ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Role ipt-server: allow IPv6-only overrides of shared variables; migrate nd, oolm-shop, web-01, web0.

Browse Source 
Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be
overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these
overrides when the IPv4 and IPv6 configs differ, instead of a warning.

Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de
and web0.warenform.de (fw_manage_config: true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-03 00:50:03 +01:00
co-authored by Claude Opus 5.5
parent fe2e749b63
commit 3d6840ef3a
8 changed files with 320 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/ipt-server/templates/etc/ipt-firewall/interfaces_ipv6.conf.j2
+11 -8
View File
@@ -1,5 +1,8 @@
#!/usr/bin/env bash
# {{ ansible_managed }}
{# IPv6 interface lists default to the IPv4 ones; override with fw_*_interfaces_v6. #}
{% set ext_interfaces_v6 = fw_ext_interfaces_v6 | default(fw_ext_interfaces) %}
{% set local_interfaces_v6 = fw_local_interfaces_v6 | default(fw_local_interfaces) %}
# -------------
@@ -8,11 +11,11 @@
# - External interface(s)
#
ext_if_1="{{ fw_ext_interfaces[0] if fw_ext_interfaces | length >= 1 else '' }}"
ext_if_2="{{ fw_ext_interfaces[1] if fw_ext_interfaces | length >= 2 else '' }}"
ext_if_3="{{ fw_ext_interfaces[2] if fw_ext_interfaces | length >= 3 else '' }}"
ext_if_1="{{ ext_interfaces_v6[0] if ext_interfaces_v6 | length >= 1 else '' }}"
ext_if_2="{{ ext_interfaces_v6[1] if ext_interfaces_v6 | length >= 2 else '' }}"
ext_if_3="{{ ext_interfaces_v6[2] if ext_interfaces_v6 | length >= 3 else '' }}"
ext_ifs="{{ fw_ext_interfaces | join(' ') }}"
ext_ifs="{{ ext_interfaces_v6 | join(' ') }}"
# - VPN Interfaces
@@ -26,11 +29,11 @@ wg_ifs="{{ fw_wg_ifs }}"
# - Local Interfaces
local_if_1="{{ fw_local_interfaces[0] if fw_local_interfaces | length >= 1 else '' }}"
local_if_2="{{ fw_local_interfaces[1] if fw_local_interfaces | length >= 2 else '' }}"
local_if_3="{{ fw_local_interfaces[2] if fw_local_interfaces | length >= 3 else '' }}"
local_if_1="{{ local_interfaces_v6[0] if local_interfaces_v6 | length >= 1 else '' }}"
local_if_2="{{ local_interfaces_v6[1] if local_interfaces_v6 | length >= 2 else '' }}"
local_if_3="{{ local_interfaces_v6[2] if local_interfaces_v6 | length >= 3 else '' }}"
local_ifs="{{ fw_local_interfaces | join(' ') }}"
local_ifs="{{ local_interfaces_v6 | join(' ') }}"
# -------------
roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2
+112 -108
View File
@@ -1,5 +1,9 @@
#!/usr/bin/env bash
# {{ ansible_managed }}
{#
Variables shared between IPv4 and IPv6 can be overridden for IPv6 only
by defining <name>_v6 (e.g. fw_mail_server_ips_v6: "").
