update..
This commit is contained in:
parent
2f01f6a543
commit
d604f3508e
45
hosts
45
hosts
@ -14,6 +14,12 @@ rage.so36.net ansible_user=ckubu
|
|||||||
#kvm05.so36.net ansible_ssh_user=ckubu ansible_ssh_port=1036
|
#kvm05.so36.net ansible_ssh_user=ckubu ansible_ssh_port=1036
|
||||||
#kvm13.so36.net ansible_ssh_user=ckubu ansible_ssh_port=1036
|
#kvm13.so36.net ansible_ssh_user=ckubu ansible_ssh_port=1036
|
||||||
|
|
||||||
|
[no_ipt_firewall]
|
||||||
|
|
||||||
|
lxc-host-kb.anw-kb.netz
|
||||||
|
o33.oopen.de
|
||||||
|
o25.oopen.de
|
||||||
|
|
||||||
|
|
||||||
[dns_sinma]
|
[dns_sinma]
|
||||||
|
|
||||||
@ -122,13 +128,11 @@ o13-web.oopen.de
|
|||||||
|
|
||||||
o17.oopen.de
|
o17.oopen.de
|
||||||
test.mx.oopen.de
|
test.mx.oopen.de
|
||||||
meet2.oopen.de
|
|
||||||
|
|
||||||
o18.oopen.de
|
o18.oopen.de
|
||||||
|
|
||||||
o20.oopen.de
|
o20.oopen.de
|
||||||
|
|
||||||
o21.oopen.de
|
|
||||||
o31.oopen.de
|
o31.oopen.de
|
||||||
mail.cadus.org
|
mail.cadus.org
|
||||||
web.cadus.org
|
web.cadus.org
|
||||||
@ -170,7 +174,7 @@ o28.oopen.de
|
|||||||
# - o29.oopen.de Backup Server
|
# - o29.oopen.de Backup Server
|
||||||
o29.oopen.de
|
o29.oopen.de
|
||||||
backup.oopen.de
|
backup.oopen.de
|
||||||
gitea.oopen.de
|
git.oopen.de
|
||||||
|
|
||||||
# AK - Server Nextcloud/Jitsi Meet
|
# AK - Server Nextcloud/Jitsi Meet
|
||||||
o30.oopen.de
|
o30.oopen.de
|
||||||
@ -277,14 +281,12 @@ o13-web.oopen.de
|
|||||||
o17.oopen.de
|
o17.oopen.de
|
||||||
test.mx.oopen.de
|
test.mx.oopen.de
|
||||||
test.mariadb.oopen.de
|
test.mariadb.oopen.de
|
||||||
meet2.oopen.de
|
|
||||||
|
|
||||||
o18.oopen.de
|
o18.oopen.de
|
||||||
|
|
||||||
# - o20.oopen.de (srv-cityslang.cityslang.com)
|
# - o20.oopen.de (srv-cityslang.cityslang.com)
|
||||||
o20.oopen.de
|
o20.oopen.de
|
||||||
|
|
||||||
o21.oopen.de
|
|
||||||
o31.oopen.de
|
o31.oopen.de
|
||||||
mail.cadus.org
|
mail.cadus.org
|
||||||
web.cadus.org
|
web.cadus.org
|
||||||
@ -330,9 +332,7 @@ o28.oopen.de
|
|||||||
o29.oopen.de
|
o29.oopen.de
|
||||||
backup.oopen.de
|
backup.oopen.de
|
||||||
git.oopen.de
|
git.oopen.de
|
||||||
gitea.oopen.de
|
|
||||||
munin.oopen.de
|
munin.oopen.de
|
||||||
nscache.oopen.de
|
|
||||||
|
|
||||||
# AK - Server Nextcloud/Jitsi Meet
|
# AK - Server Nextcloud/Jitsi Meet
|
||||||
o30.oopen.de
|
o30.oopen.de
|
||||||
@ -496,7 +496,6 @@ munin.oopen.de
|
|||||||
# o20.oopen.de (srv-cityslang.cityslang.com)
|
# o20.oopen.de (srv-cityslang.cityslang.com)
|
||||||
o20.oopen.de
|
o20.oopen.de
|
||||||
|
|
||||||
# o21.oopen.de
|
|
||||||
# o31.oopen.de
|
# o31.oopen.de
|
||||||
web.cadus.org
|
web.cadus.org
|
||||||
wiki.cadus.org
|
wiki.cadus.org
|
||||||
@ -645,7 +644,6 @@ o13-board.oopen.de
|
|||||||
o13-pad.oopen.de
|
o13-pad.oopen.de
|
||||||
|
|
||||||
# o17.oopen.de
|
# o17.oopen.de
|
||||||
meet2.oopen.de
|
|
||||||
|
|
||||||
# o23.oopen.de
|
# o23.oopen.de
|
||||||
cp-01.oopen.de
|
cp-01.oopen.de
|
||||||
@ -697,7 +695,6 @@ initiativenserver.oopen.de
|
|||||||
o13-web.oopen.de
|
o13-web.oopen.de
|
||||||
|
|
||||||
|
|
||||||
# o21.oopen.de
|
|
||||||
# o31.oopen.de
|
# o31.oopen.de
|
||||||
web.cadus.org
|
web.cadus.org
|
||||||
wiki.cadus.org
|
wiki.cadus.org
|
||||||
@ -751,7 +748,6 @@ o13-schleuder.oopen.de
|
|||||||
# o17.oopen.de
|
# o17.oopen.de
|
||||||
test.mx.oopen.de
|
test.mx.oopen.de
|
||||||
|
|
||||||
# o21.oopen.de
|
|
||||||
# o31.oopen.de
|
# o31.oopen.de
|
||||||
mail.cadus.org
|
mail.cadus.org
|
||||||
|
|
||||||
@ -864,11 +860,6 @@ test.mariadb.oopen.de
|
|||||||
# o20.oopen.de (srv-cityslang.cityslang.com)
|
# o20.oopen.de (srv-cityslang.cityslang.com)
|
||||||
o20.oopen.de
|
o20.oopen.de
|
||||||
|
|
||||||
# o21.oopen.de
|
|
||||||
web.cadus.org
|
|
||||||
wiki.cadus.org
|
|
||||||
mail.cadus.org
|
|
||||||
|
|
||||||
# o22.oopen.de
|
# o22.oopen.de
|
||||||
oolm-db-dev.oopen.de
|
oolm-db-dev.oopen.de
|
||||||
