw_v6 = parsed_main_v6.get(bash_var) - if raw_v4 is not None and raw_v6 is not None \ - and normalize_value(raw_v4) != normalize_value(raw_v6): - warnings.append(f" # {ansible_var}: IPv4 '{raw_v4}' != IPv6 '{raw_v6}' — IPv4 value used") raw = raw_v4 if raw_v4 is not None else raw_v6 if raw is None: continue - raw = normalize_value(raw) - v = coerce_bool(raw) if raw.lower() in ("true", "false") else raw + v = to_value(raw) default = DEFAULTS.get(ansible_var) if v != default: result[ansible_var] = v + if raw_v4 is not None and raw_v6 is not None: + v6 = to_value(raw_v6) + if v6 != v: + result[f"{ansible_var}_v6"] = v6 # --- IPv4-only main variables --- for bash_var, ansible_var in MAIN_V4_ONLY.items(): @@ -681,13 +693,20 @@ def render_yaml(hostname, host_vars, all_warnings): ("Special", ["fw_create_traffic_counter", "fw_create_iperf_rules"]), ] + # IPv6-only overrides of shared variables follow their base variable + sections = [(name, [x for k in keys for x in (k, f"{k}_v6") + if x == k or x not in keys]) + for name, keys in sections] + emitted = set() for section_name, keys in sections: section_lines = [] for k in keys: if k in host_vars: v = host_vars[k] - if isinstance(v, list): + if isinstance(v, list) and not v: + section_lines.append(f"{k}: []") + elif isinstance(v, list): section_lines.append(f"{k}:") for item in v: section_lines.append(f" - \"{item}\"") @@ -707,7 +726,9 @@ def render_yaml(hostname, host_vars, all_warnings): if remaining: lines.append("# --- Other") for k, v in remaining.items(): - if isinstance(v, list): + if isinstance(v, list) and not v: + lines.append(f"{k}: []") + elif isinstance(v, list): lines.append(f"{k}:") for item in v: lines.append(f" - \"{item}\"") diff --git a/host_vars/nd.warenform.de/nd-ipt-server.yml b/host_vars/nd.warenform.de/nd-ipt-server.yml new file mode 100644 index 0000000..7a8dbca --- /dev/null +++ b/host_vars/nd.warenform.de/nd-ipt-server.yml @@ -0,0 +1,43 @@ +--- +# ipt-firewall configuration for nd.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "eth0" + - "eth1" +fw_ext_ips_v4: + - "83.223.86.50" + - "83.223.86.53" +fw_ext_ips_v6: + - "2a01:30:0:13:2f4:75ff:fe1e:376f 2a01:30:0:505:2f4:75ff:fe1e:376f" + - "2a01:30:0:13:201:82ff:fedf:737a 2a01:30:0:505:201:82ff:fedf:737a" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "xkat.catalogue.librinet.de:8097:tcp wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip $ext_2_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- VPN / WireGuard +fw_wireguard_server_ips: $ext_ips + +# --- FTP +fw_ftp_server_ips: $ext_2_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 + +# --- Protection / limits +fw_per_IP_connection_limit: 501 +fw_limit_new_tcp_connections_per_seconds_per_source_IP: false diff --git a/host_vars/oolm-shop.oopen.de/oolm-shop-ipt-server.yml b/host_vars/oolm-shop.oopen.de/oolm-shop-ipt-server.yml new file mode 100644 index 0000000..40b10a8 --- /dev/null +++ b/host_vars/oolm-shop.oopen.de/oolm-shop-ipt-server.yml @@ -0,0 +1,47 @@ +--- +# ipt-firewall configuration for oolm-shop.