#}
## ----------------------------------------------------------------
@@ -11,32 +15,32 @@
# --- Bridged / LXC traffic
# -------------
do_not_firewall_bridged_traffic={{ fw_do_not_firewall_bridged_traffic | lower }}
do_not_firewall_lx_guest_systems={{ fw_do_not_firewall_lx_guest_systems | lower }}
do_not_firewall_bridged_traffic={{ (fw_do_not_firewall_bridged_traffic_v6 | default(fw_do_not_firewall_bridged_traffic)) | lower }}
do_not_firewall_lx_guest_systems={{ (fw_do_not_firewall_lx_guest_systems_v6 | default(fw_do_not_firewall_lx_guest_systems)) | lower }}
# -------------
# --- Drop ICMP / MNDP / mDNS
# -------------
drop_icmp={{ fw_drop_icmp | lower }}
drop_mndp={{ fw_drop_mndp | lower }}
drop_mdns={{ fw_drop_mdns | lower }}
drop_icmp={{ (fw_drop_icmp_v6 | default(fw_drop_icmp)) | lower }}
drop_mndp={{ (fw_drop_mndp_v6 | default(fw_drop_mndp)) | lower }}
drop_mdns={{ (fw_drop_mdns_v6 | default(fw_drop_mdns)) | lower }}
# -------------
# --- Outgoing traffic
# -------------
allow_all_outgoing_traffic={{ fw_allow_all_outgoing_traffic | lower }}
allow_all_outgoing_traffic={{ (fw_allow_all_outgoing_traffic_v6 | default(fw_allow_all_outgoing_traffic)) | lower }}
# -------------
# --- Interface policy
# -------------
blocked_ifs="{{ fw_blocked_ifs }}"
unprotected_ifs="{{ fw_unprotected_ifs }}"
blocked_ifs="{{ (fw_blocked_ifs_v6 | default(fw_blocked_ifs)) }}"
unprotected_ifs="{{ (fw_unprotected_ifs_v6 | default(fw_unprotected_ifs)) }}"
# -------------
@@ -75,34 +79,34 @@ allow_local_service_from_networks="{{ fw_allow_local_service_from_networks_v6 }}
# --- Services: VPN / WireGuard
# -------------
vpn_server_ips="{{ fw_vpn_server_ips }}"
forward_vpn_server_ips="{{ fw_forward_vpn_server_ips }}"
vpn_ports="{{ fw_vpn_ports }}"
vpn_server_ips="{{ (fw_vpn_server_ips_v6 | default(fw_vpn_server_ips)) }}"
forward_vpn_server_ips="{{ (fw_forward_vpn_server_ips_v6 | default(fw_forward_vpn_server_ips)) }}"
vpn_ports="{{ (fw_vpn_ports_v6 | default(fw_vpn_ports)) }}"
wireguard_server_ips="{{ fw_wireguard_server_ips }}"
forward_wireguard_server_ips="{{ fw_forward_wireguard_server_ips }}"
wireguard_server_ports="{{ fw_wireguard_server_ports }}"
wireguard_out_ports="{{ fw_wireguard_out_ports }}"
wireguard_server_ips="{{ (fw_wireguard_server_ips_v6 | default(fw_wireguard_server_ips)) }}"
forward_wireguard_server_ips="{{ (fw_forward_wireguard_server_ips_v6 | default(fw_forward_wireguard_server_ips)) }}"
wireguard_server_ports="{{ (fw_wireguard_server_ports_v6 | default(fw_wireguard_server_ports)) }}"
wireguard_out_ports="{{ (fw_wireguard_out_ports_v6 | default(fw_wireguard_out_ports)) }}"
# -------------
# --- Services: NTP
# -------------
local_ntp_service={{ fw_local_ntp_service | lower }}
ntp_port="{{ fw_ntp_port }}"
ntp_allowed_net="{{ fw_ntp_allowed_net }}"
local_ntp_service={{ (fw_local_ntp_service_v6 | default(fw_local_ntp_service)) | lower }}
ntp_port="{{ (fw_ntp_port_v6 | default(fw_ntp_port)) }}"
ntp_allowed_net="{{ (fw_ntp_allowed_net_v6 | default(fw_ntp_allowed_net)) }}"
# -------------
# --- Services: DNS
# -------------
dns_server_ips="{{ fw_dns_server_ips }}"
forward_dns_server_ips="{{ fw_forward_dns_server_ips }}"
dns_server_ips="{{ (fw_dns_server_ips_v6 | default(fw_dns_server_ips)) }}"