oolm-db.oopen.de
|
oolm-db.oopen.de
|
||||||
@ -898,6 +889,11 @@ backup.oopen.de
|
|||||||
# o30.oopen.de - AK server Jitsi Meet/Nextcloud
|
# o30.oopen.de - AK server Jitsi Meet/Nextcloud
|
||||||
cloud.akweb.de
|
cloud.akweb.de
|
||||||
|
|
||||||
|
# o31.oopen.de
|
||||||
|
web.cadus.org
|
||||||
|
wiki.cadus.org
|
||||||
|
mail.cadus.org
|
||||||
|
|
||||||
# etventure
|
# etventure
|
||||||
o32.oopen.de
|
o32.oopen.de
|
||||||
|
|
||||||
@ -1026,9 +1022,7 @@ o13-mail.oopen.de
|
|||||||
test.mx.oopen.de
|
test.mx.oopen.de
|
||||||
|
|
||||||
# o29.oopen.de
|
# o29.oopen.de
|
||||||
nscache.oopen.de
|
|
||||||
|
|
||||||
# o21.oopen.de
|
|
||||||
# o31.oopen.de
|
# o31.oopen.de
|
||||||
mail.cadus.org
|
mail.cadus.org
|
||||||
|
|
||||||
@ -1144,7 +1138,6 @@ file-fhxb.fhxb.netz
|
|||||||
# Not usefull for gateways of office networks
|
# Not usefull for gateways of office networks
|
||||||
#
|
#
|
||||||
[local_resolver]
|
[local_resolver]
|
||||||
nscache.oopen.de
|
|
||||||
|
|
||||||
|
|
||||||
[ntp_server]
|
[ntp_server]
|
||||||
@ -1155,7 +1148,6 @@ nscache.oopen.de
|
|||||||
[jitsi_meet_server]
|
[jitsi_meet_server]
|
||||||
|
|
||||||
# o17.oopen.de
|
# o17.oopen.de
|
||||||
meet2.oopen.de
|
|
||||||
|
|
||||||
# o23.oopen.de
|
# o23.oopen.de
|
||||||
meet.oopen.de
|
meet.oopen.de
|
||||||
@ -1186,7 +1178,6 @@ o13.oopen.de
|
|||||||
o17.oopen.de
|
o17.oopen.de
|
||||||
o18.oopen.de
|
o18.oopen.de
|
||||||
#o20.oopen.de
|
#o20.oopen.de
|
||||||
o21.oopen.de
|
|
||||||
o22.oopen.de
|
o22.oopen.de
|
||||||
o23.oopen.de
|
o23.oopen.de
|
||||||
o24.oopen.de
|
o24.oopen.de
|
||||||
@ -1257,9 +1248,7 @@ o13-web.oopen.de
|
|||||||
# - o17.oopen.de
|
# - o17.oopen.de
|
||||||
test.mx.oopen.de
|
test.mx.oopen.de
|
||||||
test.mariadb.oopen.de
|
test.mariadb.oopen.de
|
||||||
meet2.oopen.de
|
|
||||||
|
|
||||||
# - o21.oopen.de
|
|
||||||
# - o31.oopen.de
|
# - o31.oopen.de
|
||||||
mail.cadus.org
|
mail.cadus.org
|
||||||
web.cadus.org
|
web.cadus.org
|
||||||
@ -1294,9 +1283,7 @@ o26.oopen.de
|
|||||||
# o29.oopen.de
|
# o29.oopen.de
|
||||||
backup.oopen.de
|
backup.oopen.de
|
||||||
git.oopen.de
|
git.oopen.de
|
||||||
gitea.oopen.de
|
|
||||||
munin.oopen.de
|
munin.oopen.de
|
||||||
nscache.oopen.de
|
|
||||||
|
|
||||||
# o30.oopen.de - AK Server Nextcloud/Jitsi Meet
|
# o30.oopen.de - AK Server Nextcloud/Jitsi Meet
|
||||||
meet.akweb.de
|
meet.akweb.de
|
||||||
@ -1424,14 +1411,11 @@ o13-web.oopen.de
|
|||||||
o17.oopen.de
|
o17.oopen.de
|
||||||
test.mx.oopen.de
|
test.mx.oopen.de
|
||||||
test.mariadb.oopen.de
|
test.mariadb.oopen.de
|
||||||
meet2.oopen.de
|
|
||||||
|
|
||||||
# - o20.oopen.de (srv-cityslang.cityslang.com)
|
# - o20.oopen.de (srv-cityslang.cityslang.com)
|
||||||
o20.oopen.de
|
o20.oopen.de
|
||||||
|
|
||||||
# - o21.oopen.de
|
|
||||||
# - o31.oopen.de
|
# - o31.oopen.de
|
||||||
o21.oopen.de
|
|
||||||
o31.oopen.de
|
o31.oopen.de
|
||||||
mail.cadus.org
|
mail.cadus.org
|
||||||
web.cadus.org
|
web.cadus.org
|
||||||
@ -1477,8 +1461,6 @@ o28.oopen.de
|
|||||||
o29.oopen.de
|
o29.oopen.de
|
||||||
backup.oopen.de
|
backup.oopen.de
|
||||||
git.oopen.de
|
git.oopen.de
|
||||||
gitea.oopen.de
|
|
||||||
nscache.oopen.de
|
|
||||||
munin.oopen.de
|
munin.oopen.de
|
||||||
|
|
||||||
# AK - Server Nextcloud/Jitsi Meet
|
# AK - Server Nextcloud/Jitsi Meet
|
||||||
@ -1506,6 +1488,7 @@ d.mx.oopen.de
|
|||||||
a.mx.oopen.de
|
a.mx.oopen.de
|
||||||
|
|
||||||
# o36 - b.mx, web-01, web-03,--
|
# o36 - b.mx, web-01, web-03,--
|
||||||
|
o36.oopen.de
|
||||||
b.mx.oopen.de
|
b.mx.oopen.de
|
||||||
matomo-01.oopen.de
|
matomo-01.oopen.de
|
||||||
web-03.oopen.de
|
web-03.oopen.de
|
||||||
@ -1569,8 +1552,6 @@ gateway_server_ro
|
|||||||
gateway_server_rw
|
gateway_server_rw
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
[warenform_server]
|
[warenform_server]
|
||||||
|
|
||||||
# server18
|
# server18
|
||||||
