ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update..

Browse Source
This commit is contained in:
Christoph
2023-10-16 14:35:57 +02:00
parent 58a501fe81
commit a932167bc6
9 changed files with 318 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

118
roles/modify-ipt-gateway/tasks/main.yml
View File

@ -122,63 +122,123 @@
# ---
# IP Address Filtering Gaming Devices
# Restrict VPN Networks
# ---
- name: Check if String 'gaming_device_ip_addresses..' (IPv4) is present
shell: grep -q -E "^#?gaming_device_ip_addresses=" /etc/ipt-firewall/main_ipv4.conf
register: gaming_device_ip_addresses_ipv4_present
- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv4) is present
shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv4.conf
register: restrict_vpn_net_to_local_service_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "gaming_device_ip_addresses_ipv4_present.rc > 1"
changed_when: "gaming_device_ip_addresses_ipv4_present.rc > 0"
failed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 1"
changed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (gaming_device_ip_addresses)
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (restrict_vpn_net_to_local_service)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*gaming_device_mac_addresses='
insertafter: '^#?\s*vpn_out_ports='
block: |
# =============
# - IP Address Filtering Gaming Devices
# =============
# -----
# - Restrict VPN Network to local Service
# -----#
# - IP adresses here are only allowed connect to internet but NOT to loacl services and networks
# - restrict_vpn_net_to_local_service
# -
# - allow_ext_net_to_local_service="vpn-net:local-address:port:protocol [vpn-net:local-address:port:protocol] [..]"
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - restrict_vpn_net_to_local_service="
# - 10.100.112.0/24:192.168.112.192/27:80:tcp
# - 10.100.112.0/24:192.168.112.192/27:443:tcp
# - "
# -
# - Blank separated list
# -
gaming_device_ip_addresses=""
marker: "# Marker set by modify-ipt-gateway.yml (gaming_device_ip_addresses)"
restrict_vpn_net_to_local_service=""
# -----
# - Restrict VPN Network to local (Sub) network
# -----
# - restrict_vpn_net_to_local_subnet
# -
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>:<dst-local-net> [<src-vpn-net>:<dst-local-net>} [..]
# -
# - Example:
# - restrict_vpn_net_to_local_subnet="
# - 10.100.112.0/24:192.168.112.192/27
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_subnet=""
marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
when:
- main_ipv4_exists.stat.exists
- gaming_device_ip_addresses_ipv4_present is changed
- restrict_vpn_net_to_local_service_ipv4_present is changed
- name: Check if String 'gaming_device_ip_addresses..' (IPv6) is present
shell: grep -q -E "^#?gaming_device_ip_addresses=" /etc/ipt-firewall/main_ipv6.conf
register: gaming_device_ip_addresses_ipv6_present
- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv6) is present
shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv6.conf
register: restrict_vpn_net_to_local_service_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "gaming_device_ip_addresses_ipv6_present.rc > 1"
changed_when: "gaming_device_ip_addresses_ipv6_present.rc > 0"
failed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 1"
changed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (gaming_device_ip_addresses)
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (restrict_vpn_net_to_local_service)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*gaming_device_mac_addresses='
insertafter: '^#?\s*vpn_out_ports='
block: |
# =============
# - IP Address Filtering Gaming Devices
# =============
# -----
# - Restrict VPN Network to local Service
# -----#
# - IP adresses here are only allowed connect to internet but NOT to loacl services and networks
# - restrict_vpn_net_to_local_service
# -
# - allow_ext_net_to_local_service="vpn-net,local-address,port,protocol [vpn-net,local-address,port,protocol] [..]"
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - restrict_vpn_net_to_local_service="
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,80,tcp
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,443,tcp
# - "
# -
# - Blank separated list
# -
gaming_device_ip_addresses=""
marker: "# Marker set by modify-ipt-gateway.yml (gaming_device_ip_addresses)"
restrict_vpn_net_to_local_service=""
# -----
# - Restrict VPN Network to local (Sub) network
# -----
# - restrict_vpn_net_to_local_subnet
# -
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>,<dst-local-net> [<src-vpn-net>,<dst-local-net>} [..]
# -
# - Example:
# - restrict_vpn_net_to_local_subnet="
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_subnet=""
marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
when:
- main_ipv6_exists.stat.exists
- gaming_device_ip_addresses_ipv6_present is changed
- restrict_vpn_net_to_local_service_ipv6_present is changed
# ---