forward_dns_server_ips="{{ (fw_forward_dns_server_ips_v6 | default(fw_forward_dns_server_ips)) }}"
local_resolver_service={{ fw_local_resolver_service | lower }}
resolver_port="{{ fw_resolver_port }}"
local_resolver_service={{ (fw_local_resolver_service_v6 | default(fw_local_resolver_service)) | lower }}
resolver_port="{{ (fw_resolver_port_v6 | default(fw_resolver_port)) }}"
# resolver_allowed_networks="2001:678:a40:3000::/64"
resolver_allowed_networks="{{ fw_resolver_allowed_networks_v6 }}"
@@ -111,31 +115,31 @@ resolver_allowed_networks="{{ fw_resolver_allowed_networks_v6 }}"
# --- Services: SSH
# -------------
ssh_server_ips="{{ fw_ssh_server_ips }}"
forward_ssh_server_ips="{{ fw_forward_ssh_server_ips }}"
ssh_ports="{{ fw_ssh_ports }}"
ssh_server_ips="{{ (fw_ssh_server_ips_v6 | default(fw_ssh_server_ips)) }}"
forward_ssh_server_ips="{{ (fw_forward_ssh_server_ips_v6 | default(fw_forward_ssh_server_ips)) }}"
ssh_ports="{{ (fw_ssh_ports_v6 | default(fw_ssh_ports)) }}"
# -------------
# --- Services: HTTP(S)
# -------------
http_server_ips="{{ fw_http_server_ips }}"
forward_http_server_ips="{{ fw_forward_http_server_ips }}"
http_ports="{{ fw_http_ports }}"
http_server_ips="{{ (fw_http_server_ips_v6 | default(fw_http_server_ips)) }}"
forward_http_server_ips="{{ (fw_forward_http_server_ips_v6 | default(fw_forward_http_server_ips)) }}"
http_ports="{{ (fw_http_ports_v6 | default(fw_http_ports)) }}"
log_cgi_traffic_out={{ fw_log_cgi_traffic_out | lower }}
cgi_script_users="{{ fw_cgi_script_users }}"
log_cgi_traffic_out={{ (fw_log_cgi_traffic_out_v6 | default(fw_log_cgi_traffic_out)) | lower }}
cgi_script_users="{{ (fw_cgi_script_users_v6 | default(fw_cgi_script_users)) }}"
# Restrictions on HTTP(S) connections to counteract attacks
set_max_new_http_conn_per_ip_per_second={{ fw_set_max_new_http_conn_per_ip_per_second | lower }}
max_http_new_conn_per_ip_per_second="{{ fw_max_http_new_conn_per_ip_per_second }}"
set_max_new_http_conn_per_ip_per_second={{ (fw_set_max_new_http_conn_per_ip_per_second_v6 | default(fw_set_max_new_http_conn_per_ip_per_second)) | lower }}
max_http_new_conn_per_ip_per_second="{{ (fw_max_http_new_conn_per_ip_per_second_v6 | default(fw_max_http_new_conn_per_ip_per_second)) }}"
set_max_concurrent_http_conn_per_ip={{ fw_set_max_concurrent_http_conn_per_ip | lower }}
max_concurrent_http_conn_per_ip="{{ fw_max_concurrent_http_conn_per_ip }}"
set_max_concurrent_http_conn_per_ip={{ (fw_set_max_concurrent_http_conn_per_ip_v6 | default(fw_set_max_concurrent_http_conn_per_ip)) | lower }}
max_concurrent_http_conn_per_ip="{{ (fw_max_concurrent_http_conn_per_ip_v6 | default(fw_max_concurrent_http_conn_per_ip)) }}"
set_max_new_http_conn_per_second={{ fw_set_max_new_http_conn_per_second | lower }}
max_new_http_conn_per_second="{{ fw_max_new_http_conn_per_second }}"
set_max_new_http_conn_per_second={{ (fw_set_max_new_http_conn_per_second_v6 | default(fw_set_max_new_http_conn_per_second)) | lower }}
max_new_http_conn_per_second="{{ (fw_max_new_http_conn_per_second_v6 | default(fw_max_new_http_conn_per_second)) }}"
# Clamp the advertised MSS of incoming HTTPS SYN packets
throttle_tcp6_mss_for_https={{ fw_throttle_tcp6_mss_for_https | lower }}