|
@ -5,7 +5,8 @@
|
|||||||
# apt-caching-nameserver
|
# apt-caching-nameserver
|
||||||
- import_tasks: ipt-server.yml
|
- import_tasks: ipt-server.yml
|
||||||
when:
|
when:
|
||||||
- groups['gateway_server']|string is not search(inventory_hostname)
|
- inventory_hostname not in groups['gateway_server']
|
||||||
|
- inventory_hostname not in groups['no_ipt_firewall']
|
||||||
tags:
|
tags:
|
||||||
- git-firewall-repository
|
- git-firewall-repository
|
||||||
- ipt-server
|
- ipt-server
|
||||||
@ -13,7 +14,8 @@
|
|||||||
|
|
||||||
- import_tasks: ipt-gateway.yml
|
- import_tasks: ipt-gateway.yml
|
||||||
when:
|
when:
|
||||||
- groups['gateway_server']|string is search(inventory_hostname)
|
- inventory_hostname in groups['gateway_server']
|
||||||
|
- inventory_hostname not in groups['no_ipt_firewall']
|
||||||
tags:
|
tags:
|
||||||
- git-firewall-repository
|
- git-firewall-repository
|
||||||
- ipt-gateway
|
- ipt-gateway
|
||||||
|
593
roles/modify-ipt-server/tasks/ipt-server.yml
Normal file
593
roles/modify-ipt-server/tasks/ipt-server.yml
Normal file
@ -0,0 +1,593 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Install/Uodate git firewall repository
|
||||||
|
# ===
|
||||||
|
|
||||||
|
#- meta: end_play
|
||||||
|
# when:
|
||||||
|
# - inventory_hostname in groups['gateway_server'] or inventory_hostname in groups['no_ipt_firewall'] or git_firewall_repository is not defined or git_firewall_repository|length < 1
|
||||||
|
|
||||||
|
|
||||||
|
- name: Install/update firewall repository
|
||||||
|
git:
|
||||||
|
repo: '{{ git_firewall_repository.repo }}'
|
||||||
|
dest: '{{ git_firewall_repository.dest }}'
|
||||||
|
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||||
|
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Some Checks
|
||||||
|
# ===
|
||||||
|
|
||||||
|
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
|
||||||
|
stat:
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
register: main_ipv6_exists
|
||||||
|
|
||||||
|
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
|
||||||
|
stat:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
register: main_ipv4_exists
|
||||||
|
|
||||||
|
- name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists
|
||||||
|
stat:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||||
|
register: interfaces_ipv6_exists
|
||||||
|
|
||||||
|
- name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists
|
||||||
|
stat:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||||
|
register: interfaces_ipv4_exists
|
||||||
|
|
||||||
|
- name: Check if file '/etc/munin/munin-node.conf' exists
|
||||||
|
stat:
|
||||||
|
path: /etc/munin/munin-node.conf
|
||||||
|
register: munin_node_exists
|
||||||
|
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Adjust/Correct some values..
|
||||||
|
# ===
|
||||||
|
|
||||||
|
- name: addjust line 'munin_remote_ip' (IPv4)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
regexp: '^munin_remote_ip='
|
||||||
|
line: 'munin_remote_ip="{{ munin_remote_ipv4 }}"'
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
- name: addjust line 'munin_remote_ip' (IPv6)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
regexp: '^munin_remote_ip='
|
||||||
|
line: 'munin_remote_ip="{{ munin_remote_ipv6 }}"'
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
- name: addjust line 'vpn_ifs' (IPv4)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||||
|
regexp: '^vpn_ifs='
|
||||||
|
line: 'vpn_ifs="tun+"'
|
||||||
|
when:
|
||||||
|
- interfaces_ipv4_exists.stat.exists
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
- name: addjust line 'vpn_ifs' (IPv6)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||||
|
regexp: '^vpn_ifs='
|
||||||
|
line: 'vpn_ifs="tun+"'
|
||||||
|
when:
|
||||||
|
- interfaces_ipv6_exists.stat.exists
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Add some Code Block.