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.124" +fw_ext_ips_v6: + - "2a01:30:0:505:263:20ff:feaa:7783 2a01:30:0:13:263:20ff:feaa:7783" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] +fw_local_ips_v4: + - "192.168.3.124" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Outgoing / interfaces +fw_unprotected_ifs: eth1 +fw_unprotected_ifs_v6: "" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 + +# --- Protection / limits +fw_limit_connections_per_source_IP: false +fw_limit_connections_per_source_IP_v6: true +fw_per_IP_connection_limit: 2048 +fw_per_IP_connection_limit_v6: 1024 +fw_limit_new_tcp_connections_per_seconds_per_source_IP: false +fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6: true diff --git a/host_vars/web-01.oopen.de/web-01-ipt-server.yml b/host_vars/web-01.oopen.de/web-01-ipt-server.yml new file mode 100644 index 0000000..765baa3 --- /dev/null +++ b/host_vars/web-01.oopen.de/web-01-ipt-server.yml @@ -0,0 +1,33 @@ +--- +# ipt-firewall configuration for web-01.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "162.55.82.78" +fw_ext_ips_v6: + - "2a01:4f8:271:1266::78" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_server_ips_v6: "" +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web0.warenform.de/web0-ipt-server.yml b/host_vars/web0.warenform.de/web0-ipt-server.yml new file mode 100644 index 0000000..480c587 --- /dev/null +++ b/host_vars/web0.warenform.de/web0-ipt-server.yml @@ -0,0 +1,33 @@ +--- +# ipt-firewall configuration for web0.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.85.164" +fw_ext_ips_v6: + - "2a01:30:0:13:286:96ff:fe4a:6eee 2a01:30:0:505:286:96ff:fe4a:6eee" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip +fw_set_max_new_http_conn_per_ip_per_second: false +fw_set_max_concurrent_http_conn_per_ip: false +fw_set_max_new_http_conn_per_second: false + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/roles/ipt-server/README.md b/roles/ipt-server/README.md index 99f195d..9d59b8b 100644 --- a/roles/ipt-server/README.md +++ b/roles/ipt-server/README.md @@ -158,6 +158,19 @@ fw_lxc_guest_ips_v6: - "fd00::11" ``` +### Abweichende Werte nur für IPv6 + +Variablen ohne `_v4`/`_v6`-Suffix gelten für beide Firewalls. Jede davon +lässt sich für IPv6 mit `_v6` überschreiben (ebenso +`fw_ext_interfaces_v6` / `fw_local_interfaces_v6`). `extract-fw-host-vars.py` +erzeugt diese Overrides automatisch, wenn IPv4- und IPv6-Konfiguration +voneinander abweichen. + +```yaml +fw_mail_server_ips: $ext_1_ip +fw_mail_server_ips_v6: "" # Mail-Ports nur über IPv4 +``` + --- ## Firewall-Skripte aktualisieren diff --git a/roles/ipt-server/templates/etc/ipt-firewall/interfaces_ipv6.conf.j2 b/roles/ipt-server/templates/etc/ipt-firewall/interfaces_ipv6.conf.j2 index f695a08..1b3806d 100644 --- a/roles/ipt-server/templates/etc/ipt-firewall/interfaces_ipv6.conf.j2 +++ b/roles/ipt-server/templates/etc/ipt-firewall/interfaces_ipv6.conf.j2 @@ -1,5 +1,8 @@ #!/usr/bin/env bash # {{ ansible_managed }} +{# IPv6 interface lists default to the IPv4 ones; override with fw_*_interfaces_v6. #} +{% set ext_interfaces_v6 = fw_ext_interfaces_v6 | default(fw_ext_interfaces) %} +{% set local_interfaces_v6 = fw_local_interfaces_v6 | default(fw_local_interfaces) %} # ------------- @@ -8,11 +11,11 @@ # - External interface(s) # -ext_if_1="{{ fw_ext_interfaces[0] if fw_ext_interfaces | length >= 1 else '' }}" -ext_if_2="{{ fw_ext_interfaces[1] if fw_ext_interfaces | length >= 2 else '' }}" -ext_if_3="{{ fw_ext_interfaces[2] if fw_ext_interfaces | length >= 3 else '' }}" +ext_if_1="{{ ext_interfaces_v6[0] if ext_interfaces_v6 | length >= 1 else '' }}" +ext_if_2="{{ ext_interfaces_v6[1] if ext_interfaces_v6 | length >= 2 else '' }}" +ext_if_3="{{ ext_interfaces_v6[2] if ext_interfaces_v6 | length >= 3 else '' }}" -ext_ifs="{{ fw_ext_interfaces | join(' ') }}" +ext_ifs="{{ ext_interfaces_v6 | join(' ') }}" # - VPN Interfaces @@ -26,11 +29,11 @@ wg_ifs="{{ fw_wg_ifs }}" # - Local Interfaces -local_if_1="{{ fw_local_interfaces[0] if fw_local_interfaces | length >= 1 else '' }}" -local_if_2="{{ fw_local_interfaces[1] if fw_local_interfaces | length >= 2 else '' }}" -local_if_3="{{ fw_local_interfaces[2] if fw_local_interfaces | length >= 3 else '' }}" +local_if_1="{{ local_interfaces_v6[0] if local_interfaces_v6 | length >= 1 else '' }}" +local_if_2="{{ local_interfaces_v6[1] if local_interfaces_v6 | length >= 2 else '' }}" +local_if_3="{{ local_interfaces_v6[2] if local_interfaces_v6 | length >= 3 else '' }}" -local_ifs="{{ fw_local_interfaces | join(' ') }}" +local_ifs="{{ local_interfaces_v6 | join(' ') }}" # ------------- diff --git a/roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2 b/roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2 index b885c27..3cf36c2 100644 --- a/roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2 +++ b/roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2 @@ -1,5 +1,9 @@ #!/usr/bin/env bash # {{ ansible_managed }} +{# + Variables shared between IPv4 and IPv6 can be overridden for IPv6 only + by defining _v6 (e.g. fw_mail_server_ips_v6: ""). +#} ## ---------------------------------------------------------------- @@ -11,32 +15,32 @@ # --- Bridged / LXC traffic # ------------- -do_not_firewall_bridged_traffic={{ fw_do_not_firewall_bridged_traffic | lower }} -do_not_firewall_lx_guest_systems={{ fw_do_not_firewall_lx_guest_systems | lower }} +do_not_firewall_bridged_traffic={{ (fw_do_not_firewall_bridged_traffic_v6 | default(fw_do_not_firewall_bridged_traffic)) | lower }} +do_not_firewall_lx_guest_systems={{ (fw_do_not_firewall_lx_guest_systems_v6 | default(fw_do_not_firewall_lx_guest_systems)) | lower }} # ------------- # --- Drop ICMP / MNDP / mDNS # ------------- -drop_icmp={{ fw_drop_icmp | lower }} -drop_mndp={{ fw_drop_mndp | lower }} -drop_mdns={{ fw_drop_mdns | lower }} +drop_icmp={{ (fw_drop_icmp_v6 | default(fw_drop_icmp)) | lower }} +drop_mndp={{ (fw_drop_mndp_v6 | default(fw_drop_mndp)) | lower }} +drop_mdns={{ (fw_drop_mdns_v6 | default(fw_drop_mdns)) | lower }} # ------------- # --- Outgoing traffic # ------------- -allow_all_outgoing_traffic={{ fw_allow_all_outgoing_traffic | lower }} +allow_all_outgoing_traffic={{ (fw_allow_all_outgoing_traffic_v6 | default(fw_allow_all_outgoing_traffic)) | lower }} # ------------- # --- Interface policy # ------------- -blocked_ifs="{{ fw_blocked_ifs }}" -unprotected_ifs="{{ fw_unprotected_ifs }}" +blocked_ifs="{{ (fw_blocked_ifs_v6 | default(fw_blocked_ifs)) }}" +unprotected_ifs="{{ (fw_unprotected_ifs_v6 | default(fw_unprotected_ifs)) }}" # ------------- @@ -75,34 +79,34 @@ allow_local_service_from_networks="{{ fw_allow_local_service_from_networks_v6 }} # --- Services: VPN / WireGuard # ------------- -vpn_server_ips="{{ fw_vpn_server_ips }}" -forward_vpn_server_ips="{{ fw_forward_vpn_server_ips }}" -vpn_ports="{{ fw_vpn_ports }}" +vpn_server_ips="{{ (fw_vpn_server_ips_v6 | default(fw_vpn_server_ips)) }}" +forward_vpn_server_ips="{{ (fw_forward_vpn_server_ips_v6 | default(fw_forward_vpn_server_ips)) }}" +vpn_ports="{{ (fw_vpn_ports_v6 | default(fw_vpn_ports)) }}" -wireguard_server_ips="{{ fw_wireguard_server_ips }}" -forward_wireguard_server_ips="{{ fw_forward_wireguard_server_ips }}" -wireguard_server_ports="{{ fw_wireguard_server_ports }}" -wireguard_out_ports="{{ fw_wireguard_out_ports }}" +wireguard_server_ips="{{ (fw_wireguard_server_ips_v6 | default(fw_wireguard_server_ips)) }}" +forward_wireguard_server_ips="{{ (fw_forward_wireguard_server_ips_v6 | default(fw_forward_wireguard_server_ips)) }}" +wireguard_server_ports="{{ (fw_wireguard_server_ports_v6 | default(fw_wireguard_server_ports)) }}" +wireguard_out_ports="{{ (fw_wireguard_out_ports_v6 | default(fw_wireguard_out_ports)) }}" # ------------- # --- Services: NTP # ------------- -local_ntp_service={{ fw_local_ntp_service | lower }} -ntp_port="{{ fw_ntp_port }}" -ntp_allowed_net="{{ fw_ntp_allowed_net }}" +local_ntp_service={{ (fw_local_ntp_service_v6 | default(fw_local_ntp_service)) | lower }} +ntp_port="{{ (fw_ntp_port_v6 | default(fw_ntp_port)) }}" +ntp_allowed_net="{{ (fw_ntp_allowed_net_v6 | default(fw_ntp_allowed_net)) }}" # ------------- # --- Services: DNS # ------------- -dns_server_ips="{{ fw_dns_server_ips }}" -forward_dns_server_ips="{{ fw_forward_dns_server_ips }}" +dns_server_ips="{{ (fw_dns_server_ips_v6 | default(fw_dns_server_ips)) }}" +forward_dns_server_ips="{{ (fw_forward_dns_server_ips_v6 | default(fw_forward_dns_server_ips)) }}" -local_resolver_service={{ fw_local_resolver_service | lower }} -resolver_port="{{ fw_resolver_port }}" +local_resolver_service={{ (fw_local_resolver_service_v6 | default(fw_local_resolver_service)) | lower }} +resolver_port="{{ (fw_resolver_port_v6 | default(fw_resolver_port)) }}" # resolver_allowed_networks="2001:678:a40:3000::/64" resolver_allowed_networks="{{ fw_resolver_allowed_networks_v6 }}" @@ -111,31 +115,31 @@ resolver_allowed_networks="{{ fw_resolver_allowed_networks_v6 }}" # --- Services: SSH # ------------- -ssh_server_ips="{{ fw_ssh_server_ips }}" -forward_ssh_server_ips="{{ fw_forward_ssh_server_ips }}" -ssh_ports="{{ fw_ssh_ports }}" +ssh_server_ips="{{ (fw_ssh_server_ips_v6 | default(fw_ssh_server_ips)) }}" +forward_ssh_server_ips="{{ (fw_forward_ssh_server_ips_v6 | default(fw_forward_ssh_server_ips)) }}" +ssh_ports="{{ (fw_ssh_ports_v6 | default(fw_ssh_ports)) }}" # ------------- # --- Services: HTTP(S) # ------------- -http_server_ips="{{ fw_http_server_ips }}" -forward_http_server_ips="{{ fw_forward_http_server_ips }}" -http_ports="{{ fw_http_ports }}" +http_server_ips="{{ (fw_http_server_ips_v6 | default(fw_http_server_ips)) }}" +forward_http_server_ips="{{ (fw_forward_http_server_ips_v6 | default(fw_forward_http_server_ips)) }}" +http_ports="{{ (fw_http_ports_v6 | default(fw_http_ports)) }}" -log_cgi_traffic_out={{ fw_log_cgi_traffic_out | lower }} -cgi_script_users="{{ fw_cgi_script_users }}" +log_cgi_traffic_out={{ (fw_log_cgi_traffic_out_v6 | default(fw_log_cgi_traffic_out)) | lower }} +cgi_script_users="{{ (fw_cgi_script_users_v6 | default(fw_cgi_script_users)) }}" # Restrictions on HTTP(S) connections to counteract attacks -set_max_new_http_conn_per_ip_per_second={{ fw_set_max_new_http_conn_per_ip_per_second | lower }} -max_http_new_conn_per_ip_per_second="{{ fw_max_http_new_conn_per_ip_per_second }}" +set_max_new_http_conn_per_ip_per_second={{ (fw_set_max_new_http_conn_per_ip_per_second_v6 | default(fw_set_max_new_http_conn_per_ip_per_second)) | lower }} +max_http_new_conn_per_ip_per_second="{{ (fw_max_http_new_conn_per_ip_per_second_v6 | default(fw_max_http_new_conn_per_ip_per_second)) }}" -set_max_concurrent_http_conn_per_ip={{ fw_set_max_concurrent_http_conn_per_ip | lower }} -max_concurrent_http_conn_per_ip="{{ fw_max_concurrent_http_conn_per_ip }}" +set_max_concurrent_http_conn_per_ip={{ (fw_set_max_concurrent_http_conn_per_ip_v6 | default(fw_set_max_concurrent_http_conn_per_ip)) | lower }} +max_concurrent_http_conn_per_ip="{{ (fw_max_concurrent_http_conn_per_ip_v6 | default(fw_max_concurrent_http_conn_per_ip)) }}" -set_max_new_http_conn_per_second={{ fw_set_max_new_http_conn_per_second | lower }} -max_new_http_conn_per_second="{{ fw_max_new_http_conn_per_second }}" +set_max_new_http_conn_per_second={{ (fw_set_max_new_http_conn_per_second_v6 | default(fw_set_max_new_http_conn_per_second)) | lower }} +max_new_http_conn_per_second="{{ (fw_max_new_http_conn_per_second_v6 | default(fw_max_new_http_conn_per_second)) }}" # Clamp the advertised MSS of incoming HTTPS SYN packets throttle_tcp6_mss_for_https={{ fw_throttle_tcp6_mss_for_https | lower }} @@ -146,31 +150,31 @@ tcp6_mss_for_https_val="{{ fw_tcp6_mss_for_https_val }}" # --- Services: Mattermost # ------------- -mm_server_ips="{{ fw_mm_server_ips }}" -forward_mm_server_ips="{{ fw_forward_mm_server_ips }}" -mm_udp_ports_in="{{ fw_mm_udp_ports_in }}" -mm_tcp_ports_in="{{ fw_mm_tcp_ports_in }}" -mm_udp_ports_out="{{ fw_mm_udp_ports_out }}" +mm_server_ips="{{ (fw_mm_server_ips_v6 | default(fw_mm_server_ips)) }}" +forward_mm_server_ips="{{ (fw_forward_mm_server_ips_v6 | default(fw_forward_mm_server_ips)) }}" +mm_udp_ports_in="{{ (fw_mm_udp_ports_in_v6 | default(fw_mm_udp_ports_in)) }}" +mm_tcp_ports_in="{{ (fw_mm_tcp_ports_in_v6 | default(fw_mm_tcp_ports_in)) }}" +mm_udp_ports_out="{{ (fw_mm_udp_ports_out_v6 | default(fw_mm_udp_ports_out)) }}" # ------------- # --- Services: Mail (SMTP / IMAP / POP) # ------------- -smtpd_ips="{{ fw_smtpd_ips }}" -forward_smtpd_ips="{{ fw_forward_smtpd_ips }}" -smtpd_additional_listen_ports="{{ fw_smtpd_additional_listen_ports }}" -smtpd_additional_outgoung_ports="{{ fw_smtpd_additional_outgoing_ports }}" +smtpd_ips="{{ (fw_smtpd_ips_v6 | default(fw_smtpd_ips)) }}" +forward_smtpd_ips="{{ (fw_forward_smtpd_ips_v6 | default(fw_forward_smtpd_ips)) }}" +smtpd_additional_listen_ports="{{ (fw_smtpd_additional_listen_ports_v6 | default(fw_smtpd_additional_listen_ports)) }}" +smtpd_additional_outgoung_ports="{{ (fw_smtpd_additional_outgoing_ports_v6 | default(fw_smtpd_additional_outgoing_ports)) }}" -mail_server_ips="{{ fw_mail_server_ips }}" -forward_mail_server_ips="{{ fw_forward_mail_server_ips }}" -mail_user_ports="{{ fw_mail_user_ports }}" +mail_server_ips="{{ (fw_mail_server_ips_v6 | default(fw_mail_server_ips)) }}" +forward_mail_server_ips="{{ (fw_forward_mail_server_ips_v6 | default(fw_forward_mail_server_ips)) }}" +mail_user_ports="{{ (fw_mail_user_ports_v6 | default(fw_mail_user_ports)) }}" -mail_client_ips="{{ fw_mail_client_ips }}" -forward_mail_client_ips="{{ fw_forward_mail_client_ips }}" +mail_client_ips="{{ (fw_mail_client_ips_v6 | default(fw_mail_client_ips)) }}" +forward_mail_client_ips="{{ (fw_forward_mail_client_ips_v6 | default(fw_forward_mail_client_ips)) }}" -dovecot_auth_service={{ fw_dovecot_auth_service | lower }} -dovecot_auth_port="{{ fw_dovecot_auth_port }}" +dovecot_auth_service={{ (fw_dovecot_auth_service_v6 | default(fw_dovecot_auth_service)) | lower }} +dovecot_auth_port="{{ (fw_dovecot_auth_port_v6 | default(fw_dovecot_auth_port)) }}" # dovecot_auth_allowed_networks="2001:678:a40:3000::/64 2a01:30:0:13:2f7:50ff:fed2:cef7" dovecot_auth_allowed_networks="{{ fw_dovecot_auth_allowed_networks_v6 }}" @@ -179,19 +183,19 @@ dovecot_auth_allowed_networks="{{ fw_dovecot_auth_allowed_networks_v6 }}" # --- Services: FTP # ------------- -ftp_server_ips="{{ fw_ftp_server_ips }}" -forward_ftp_server_ips="{{ fw_forward_ftp_server_ips }}" -ftp_passive_port_range="{{ fw_ftp_passive_port_range }}" +ftp_server_ips="{{ (fw_ftp_server_ips_v6 | default(fw_ftp_server_ips)) }}" +forward_ftp_server_ips="{{ (fw_forward_ftp_server_ips_v6 | default(fw_forward_ftp_server_ips)) }}" +ftp_passive_port_range="{{ (fw_ftp_passive_port_range_v6 | default(fw_ftp_passive_port_range)) }}" # ------------- # --- Services: XMPP (Jabber / Prosody) # ------------- -xmpp_server_ips="{{ fw_xmpp_server_ips }}" -forward_xmpp_server_ips="{{ fw_forward_xmpp_server_ips }}" -xmmp_tcp_in_ports="{{ fw_xmmp_tcp_in_ports }}" -xmmp_tcp_out_ports="{{ fw_xmmp_tcp_out_ports }}" +xmpp_server_ips="{{ (fw_xmpp_server_ips_v6 | default(fw_xmpp_server_ips)) }}" +forward_xmpp_server_ips="{{ (fw_forward_xmpp_server_ips_v6 | default(fw_forward_xmpp_server_ips)) }}" +xmmp_tcp_in_ports="{{ (fw_xmmp_tcp_in_ports_v6 | default(fw_xmmp_tcp_in_ports)) }}" +xmmp_tcp_out_ports="{{ (fw_xmmp_tcp_out_ports_v6 | default(fw_xmmp_tcp_out_ports)) }}" # xmmp_remote_out_services="2a01:4f8:221:3b4e::247,44444" xmmp_remote_out_services="{{ fw_xmmp_remote_out_services_v6 }}" @@ -200,31 +204,31 @@ xmmp_remote_out_services="{{ fw_xmmp_remote_out_services_v6 }}" # --- Services: Mumble # ------------- -mumble_server_ips="{{ fw_mumble_server_ips }}" -forward_mumble_server_ips="{{ fw_forward_mumble_server_ips }}" -mumble_ports="{{ fw_mumble_ports }}" +mumble_server_ips="{{ (fw_mumble_server_ips_v6 | default(fw_mumble_server_ips)) }}" +forward_mumble_server_ips="{{ (fw_forward_mumble_server_ips_v6 | default(fw_forward_mumble_server_ips)) }}" +mumble_ports="{{ (fw_mumble_ports_v6 | default(fw_mumble_ports)) }}" # ------------- # --- Services: Jitsi / Jibri # ------------- -jitsi_server_ips="{{ fw_jitsi_server_ips }}" -forward_jitsi_server_ips="{{ fw_forward_jitsi_server_ips }}" -jitsi_tcp_ports="{{ fw_jitsi_tcp_ports }}" -jitsi_udp_port_range="{{ fw_jitsi_udp_port_range }}" -jitsi_tcp_ports_out="{{ fw_jitsi_tcp_ports_out }}" -jitsi_udp_ports_out="{{ fw_jitsi_udp_ports_out }}" -jitsi_dovecot_auth={{ fw_jitsi_dovecot_auth | lower }} -jitsi_dovecot_host="{{ fw_jitsi_dovecot_host }}" +jitsi_server_ips="{{ (fw_jitsi_server_ips_v6 | default(fw_jitsi_server_ips)) }}" +forward_jitsi_server_ips="{{ (fw_forward_jitsi_server_ips_v6 | default(fw_forward_jitsi_server_ips)) }}" +jitsi_tcp_ports="{{ (fw_jitsi_tcp_ports_v6 | default(fw_jitsi_tcp_ports)) }}" +jitsi_udp_port_range="{{ (fw_jitsi_udp_port_range_v6 | default(fw_jitsi_udp_port_range)) }}" +jitsi_tcp_ports_out="{{ (fw_jitsi_tcp_ports_out_v6 | default(fw_jitsi_tcp_ports_out)) }}" +jitsi_udp_ports_out="{{ (fw_jitsi_udp_ports_out_v6 | default(fw_jitsi_udp_ports_out)) }}" +jitsi_dovecot_auth={{ (fw_jitsi_dovecot_auth_v6 | default(fw_jitsi_dovecot_auth)) | lower }} +jitsi_dovecot_host="{{ (fw_jitsi_dovecot_host_v6 | default(fw_jitsi_dovecot_host)) }}" jitsi_dovecot_port="{{ fw_jitsi_dovecot_port }}" -jitsi_jibri_remote_auth={{ fw_jitsi_jibri_remote_auth | lower }} -jitsi_jibri_remote_ips="{{ fw_jitsi_jibri_remote_ips }}" +jitsi_jibri_remote_auth={{ (fw_jitsi_jibri_remote_auth_v6 | default(fw_jitsi_jibri_remote_auth)) | lower }} +jitsi_jibri_remote_ips="{{ (fw_jitsi_jibri_remote_ips_v6 | default(fw_jitsi_jibri_remote_ips)) }}" jitsi_jibri_remote_auth_port="{{ fw_jitsi_jibri_remote_auth_port }}" -jibri_server_ips="{{ fw_jibri_server_ips }}" -forward_jibri_server_ips="{{ fw_forward_jibri_server_ips }}" -jibri_remote_jitsi_server="{{ fw_jibri_remote_jitsi_server }}" +jibri_server_ips="{{ (fw_jibri_server_ips_v6 | default(fw_jibri_server_ips)) }}" +forward_jibri_server_ips="{{ (fw_forward_jibri_server_ips_v6 | default(fw_forward_jibri_server_ips)) }}" +jibri_remote_jitsi_server="{{ (fw_jibri_remote_jitsi_server_v6 | default(fw_jibri_remote_jitsi_server)) }}" jibri_remote_auth_port="{{ fw_jibri_remote_auth_port }}" @@ -232,69 +236,69 @@ jibri_remote_auth_port="{{ fw_jibri_remote_auth_port }}" # --- Services: TURN / STUN (Nextcloud Talk) # ------------- -nc_turn_server_ips="{{ fw_nc_turn_server_ips }}" -forward_nc_turn_server_ips="{{ fw_forward_nc_turn_server_ips }}" -nc_turn_ports="{{ fw_nc_turn_ports }}" -nc_turn_udp_ports="{{ fw_nc_turn_udp_ports }}" +nc_turn_server_ips="{{ (fw_nc_turn_server_ips_v6 | default(fw_nc_turn_server_ips)) }}" +forward_nc_turn_server_ips="{{ (fw_forward_nc_turn_server_ips_v6 | default(fw_forward_nc_turn_server_ips)) }}" +nc_turn_ports="{{ (fw_nc_turn_ports_v6 | default(fw_nc_turn_ports)) }}" +nc_turn_udp_ports="{{ (fw_nc_turn_udp_ports_v6 | default(fw_nc_turn_udp_ports)) }}" # ------------- # --- Services: TFTP (not yet implemented) # ------------- -tftp_server_ips="{{ fw_tftp_server_ips }}" +tftp_server_ips="{{ (fw_tftp_server_ips_v6 | default(fw_tftp_server_ips)) }}" # ------------- # --- Services: Prometheus # ------------- -prometheus_local_server_ips="{{ fw_prometheus_local_server_ips }}" +prometheus_local_server_ips="{{ (fw_prometheus_local_server_ips_v6 | default(fw_prometheus_local_server_ips)) }}" prometheus_remote_client_ports="{{ fw_prometheus_remote_client_ports }}" -prometheus_local_client_ips="{{ fw_prometheus_local_client_ips }}" +prometheus_local_client_ips="{{ (fw_prometheus_local_client_ips_v6 | default(fw_prometheus_local_client_ips)) }}" prometheus_local_client_ports="{{ fw_prometheus_local_client_ports }}" -prometheus_remote_server_ips="{{ fw_prometheus_remote_server_ips }}" +prometheus_remote_server_ips="{{ (fw_prometheus_remote_server_ips_v6 | default(fw_prometheus_remote_server_ips)) }}" # ------------- # --- Services: Munin # ------------- -munin_server_ips="{{ fw_munin_server_ips }}" -forward_munin_server_ips="{{ fw_forward_munin_server_ips }}" -munin_remote_port="{{ fw_munin_remote_port }}" +munin_server_ips="{{ (fw_munin_server_ips_v6 | default(fw_munin_server_ips)) }}" +forward_munin_server_ips="{{ (fw_forward_munin_server_ips_v6 | default(fw_forward_munin_server_ips)) }}" +munin_remote_port="{{ (fw_munin_remote_port_v6 | default(fw_munin_remote_port)) }}" munin_remote_ip="{{ munin_remote_ipv6 }}" -munin_local_port="{{ fw_munin_local_port }}" +munin_local_port="{{ (fw_munin_local_port_v6 | default(fw_munin_local_port)) }}" # ------------- # --- Services: Xymon (not yet implemented) # ------------- -xymon_server_ips="{{ fw_xymon_server_ips }}" -local_xymon_client={{ fw_local_xymon_client | lower }} -xymon_port="{{ fw_xymon_port }}" +xymon_server_ips="{{ (fw_xymon_server_ips_v6 | default(fw_xymon_server_ips)) }}" +local_xymon_client={{ (fw_local_xymon_client_v6 | default(fw_local_xymon_client)) | lower }} +xymon_port="{{ (fw_xymon_port_v6 | default(fw_xymon_port)) }}" # ------------- # --- Protocols out: Rsync # ------------- -rsync_out_ips="{{ fw_rsync_out_ips }}" -forward_rsync_out_ips="{{ fw_forward_rsync_out_ips }}" -rsync_ports="{{ fw_rsync_ports }}" +rsync_out_ips="{{ (fw_rsync_out_ips_v6 | default(fw_rsync_out_ips)) }}" +forward_rsync_out_ips="{{ (fw_forward_rsync_out_ips_v6 | default(fw_forward_rsync_out_ips)) }}" +rsync_ports="{{ (fw_rsync_ports_v6 | default(fw_rsync_ports)) }}" # ------------- # --- Special ports (OUT) # ------------- -tcp_out_ports="{{ fw_tcp_out_ports }}" -forward_tcp_out_ports="{{ fw_forward_tcp_out_ports }}" -udp_out_ports="{{ fw_udp_out_ports }}" -forward_udp_out_ports="{{ fw_forward_udp_out_ports }}" +tcp_out_ports="{{ (fw_tcp_out_ports_v6 | default(fw_tcp_out_ports)) }}" +forward_tcp_out_ports="{{ (fw_forward_tcp_out_ports_v6 | default(fw_forward_tcp_out_ports)) }}" +udp_out_ports="{{ (fw_udp_out_ports_v6 | default(fw_udp_out_ports)) }}" +forward_udp_out_ports="{{ (fw_forward_udp_out_ports_v6 | default(fw_forward_udp_out_ports)) }}" # ============= @@ -315,36 +319,36 @@ blocked_ips="{{ fw_blocked_ips_v6 }}" # Prefix length for entries in ban_ipv6.list given without mask ban_ipv6_mask="{{ fw_ban_ipv6_mask }}" -block_tcp_ports="{{ fw_block_tcp_ports }}" -block_udp_ports="{{ fw_block_udp_ports }}" +block_tcp_ports="{{ (fw_block_tcp_ports_v6 | default(fw_block_tcp_ports)) }}" +block_udp_ports="{{ (fw_block_udp_ports_v6 | default(fw_block_udp_ports)) }}" # ------------- # --- Special / Counters # ------------- -create_traffic_counter={{ fw_create_traffic_counter | lower }} -create_iperf_rules={{ fw_create_iperf_rules | lower }} +create_traffic_counter={{ (fw_create_traffic_counter_v6 | default(fw_create_traffic_counter)) | lower }} +create_iperf_rules={{ (fw_create_iperf_rules_v6 | default(fw_create_iperf_rules)) | lower }} # ------------- # --- Protection # ------------- -protection_against_syn_flooding={{ fw_protection_against_syn_flooding | lower }} -protection_against_port_scanning={{ fw_protection_against_port_scanning | lower }} -protection_against_ssh_brute_force_attacks={{ fw_protection_against_ssh_brute_force_attacks | lower }} +protection_against_syn_flooding={{ (fw_protection_against_syn_flooding_v6 | default(fw_protection_against_syn_flooding)) | lower }} +protection_against_port_scanning={{ (fw_protection_against_port_scanning_v6 | default(fw_protection_against_port_scanning)) | lower }} +protection_against_ssh_brute_force_attacks={{ (fw_protection_against_ssh_brute_force_attacks_v6 | default(fw_protection_against_ssh_brute_force_attacks)) | lower }} # ------------- # --- Connection limits # ------------- -limit_connections_per_source_IP={{ fw_limit_connections_per_source_IP | lower }} -per_IP_connection_limit={{ fw_per_IP_connection_limit }} +limit_connections_per_source_IP={{ (fw_limit_connections_per_source_IP_v6 | default(fw_limit_connections_per_source_IP)) | lower }} +per_IP_connection_limit={{ (fw_per_IP_connection_limit_v6 | default(fw_per_IP_connection_limit)) }} -limit_new_tcp_connections_per_seconds_per_source_IP={{ fw_limit_new_tcp_connections_per_seconds_per_source_IP | lower }} -limit_new_tcp_connections_per_seconds_ports="{{ fw_limit_new_tcp_connections_per_seconds_ports }}" +limit_new_tcp_connections_per_seconds_per_source_IP={{ (fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6 | default(fw_limit_new_tcp_connections_per_seconds_per_source_IP)) | lower }} +limit_new_tcp_connections_per_seconds_ports="{{ (fw_limit_new_tcp_connections_per_seconds_ports_v6 | default(fw_limit_new_tcp_connections_per_seconds_ports)) }}" # -------------