@@ -146,31 +150,31 @@ tcp6_mss_for_https_val="{{ fw_tcp6_mss_for_https_val }}"
# --- Services: Mattermost
# -------------
mm_server_ips="{{ fw_mm_server_ips }}"
forward_mm_server_ips="{{ fw_forward_mm_server_ips }}"
mm_udp_ports_in="{{ fw_mm_udp_ports_in }}"
mm_tcp_ports_in="{{ fw_mm_tcp_ports_in }}"
mm_udp_ports_out="{{ fw_mm_udp_ports_out }}"
mm_server_ips="{{ (fw_mm_server_ips_v6 | default(fw_mm_server_ips)) }}"
forward_mm_server_ips="{{ (fw_forward_mm_server_ips_v6 | default(fw_forward_mm_server_ips)) }}"
mm_udp_ports_in="{{ (fw_mm_udp_ports_in_v6 | default(fw_mm_udp_ports_in)) }}"
mm_tcp_ports_in="{{ (fw_mm_tcp_ports_in_v6 | default(fw_mm_tcp_ports_in)) }}"
mm_udp_ports_out="{{ (fw_mm_udp_ports_out_v6 | default(fw_mm_udp_ports_out)) }}"
# -------------
# --- Services: Mail (SMTP / IMAP / POP)
# -------------
smtpd_ips="{{ fw_smtpd_ips }}"
forward_smtpd_ips="{{ fw_forward_smtpd_ips }}"
smtpd_additional_listen_ports="{{ fw_smtpd_additional_listen_ports }}"
smtpd_additional_outgoung_ports="{{ fw_smtpd_additional_outgoing_ports }}"
smtpd_ips="{{ (fw_smtpd_ips_v6 | default(fw_smtpd_ips)) }}"
forward_smtpd_ips="{{ (fw_forward_smtpd_ips_v6 | default(fw_forward_smtpd_ips)) }}"
smtpd_additional_listen_ports="{{ (fw_smtpd_additional_listen_ports_v6 | default(fw_smtpd_additional_listen_ports)) }}"
smtpd_additional_outgoung_ports="{{ (fw_smtpd_additional_outgoing_ports_v6 | default(fw_smtpd_additional_outgoing_ports)) }}"
mail_server_ips="{{ fw_mail_server_ips }}"
forward_mail_server_ips="{{ fw_forward_mail_server_ips }}"
mail_user_ports="{{ fw_mail_user_ports }}"
mail_server_ips="{{ (fw_mail_server_ips_v6 | default(fw_mail_server_ips)) }}"
forward_mail_server_ips="{{ (fw_forward_mail_server_ips_v6 | default(fw_forward_mail_server_ips)) }}"
mail_user_ports="{{ (fw_mail_user_ports_v6 | default(fw_mail_user_ports)) }}"
mail_client_ips="{{ fw_mail_client_ips }}"
forward_mail_client_ips="{{ fw_forward_mail_client_ips }}"
mail_client_ips="{{ (fw_mail_client_ips_v6 | default(fw_mail_client_ips)) }}"
forward_mail_client_ips="{{ (fw_forward_mail_client_ips_v6 | default(fw_forward_mail_client_ips)) }}"
dovecot_auth_service={{ fw_dovecot_auth_service | lower }}
dovecot_auth_port="{{ fw_dovecot_auth_port }}"
dovecot_auth_service={{ (fw_dovecot_auth_service_v6 | default(fw_dovecot_auth_service)) | lower }}
dovecot_auth_port="{{ (fw_dovecot_auth_port_v6 | default(fw_dovecot_auth_port)) }}"
# dovecot_auth_allowed_networks="2001:678:a40:3000::/64 2a01:30:0:13:2f7:50ff:fed2:cef7"
dovecot_auth_allowed_networks="{{ fw_dovecot_auth_allowed_networks_v6 }}"
@@ -179,19 +183,19 @@ dovecot_auth_allowed_networks="{{ fw_dovecot_auth_allowed_networks_v6 }}"
# --- Services: FTP
# -------------
ftp_server_ips="{{ fw_ftp_server_ips }}"
forward_ftp_server_ips="{{ fw_forward_ftp_server_ips }}"
ftp_passive_port_range="{{ fw_ftp_passive_port_range }}"
ftp_server_ips="{{ (fw_ftp_server_ips_v6 | default(fw_ftp_server_ips)) }}"
forward_ftp_server_ips="{{ (fw_forward_ftp_server_ips_v6 | default(fw_forward_ftp_server_ips)) }}"
ftp_passive_port_range="{{ (fw_ftp_passive_port_range_v6 | default(fw_ftp_passive_port_range)) }}"
# -------------
# --- Services: XMPP (Jabber / Prosody)
# -------------
xmpp_server_ips="{{ fw_xmpp_server_ips }}"