|
||||||
|
# ===
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# Wireguard Service
|
||||||
|
# ---
|
||||||
|
|
||||||
|
- name: Check if String 'wg_ifs=..' is present in interfaces_ipv4.conf
|
||||||
|
shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv4.conf
|
||||||
|
register: wg_ifs_interfaces_ipv4_present
|
||||||
|
when: interfaces_ipv4_exists.stat.exists
|
||||||
|
failed_when: "wg_ifs_interfaces_ipv4_present.rc > 1"
|
||||||
|
changed_when: "wg_ifs_interfaces_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (wg_ifs)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||||
|
insertafter: '^#?\s*vpn_ifs'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# - Wireguard Interfaces
|
||||||
|
# - (comma separated list 'wg+' is also possible)
|
||||||
|
wg_ifs="wg+"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (wg_ifs)"
|
||||||
|
when:
|
||||||
|
- interfaces_ipv4_exists.stat.exists
|
||||||
|
- wg_ifs_interfaces_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'wg_ifs=..' is present in interfaces_ipv6.conf
|
||||||
|
shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv6.conf
|
||||||
|
register: wg_ifs_interfaces_ipv6_present
|
||||||
|
when: interfaces_ipv6_exists.stat.exists
|
||||||
|
failed_when: "wg_ifs_interfaces_ipv6_present.rc > 1"
|
||||||
|
changed_when: "wg_ifs_interfaces_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (wg_ifs)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||||
|
insertafter: '^#?\s*vpn_ifs'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# - Wireguard Interfaces
|
||||||
|
# - (comma separated list 'wg+' is also possible)
|
||||||
|
wg_ifs="wg+"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (wg_ifs)"
|
||||||
|
when:
|
||||||
|
- interfaces_ipv6_exists.stat.exists
|
||||||
|
- wg_ifs_interfaces_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv4.conf
|
||||||
|
shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv4.conf
|
||||||
|
register: lxc_guest_ips_interfaces_ipv4_present
|
||||||
|
when: interfaces_ipv4_exists.stat.exists
|
||||||
|
failed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 1"
|
||||||
|
changed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (lxc_guest_ips)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||||
|
insertafter: '^#?\s*local_3_ip'
|
||||||
|
block: |
|
||||||
|
local_ips="$local_1_ip $local_2_ip $local_3_ip"
|
||||||
|
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# --- IP-Addresses LXC Guest sSystems
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done
|
||||||
|
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_1_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_2_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_3_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_4_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_5_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_6_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_7_ip=""
|
||||||
|
|
||||||
|
lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)"
|
||||||
|
when:
|
||||||
|
- interfaces_ipv4_exists.stat.exists
|
||||||
|
- lxc_guest_ips_interfaces_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv6.conf
|
||||||
|
shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv6.conf
|
||||||
|
register: lxc_guest_ips_interfaces_ipv6_present
|
||||||
|
when: interfaces_ipv6_exists.stat.exists
|
||||||
|
failed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 1"
|
||||||
|
changed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (lxc_guest_ips)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||||
|
insertafter: '^#?\s*local_3_ip'
|
||||||
|
block: |
|
||||||
|
local_ips="$local_1_ip $local_2_ip $local_3_ip"
|
||||||
|
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# --- IP-Addresses LXC Guest sSystems
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done
|
||||||
|
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_1_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_2_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_3_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_4_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_5_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_6_ip=""
|
||||||
|
# NOT IN USE
|
||||||
|
lxc_guest_7_ip=""
|
||||||
|
|
||||||
|
lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)"
|
||||||
|
when:
|
||||||
|
- interfaces_ipv6_exists.stat.exists
|
||||||
|
- lxc_guest_ips_interfaces_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'do_not_firewall_lx_guest_systems=..' is present
|
||||||
|
shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
register: wireguard_service_ipv4_present
|
||||||
|
when: main_ipv4_exists.stat.exists
|
||||||
|
failed_when: "wireguard_service_ipv4_present.rc > 1"
|
||||||
|
changed_when: "wireguard_service_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (do_not_firewall_lx_guest_systems)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
insertafter: '^#?\s*do_not_firewall_bridged_traffic'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# --- Do not firewall traffic from and to LX Gust Systems
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Traffic to hosted LX containers are not firewalled here.
|
||||||
|
# -
|
||||||
|
do_not_firewall_lx_guest_systems=false
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
- wireguard_service_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'do_not_firewall_lx_guest_systems=..' is present
|
||||||
|
shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
register: wireguard_service_ipv6_present
|
||||||
|
when: main_ipv6_exists.stat.exists
|
||||||
|
failed_when: "wireguard_service_ipv6_present.rc > 1"
|
||||||
|
changed_when: "wireguard_service_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (do_not_firewall_lx_guest_systems)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
insertafter: '^#?\s*do_not_firewall_bridged_traffic'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# --- Do not firewall traffic from and to LX Gust Systems
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Traffic to hosted LX containers are not firewalled here.
|
||||||
|
# -
|
||||||
|
do_not_firewall_lx_guest_systems=false
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
- wireguard_service_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# Mattermost (MM) Service
|
||||||
|
# ---
|
||||||
|
|
||||||
|
- name: Check if String 'mm_server_ips=..' is present
|
||||||
|
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
register: mattermost_service_ipv4_present
|
||||||
|
when: main_ipv4_exists.stat.exists
|
||||||
|
failed_when: "mattermost_service_ipv4_present.rc > 1"
|
||||||
|
changed_when: "mattermost_service_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mattermost_service)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
insertafter: '^#?\s*http_ports'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# - Mattermost (MM) Service
|
||||||
|
# -
|
||||||
|
mm_server_ips=""
|
||||||
|
forward_mm_server_ips=""
|
||||||
|
|
||||||
|
# - UDP Ports IN and OUT used by MM Servive
|
||||||
|
# -
|
||||||
|
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
||||||
|
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
- mattermost_service_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'mm_server_ips=..' is present
|
||||||
|
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
register: mattermost_service_ipv6_present
|
||||||
|
when: main_ipv6_exists.stat.exists
|
||||||
|
failed_when: "mattermost_service_ipv6_present.rc > 1"
|
||||||
|
changed_when: "mattermost_service_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mattermost_service)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
insertafter: '^#?\s*http_ports'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# - Mattermost (MM) Service
|
||||||
|
# -
|
||||||
|
mm_server_ips=""
|
||||||
|
forward_mm_server_ips=""
|
||||||
|
|
||||||
|
# - UDP Ports IN and OUT used by MM Servive
|
||||||
|
# -
|
||||||
|
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
||||||
|
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
- mattermost_service_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# Protection against and Limit Connections settings
|
||||||
|
# ---
|
||||||
|
|
||||||
|
- name: Check if String 'protection_against_syn_flooding=..' is present
|
||||||
|
shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
register: protect_settings_ipv4_present
|
||||||
|
when: main_ipv4_exists.stat.exists
|
||||||
|
failed_when: "protect_settings_ipv4_present.rc > 1"
|
||||||
|
changed_when: "protect_settings_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
insertafter: '^#?\s*create_iperf_rules'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Protection against ...
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Protection against syn-flooding
|
||||||
|
# -
|
||||||
|
protection_against_syn_flooding=true
|
||||||
|
|
||||||
|
# - Protection against port scanning
|
||||||
|
# -
|
||||||
|
protection_against_port_scanning=true
|
||||||
|
|
||||||
|
# - Protection against SSH brute-force attacks
|
||||||
|
# -
|
||||||
|
protection_against_ssh_brute_force_attacks=true
|
||||||
|
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Limit Connections
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Limit connections per source IP
|
||||||
|
# -
|
||||||
|
limit_connections_per_source_IP=true
|
||||||
|
|
||||||
|
# - Limit RST packets
|
||||||
|
# -
|
||||||
|
limit_rst_packets=true
|
||||||
|
|
||||||
|
# - Limit new TCP connections per second per source IP
|
||||||
|
# -
|
||||||
|
limit_new_tcp_connections_per_seconds_per_source_IP=true
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
- protect_settings_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'protection_against_syn_flooding=..' is present
|
||||||
|
shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
register: protect_settings_ipv6_present
|
||||||
|
when: main_ipv6_exists.stat.exists
|
||||||
|
failed_when: "protect_settings_ipv6_present.rc > 1"
|
||||||
|
changed_when: "protect_settings_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
insertafter: '^#?\s*create_iperf_rules'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Protection against ...
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Protection against syn-flooding
|
||||||
|
# -
|
||||||
|
protection_against_syn_flooding=true
|
||||||
|
|
||||||
|
# - Protection against port scanning
|
||||||
|
# -
|
||||||
|
protection_against_port_scanning=true
|
||||||
|
|
||||||
|
# - Protection against SSH brute-force attacks
|
||||||
|
# -
|
||||||
|
protection_against_ssh_brute_force_attacks=true
|
||||||
|
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Limit Connections
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Limit connections per source IP
|
||||||
|
# -
|
||||||
|
limit_connections_per_source_IP=true
|
||||||
|
|
||||||
|
# - Limit RST packets
|
||||||
|
# -
|
||||||
|
limit_rst_packets=true
|
||||||
|
|
||||||
|
# - Limit new TCP connections per second per source IP
|
||||||
|
# -
|
||||||
|
limit_new_tcp_connections_per_seconds_per_source_IP=true
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
- protect_settings_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Remove Marker set by blockinfile
|
||||||
|
# ===
|
||||||
|
|
||||||
|
- name: Remove marker IPv4
|
||||||
|
replace :
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||||
|
replace: ""
|
||||||
|
register: marker_ipv4_removed
|
||||||
|
#failed_when: "marker_ipv4_removed.rc > 1"
|
||||||
|
#changed_when: "marker_ipv4_removed.rc < 1"
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
|
||||||
|
- name: Remove marker IPv6
|
||||||
|
replace :
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||||
|
replace: ""
|
||||||
|
register: marker_ipv6_removed
|
||||||
|
#failed_when: "marker_ipv6_removed.rc > 1"
|
||||||
|
#changed_when: "marker_ipv6_removed.rc < 1"
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
|
||||||
|
- name: Remove marker IPv4 from interfaces_ipv4.conf
|
||||||
|
replace :
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||||
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||||
|
replace: ""
|
||||||
|
when:
|
||||||
|
- interfaces_ipv4_exists.stat.exists
|
||||||
|
|
||||||
|
- name: Remove marker IPv6 from interfaces_ipv6.conf
|
||||||
|
replace :
|
||||||
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||||
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||||
|
replace: ""
|
||||||
|
when:
|
||||||
|
- interfaces_ipv6_exists.stat.exists
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Confiuration Files
|
||||||
|
# ===
|
||||||
|
|
||||||
|
- name: Check if configuration files are latest
|
||||||
|
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
|
||||||
|
changed_when: "diff_script_output.rc > 0"
|
||||||
|
# diff_output.rc
|
||||||
|
# 0 -> unchanged
|
||||||
|
# 1 -> changed
|
||||||
|
# 2 -> not present
|
||||||
|
failed_when: "diff_script_output.rc > 2"
|
||||||
|
when:
|
||||||
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||||
|
loop:
|
||||||
|
- default_ports.conf
|
||||||
|
- include_functions.conf
|
||||||
|
- load_modules_ipv4.conf
|
||||||
|
- load_modules_ipv6.conf
|
||||||
|
- logging_ipv4.conf
|
||||||
|
- logging_ipv6.conf
|
||||||
|
- post_decalrations.conf
|
||||||
|
register: diff_script_output
|
||||||
|
|
||||||
|
- name: Ensure configuration files are latest
|
||||||
|
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
|
||||||
|
loop:
|
||||||
|
- default_ports.conf
|
||||||
|
- include_functions.conf
|
||||||
|
- load_modules_ipv4.conf
|
||||||
|
- load_modules_ipv6.conf
|
||||||
|
- logging_ipv4.conf
|
||||||
|
- logging_ipv6.conf
|
||||||
|
- post_decalrations.conf
|
||||||
|
when:
|
||||||
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||||
|
- diff_script_output.changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
# ===
|
||||||
|
# Firewall scripts
|
||||||
|
# ===
|
||||||
|
|
||||||
|
- name: Check if firewall scripts are latest
|
||||||
|
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
|
||||||
|
changed_when: "diff_script_output.rc > 0"
|
||||||
|
# diff_output.rc
|
||||||
|
# 0 -> unchanged
|
||||||
|
# 1 -> changed
|
||||||
|
# 2 -> not present
|
||||||
|
failed_when: "diff_script_output.rc > 2"
|
||||||
|
when:
|
||||||
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||||
|
loop:
|
||||||
|
- ipt-firewall-server
|
||||||
|
- ip6t-firewall-server
|
||||||
|
register: diff_script_output
|
||||||
|
|
||||||
|
- name: Ensure firewall scripts are latest
|
||||||
|
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
|
||||||
|
loop:
|
||||||
|
- ipt-firewall-server
|
||||||
|
- ip6t-firewall-server
|
||||||
|
when:
|
||||||
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||||
|
- diff_script_output.changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
@ -1,569 +1,9 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
# ===
|
- import_tasks: ipt-server.yml
|
||||||
# Install/Uodate git firewall repository
|
|
||||||
# ===
|
|
||||||
|
|
||||||
- meta: end_play
|
|
||||||
when: git_firewall_repository is not defined or git_firewall_repository|length < 1
|
|
||||||
|
|
||||||
|
|
||||||
- name: Install/update firewall repository
|
|
||||||
git:
|
|
||||||
repo: '{{ git_firewall_repository.repo }}'
|
|
||||||
dest: '{{ git_firewall_repository.dest }}'
|
|
||||||
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
|
||||||
# Some Checks
|
|
||||||
# ===
|
|
||||||
|
|
||||||
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
|
|
||||||
stat:
|
|
||||||
path: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
register: main_ipv6_exists
|
|
||||||
|
|
||||||
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
|
|
||||||
stat:
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
register: main_ipv4_exists
|
|
||||||
|
|
||||||
- name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists
|
|
||||||
stat:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
register: interfaces_ipv6_exists
|
|
||||||
|
|
||||||
- name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists
|
|
||||||
stat:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
register: interfaces_ipv4_exists
|
|
||||||
|
|
||||||
- name: Check if file '/etc/munin/munin-node.conf' exists
|
|
||||||
stat:
|
|
||||||
path: /etc/munin/munin-node.conf
|
|
||||||
register: munin_node_exists
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
|
||||||
# Adjust/Correct some values..
|
|
||||||
# ===
|
|
||||||
|
|
||||||
- name: addjust line 'munin_remote_ip' (IPv4)
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
regexp: '^munin_remote_ip='
|
|
||||||
line: 'munin_remote_ip="{{ munin_remote_ipv4 }}"'
|
|
||||||
when:
|
when:
|
||||||
- main_ipv4_exists.stat.exists
|
- inventory_hostname not in groups['gateway_server']
|
||||||
notify:
|
- inventory_hostname not in groups['no_ipt_firewall']
|
||||||
- Restart IPv4 Firewall
|
tags:
|
||||||
|
- git-firewall-repository
|
||||||
- name: addjust line 'munin_remote_ip' (IPv6)
|
- ipt-server
|
||||||
lineinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
regexp: '^munin_remote_ip='
|
|
||||||
line: 'munin_remote_ip="{{ munin_remote_ipv6 }}"'
|
|
||||||
when:
|
|
||||||
- main_ipv6_exists.stat.exists
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
- name: addjust line 'vpn_ifs' (IPv4)
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
regexp: '^vpn_ifs='
|
|
||||||
line: 'vpn_ifs="tun+"'
|
|
||||||
when:
|
|
||||||
- interfaces_ipv4_exists.stat.exists
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
- name: addjust line 'vpn_ifs' (IPv6)
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
regexp: '^vpn_ifs='
|
|
||||||
line: 'vpn_ifs="tun+"'
|
|
||||||
when:
|
|
||||||
- interfaces_ipv6_exists.stat.exists
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
|
||||||
# Add some Code Block.
|
|
||||||
# ===
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# Wireguard Service
|
|
||||||
# ---
|
|
||||||
|
|
||||||
- name: Check if String 'wg_ifs=..' is present in interfaces_ipv4.conf
|
|
||||||
shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
register: wg_ifs_interfaces_ipv4_present
|
|
||||||
when: interfaces_ipv4_exists.stat.exists
|
|
||||||
failed_when: "wg_ifs_interfaces_ipv4_present.rc > 1"
|
|
||||||
changed_when: "wg_ifs_interfaces_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (wg_ifs)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
insertafter: '^#?\s*vpn_ifs'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - Wireguard Interfaces
|
|
||||||
# - (comma separated list 'wg+' is also possible)
|
|
||||||
wg_ifs="wg+"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (wg_ifs)"
|
|
||||||
when:
|
|
||||||
- interfaces_ipv4_exists.stat.exists
|
|
||||||
- wg_ifs_interfaces_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'wg_ifs=..' is present in interfaces_ipv6.conf
|
|
||||||
shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
register: wg_ifs_interfaces_ipv6_present
|
|
||||||
when: interfaces_ipv6_exists.stat.exists
|
|
||||||
failed_when: "wg_ifs_interfaces_ipv6_present.rc > 1"
|
|
||||||
changed_when: "wg_ifs_interfaces_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (wg_ifs)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
insertafter: '^#?\s*vpn_ifs'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - Wireguard Interfaces
|
|
||||||
# - (comma separated list 'wg+' is also possible)
|
|
||||||
wg_ifs="wg+"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (wg_ifs)"
|
|
||||||
when:
|
|
||||||
- interfaces_ipv6_exists.stat.exists
|
|
||||||
- wg_ifs_interfaces_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'nat_devices=..' is present in interfaces_ipv4.conf
|
|
||||||
shell: grep -q -E "^nat_devices=" /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
register: nat_devices_interfaces_ipv4_present
|
|
||||||
when: interfaces_ipv4_exists.stat.exists
|
|
||||||
failed_when: "nat_devices_interfaces_ipv4_present.rc > 1"
|
|
||||||
changed_when: "nat_devices_interfaces_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (nat_devices)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
insertafter: '^#?\s*local_2_ip'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - Devices given in list "nat_devices" will be natted
|
|
||||||
# -
|
|
||||||
# - Blank separated list
|
|
||||||
# -
|
|
||||||
nat_devices=""
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (nat_devices)"
|
|
||||||
when:
|
|
||||||
- interfaces_ipv4_exists.stat.exists
|
|
||||||
- nat_devices_interfaces_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'nat_devices=..' is present in interfaces_ipv6.conf
|
|
||||||
shell: grep -q -E "^nat_devices=" /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
register: nat_devices_interfaces_ipv6_present
|
|
||||||
when: interfaces_ipv6_exists.stat.exists
|
|
||||||
failed_when: "nat_devices_interfaces_ipv6_present.rc > 1"
|
|
||||||
changed_when: "nat_devices_interfaces_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (nat_devices)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
insertafter: '^#?\s*local_2_ip'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - Devices given in list "nat_devices" will be natted
|
|
||||||
# -
|
|
||||||
# - Blank separated list
|
|
||||||
# -
|
|
||||||
nat_devices=""
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (nat_devices)"