forward_xmpp_server_ips="{{ fw_forward_xmpp_server_ips }}"
xmmp_tcp_in_ports="{{ fw_xmmp_tcp_in_ports }}"
xmmp_tcp_out_ports="{{ fw_xmmp_tcp_out_ports }}"
xmpp_server_ips="{{ (fw_xmpp_server_ips_v6 | default(fw_xmpp_server_ips)) }}"
forward_xmpp_server_ips="{{ (fw_forward_xmpp_server_ips_v6 | default(fw_forward_xmpp_server_ips)) }}"
xmmp_tcp_in_ports="{{ (fw_xmmp_tcp_in_ports_v6 | default(fw_xmmp_tcp_in_ports)) }}"
xmmp_tcp_out_ports="{{ (fw_xmmp_tcp_out_ports_v6 | default(fw_xmmp_tcp_out_ports)) }}"
# xmmp_remote_out_services="2a01:4f8:221:3b4e::247,44444"
xmmp_remote_out_services="{{ fw_xmmp_remote_out_services_v6 }}"
@@ -200,31 +204,31 @@ xmmp_remote_out_services="{{ fw_xmmp_remote_out_services_v6 }}"
# --- Services: Mumble
# -------------
mumble_server_ips="{{ fw_mumble_server_ips }}"
forward_mumble_server_ips="{{ fw_forward_mumble_server_ips }}"
mumble_ports="{{ fw_mumble_ports }}"
mumble_server_ips="{{ (fw_mumble_server_ips_v6 | default(fw_mumble_server_ips)) }}"
forward_mumble_server_ips="{{ (fw_forward_mumble_server_ips_v6 | default(fw_forward_mumble_server_ips)) }}"
mumble_ports="{{ (fw_mumble_ports_v6 | default(fw_mumble_ports)) }}"
# -------------
# --- Services: Jitsi / Jibri
# -------------
jitsi_server_ips="{{ fw_jitsi_server_ips }}"
forward_jitsi_server_ips="{{ fw_forward_jitsi_server_ips }}"
jitsi_tcp_ports="{{ fw_jitsi_tcp_ports }}"
jitsi_udp_port_range="{{ fw_jitsi_udp_port_range }}"
jitsi_tcp_ports_out="{{ fw_jitsi_tcp_ports_out }}"
jitsi_udp_ports_out="{{ fw_jitsi_udp_ports_out }}"
jitsi_dovecot_auth={{ fw_jitsi_dovecot_auth | lower }}
jitsi_dovecot_host="{{ fw_jitsi_dovecot_host }}"
jitsi_server_ips="{{ (fw_jitsi_server_ips_v6 | default(fw_jitsi_server_ips)) }}"
forward_jitsi_server_ips="{{ (fw_forward_jitsi_server_ips_v6 | default(fw_forward_jitsi_server_ips)) }}"
jitsi_tcp_ports="{{ (fw_jitsi_tcp_ports_v6 | default(fw_jitsi_tcp_ports)) }}"
jitsi_udp_port_range="{{ (fw_jitsi_udp_port_range_v6 | default(fw_jitsi_udp_port_range)) }}"
jitsi_tcp_ports_out="{{ (fw_jitsi_tcp_ports_out_v6 | default(fw_jitsi_tcp_ports_out)) }}"
jitsi_udp_ports_out="{{ (fw_jitsi_udp_ports_out_v6 | default(fw_jitsi_udp_ports_out)) }}"
jitsi_dovecot_auth={{ (fw_jitsi_dovecot_auth_v6 | default(fw_jitsi_dovecot_auth)) | lower }}
jitsi_dovecot_host="{{ (fw_jitsi_dovecot_host_v6 | default(fw_jitsi_dovecot_host)) }}"
jitsi_dovecot_port="{{ fw_jitsi_dovecot_port }}"
jitsi_jibri_remote_auth={{ fw_jitsi_jibri_remote_auth | lower }}
jitsi_jibri_remote_ips="{{ fw_jitsi_jibri_remote_ips }}"
jitsi_jibri_remote_auth={{ (fw_jitsi_jibri_remote_auth_v6 | default(fw_jitsi_jibri_remote_auth)) | lower }}
jitsi_jibri_remote_ips="{{ (fw_jitsi_jibri_remote_ips_v6 | default(fw_jitsi_jibri_remote_ips)) }}"
jitsi_jibri_remote_auth_port="{{ fw_jitsi_jibri_remote_auth_port }}"
jibri_server_ips="{{ fw_jibri_server_ips }}"
forward_jibri_server_ips="{{ fw_forward_jibri_server_ips }}"
jibri_remote_jitsi_server="{{ fw_jibri_remote_jitsi_server }}"
jibri_server_ips="{{ (fw_jibri_server_ips_v6 | default(fw_jibri_server_ips)) }}"
forward_jibri_server_ips="{{ (fw_forward_jibri_server_ips_v6 | default(fw_forward_jibri_server_ips)) }}"