|
|
||||||
when:
|
|
||||||
- interfaces_ipv6_exists.stat.exists
|
|
||||||
- nat_devices_interfaces_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'wireguard_server_ips=..' is present
|
|
||||||
shell: grep -q -E "^wireguard_server_ips=" /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
register: wireguard_service_ipv4_present
|
|
||||||
when: main_ipv4_exists.stat.exists
|
|
||||||
failed_when: "wireguard_service_ipv4_present.rc > 1"
|
|
||||||
changed_when: "wireguard_service_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (wireguard_service)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
insertafter: '^#?\s*vpn_ports'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - WireGuard Service
|
|
||||||
# -
|
|
||||||
wireguard_server_ips=""
|
|
||||||
forward_wireguard_server_ips=""
|
|
||||||
|
|
||||||
# - WireGuard Ports used by local Service
|
|
||||||
# -
|
|
||||||
# - Blank separated list
|
|
||||||
# -
|
|
||||||
wireguard_server_ports="$standard_wireguard_port"
|
|
||||||
|
|
||||||
# - Remote WireGuard Ports
|
|
||||||
# -
|
|
||||||
wireguard_out_ports="$standard_wireguard_port"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
|
||||||
when:
|
|
||||||
- main_ipv4_exists.stat.exists
|
|
||||||
- wireguard_service_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'wireguard_server_ips=..' is present
|
|
||||||
shell: grep -q -E "^wireguard_server_ips=" /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
register: wireguard_service_ipv6_present
|
|
||||||
when: main_ipv6_exists.stat.exists
|
|
||||||
failed_when: "wireguard_service_ipv6_present.rc > 1"
|
|
||||||
changed_when: "wireguard_service_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (wireguard_service)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
insertafter: '^#?\s*vpn_ports'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - WireGuard Service
|
|
||||||
# -
|
|
||||||
wireguard_server_ips=""
|
|
||||||
forward_wireguard_server_ips=""
|
|
||||||
|
|
||||||
# - WireGuard Ports used by local Service
|
|
||||||
# -
|
|
||||||
# - Blank separated list
|
|
||||||
# -
|
|
||||||
wireguard_server_ports="$standard_wireguard_port"
|
|
||||||
|
|
||||||
# - Remote WireGuard Ports
|
|
||||||
# -
|
|
||||||
wireguard_out_ports="$standard_wireguard_port"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
|
||||||
when:
|
|
||||||
- main_ipv6_exists.stat.exists
|
|
||||||
- wireguard_service_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# Mattermost (MM) Service
|
|
||||||
# ---
|
|
||||||
|
|
||||||
- name: Check if String 'mm_server_ips=..' is present
|
|
||||||
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
register: mattermost_service_ipv4_present
|
|
||||||
when: main_ipv4_exists.stat.exists
|
|
||||||
failed_when: "mattermost_service_ipv4_present.rc > 1"
|
|
||||||
changed_when: "mattermost_service_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mattermost_service)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
insertafter: '^#?\s*http_ports'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - Mattermost (MM) Service
|
|
||||||
# -
|
|
||||||
mm_server_ips=""
|
|
||||||
forward_mm_server_ips=""
|
|
||||||
|
|
||||||
# - UDP Ports IN and OUT used by MM Servive
|
|
||||||
# -
|
|
||||||
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
|
||||||
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
|
||||||
when:
|
|
||||||
- main_ipv4_exists.stat.exists
|
|
||||||
- mattermost_service_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'mm_server_ips=..' is present
|
|
||||||
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
register: mattermost_service_ipv6_present
|
|
||||||
when: main_ipv6_exists.stat.exists
|
|
||||||
failed_when: "mattermost_service_ipv6_present.rc > 1"
|
|
||||||
changed_when: "mattermost_service_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mattermost_service)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
insertafter: '^#?\s*http_ports'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# - Mattermost (MM) Service
|
|
||||||
# -
|
|
||||||
mm_server_ips=""
|
|
||||||
forward_mm_server_ips=""
|
|
||||||
|
|
||||||
# - UDP Ports IN and OUT used by MM Servive
|
|
||||||
# -
|
|
||||||
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
|
||||||
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
|
||||||
when:
|
|
||||||
- main_ipv6_exists.stat.exists
|
|
||||||
- mattermost_service_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# Protection against and Limit Connections settings
|
|
||||||
# ---
|
|
||||||
|
|
||||||
- name: Check if String 'protection_against_syn_flooding=..' is present
|
|
||||||
shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
register: protect_settings_ipv4_present
|
|
||||||
when: main_ipv4_exists.stat.exists
|
|
||||||
failed_when: "protect_settings_ipv4_present.rc > 1"
|
|
||||||
changed_when: "protect_settings_ipv4_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
insertafter: '^#?\s*create_iperf_rules'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# - Protection against ...