jibri_remote_jitsi_server="{{ (fw_jibri_remote_jitsi_server_v6 | default(fw_jibri_remote_jitsi_server)) }}"
jibri_remote_auth_port="{{ fw_jibri_remote_auth_port }}"
@@ -232,69 +236,69 @@ jibri_remote_auth_port="{{ fw_jibri_remote_auth_port }}"
# --- Services: TURN / STUN (Nextcloud Talk)
# -------------
nc_turn_server_ips="{{ fw_nc_turn_server_ips }}"
forward_nc_turn_server_ips="{{ fw_forward_nc_turn_server_ips }}"
nc_turn_ports="{{ fw_nc_turn_ports }}"
nc_turn_udp_ports="{{ fw_nc_turn_udp_ports }}"
nc_turn_server_ips="{{ (fw_nc_turn_server_ips_v6 | default(fw_nc_turn_server_ips)) }}"
forward_nc_turn_server_ips="{{ (fw_forward_nc_turn_server_ips_v6 | default(fw_forward_nc_turn_server_ips)) }}"
nc_turn_ports="{{ (fw_nc_turn_ports_v6 | default(fw_nc_turn_ports)) }}"
nc_turn_udp_ports="{{ (fw_nc_turn_udp_ports_v6 | default(fw_nc_turn_udp_ports)) }}"
# -------------
# --- Services: TFTP (not yet implemented)
# -------------
tftp_server_ips="{{ fw_tftp_server_ips }}"
tftp_server_ips="{{ (fw_tftp_server_ips_v6 | default(fw_tftp_server_ips)) }}"
# -------------
# --- Services: Prometheus
# -------------
prometheus_local_server_ips="{{ fw_prometheus_local_server_ips }}"
prometheus_local_server_ips="{{ (fw_prometheus_local_server_ips_v6 | default(fw_prometheus_local_server_ips)) }}"
prometheus_remote_client_ports="{{ fw_prometheus_remote_client_ports }}"
prometheus_local_client_ips="{{ fw_prometheus_local_client_ips }}"
prometheus_local_client_ips="{{ (fw_prometheus_local_client_ips_v6 | default(fw_prometheus_local_client_ips)) }}"
prometheus_local_client_ports="{{ fw_prometheus_local_client_ports }}"
prometheus_remote_server_ips="{{ fw_prometheus_remote_server_ips }}"
prometheus_remote_server_ips="{{ (fw_prometheus_remote_server_ips_v6 | default(fw_prometheus_remote_server_ips)) }}"
# -------------
# --- Services: Munin
# -------------
munin_server_ips="{{ fw_munin_server_ips }}"
forward_munin_server_ips="{{ fw_forward_munin_server_ips }}"
munin_remote_port="{{ fw_munin_remote_port }}"
munin_server_ips="{{ (fw_munin_server_ips_v6 | default(fw_munin_server_ips)) }}"
forward_munin_server_ips="{{ (fw_forward_munin_server_ips_v6 | default(fw_forward_munin_server_ips)) }}"
munin_remote_port="{{ (fw_munin_remote_port_v6 | default(fw_munin_remote_port)) }}"
munin_remote_ip="{{ munin_remote_ipv6 }}"
munin_local_port="{{ fw_munin_local_port }}"
munin_local_port="{{ (fw_munin_local_port_v6 | default(fw_munin_local_port)) }}"
# -------------
# --- Services: Xymon (not yet implemented)
# -------------
xymon_server_ips="{{ fw_xymon_server_ips }}"
local_xymon_client={{ fw_local_xymon_client | lower }}
xymon_port="{{ fw_xymon_port }}"
xymon_server_ips="{{ (fw_xymon_server_ips_v6 | default(fw_xymon_server_ips)) }}"
local_xymon_client={{ (fw_local_xymon_client_v6 | default(fw_local_xymon_client)) | lower }}
xymon_port="{{ (fw_xymon_port_v6 | default(fw_xymon_port)) }}"
# -------------
# --- Protocols out: Rsync
# -------------
rsync_out_ips="{{ fw_rsync_out_ips }}"
forward_rsync_out_ips="{{ fw_forward_rsync_out_ips }}"
rsync_ports="{{ fw_rsync_ports }}"
rsync_out_ips="{{ (fw_rsync_out_ips_v6 | default(fw_rsync_out_ips)) }}"
forward_rsync_out_ips="{{ (fw_forward_rsync_out_ips_v6 | default(fw_forward_rsync_out_ips)) }}"
rsync_ports="{{ (fw_rsync_ports_v6 | default(fw_rsync_ports)) }}"
# -------------
# --- Special ports (OUT)
# -------------
tcp_out_ports="{{ fw_tcp_out_ports }}"
forward_tcp_out_ports="{{ fw_forward_tcp_out_ports }}"
udp_out_ports="{{ fw_udp_out_ports }}"
forward_udp_out_ports="{{ fw_forward_udp_out_ports }}"
tcp_out_ports="{{ (fw_tcp_out_ports_v6 | default(fw_tcp_out_ports)) }}"
forward_tcp_out_ports="{{ (fw_forward_tcp_out_ports_v6 | default(fw_forward_tcp_out_ports)) }}"
udp_out_ports="{{ (fw_udp_out_ports_v6 | default(fw_udp_out_ports)) }}"
forward_udp_out_ports="{{ (fw_forward_udp_out_ports_v6 | default(fw_forward_udp_out_ports)) }}"
# =============
@@ -315,36 +319,36 @@ blocked_ips="{{ fw_blocked_ips_v6 }}"
# Prefix length for entries in ban_ipv6.list given without mask
ban_ipv6_mask="{{ fw_ban_ipv6_mask }}"
block_tcp_ports="{{ fw_block_tcp_ports }}"
block_udp_ports="{{ fw_block_udp_ports }}"
block_tcp_ports="{{ (fw_block_tcp_ports_v6 | default(fw_block_tcp_ports)) }}"
block_udp_ports="{{ (fw_block_udp_ports_v6 | default(fw_block_udp_ports)) }}"
# -------------
# --- Special / Counters
# -------------
create_traffic_counter={{ fw_create_traffic_counter | lower }}
create_iperf_rules={{ fw_create_iperf_rules | lower }}
create_traffic_counter={{ (fw_create_traffic_counter_v6 | default(fw_create_traffic_counter)) | lower }}
create_iperf_rules={{ (fw_create_iperf_rules_v6 | default(fw_create_iperf_rules)) | lower }}
# -------------
# --- Protection
# -------------
protection_against_syn_flooding={{ fw_protection_against_syn_flooding | lower }}
protection_against_port_scanning={{ fw_protection_against_port_scanning | lower }}
protection_against_ssh_brute_force_attacks={{ fw_protection_against_ssh_brute_force_attacks | lower }}
protection_against_syn_flooding={{ (fw_protection_against_syn_flooding_v6 | default(fw_protection_against_syn_flooding)) | lower }}
protection_against_port_scanning={{ (fw_protection_against_port_scanning_v6 | default(fw_protection_against_port_scanning)) | lower }}
protection_against_ssh_brute_force_attacks={{ (fw_protection_against_ssh_brute_force_attacks_v6 | default(fw_protection_against_ssh_brute_force_attacks)) | lower }}
# -------------
# --- Connection limits
# -------------
limit_connections_per_source_IP={{ fw_limit_connections_per_source_IP | lower }}
per_IP_connection_limit={{ fw_per_IP_connection_limit }}
limit_connections_per_source_IP={{ (fw_limit_connections_per_source_IP_v6 | default(fw_limit_connections_per_source_IP)) | lower }}
per_IP_connection_limit={{ (fw_per_IP_connection_limit_v6 | default(fw_per_IP_connection_limit)) }}
limit_new_tcp_connections_per_seconds_per_source_IP={{ fw_limit_new_tcp_connections_per_seconds_per_source_IP | lower }}
limit_new_tcp_connections_per_seconds_ports="{{ fw_limit_new_tcp_connections_per_seconds_ports }}"
limit_new_tcp_connections_per_seconds_per_source_IP={{ (fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6 | default(fw_limit_new_tcp_connections_per_seconds_per_source_IP)) | lower }}
limit_new_tcp_connections_per_seconds_ports="{{ (fw_limit_new_tcp_connections_per_seconds_ports_v6 | default(fw_limit_new_tcp_connections_per_seconds_ports)) }}"
# -------------