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# - Protection against syn-flooding
|
|
||||||
# -
|
|
||||||
protection_against_syn_flooding=true
|
|
||||||
|
|
||||||
# - Protection against port scanning
|
|
||||||
# -
|
|
||||||
protection_against_port_scanning=true
|
|
||||||
|
|
||||||
# - Protection against SSH brute-force attacks
|
|
||||||
# -
|
|
||||||
protection_against_ssh_brute_force_attacks=true
|
|
||||||
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# - Limit Connections
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# - Limit connections per source IP
|
|
||||||
# -
|
|
||||||
limit_connections_per_source_IP=true
|
|
||||||
|
|
||||||
# - Limit RST packets
|
|
||||||
# -
|
|
||||||
limit_rst_packets=true
|
|
||||||
|
|
||||||
# - Limit new TCP connections per second per source IP
|
|
||||||
# -
|
|
||||||
limit_new_tcp_connections_per_seconds_per_source_IP=true
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
|
|
||||||
when:
|
|
||||||
- main_ipv4_exists.stat.exists
|
|
||||||
- protect_settings_ipv4_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
- name: Check if String 'protection_against_syn_flooding=..' is present
|
|
||||||
shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
register: protect_settings_ipv6_present
|
|
||||||
when: main_ipv6_exists.stat.exists
|
|
||||||
failed_when: "protect_settings_ipv6_present.rc > 1"
|
|
||||||
changed_when: "protect_settings_ipv6_present.rc > 0"
|
|
||||||
|
|
||||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
insertafter: '^#?\s*create_iperf_rules'
|
|
||||||
block: |
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# - Protection against ...
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# - Protection against syn-flooding
|
|
||||||
# -
|
|
||||||
protection_against_syn_flooding=true
|
|
||||||
|
|
||||||
# - Protection against port scanning
|
|
||||||
# -
|
|
||||||
protection_against_port_scanning=true
|
|
||||||
|
|
||||||
# - Protection against SSH brute-force attacks
|
|
||||||
# -
|
|
||||||
protection_against_ssh_brute_force_attacks=true
|
|
||||||
|
|
||||||
|
|
||||||
# -------------
|
|
||||||
# - Limit Connections
|
|
||||||
# -------------
|
|
||||||
|
|
||||||
# - Limit connections per source IP
|
|
||||||
# -
|
|
||||||
limit_connections_per_source_IP=true
|
|
||||||
|
|
||||||
# - Limit RST packets
|
|
||||||
# -
|
|
||||||
limit_rst_packets=true
|
|
||||||
|
|
||||||
# - Limit new TCP connections per second per source IP
|
|
||||||
# -
|
|
||||||
limit_new_tcp_connections_per_seconds_per_source_IP=true
|
|
||||||
|
|
||||||
marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
|
|
||||||
when:
|
|
||||||
- main_ipv6_exists.stat.exists
|
|
||||||
- protect_settings_ipv6_present is changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
|
||||||
# ===
|
|
||||||
# Remove Marker set by blockinfile
|
|
||||||
# ===
|
|
||||||
|
|
||||||
- name: Remove marker IPv4
|
|
||||||
replace :
|
|
||||||
path: /etc/ipt-firewall/main_ipv4.conf
|
|
||||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
||||||
replace: ""
|
|
||||||
register: marker_ipv4_removed
|
|
||||||
#failed_when: "marker_ipv4_removed.rc > 1"
|
|
||||||
#changed_when: "marker_ipv4_removed.rc < 1"
|
|
||||||
when:
|
|
||||||
- main_ipv4_exists.stat.exists
|
|
||||||
|
|
||||||
- name: Remove marker IPv6
|
|
||||||
replace :
|
|
||||||
path: /etc/ipt-firewall/main_ipv6.conf
|
|
||||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
||||||
replace: ""
|
|
||||||
register: marker_ipv6_removed
|
|
||||||
#failed_when: "marker_ipv6_removed.rc > 1"
|
|
||||||
#changed_when: "marker_ipv6_removed.rc < 1"
|
|
||||||
when:
|
|
||||||
- main_ipv6_exists.stat.exists
|
|
||||||
|
|
||||||
- name: Remove marker IPv4 from interfaces_ipv4.conf
|
|
||||||
replace :
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
||||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
||||||
replace: ""
|
|
||||||
when:
|
|
||||||
- interfaces_ipv4_exists.stat.exists
|
|
||||||
|
|
||||||
- name: Remove marker IPv6 from interfaces_ipv6.conf
|
|
||||||
replace :
|
|
||||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
||||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
||||||
replace: ""
|
|
||||||
when:
|
|
||||||
- interfaces_ipv6_exists.stat.exists
|
|
||||||
|
|
||||||
# ===
|
|
||||||
# Confiuration Files
|
|
||||||
# ===
|
|
||||||
|
|
||||||
- name: Check if configuration files are latest
|
|
||||||
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
|
|
||||||
changed_when: "diff_script_output.rc > 0"
|
|
||||||
# diff_output.rc
|
|
||||||
# 0 -> unchanged
|
|
||||||
# 1 -> changed
|
|
||||||
# 2 -> not present
|
|
||||||
failed_when: "diff_script_output.rc > 2"
|
|
||||||
when:
|
|
||||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
||||||
loop:
|
|
||||||
- default_ports.conf
|
|
||||||
- include_functions.conf
|
|
||||||
- load_modules_ipv4.conf
|
|
||||||
- load_modules_ipv6.conf
|
|
||||||
- logging_ipv4.conf
|
|
||||||
- logging_ipv6.conf
|
|
||||||
- post_decalrations.conf
|
|
||||||
register: diff_script_output
|
|
||||||
|
|
||||||
- name: Ensure configuration files are latest
|
|
||||||
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
|
|
||||||
loop:
|
|
||||||
- default_ports.conf
|
|
||||||
- include_functions.conf
|
|
||||||
- load_modules_ipv4.conf
|
|
||||||
- load_modules_ipv6.conf
|
|
||||||
- logging_ipv4.conf
|
|
||||||
- logging_ipv6.conf
|
|
||||||
- post_decalrations.conf
|
|
||||||
when:
|
|
||||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
||||||
- diff_script_output.changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
# ===
|
|
||||||
# Firewall scripts
|
|
||||||
# ===
|
|
||||||
|
|
||||||
- name: Check if firewall scripts are latest
|
|
||||||
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
|
|
||||||
changed_when: "diff_script_output.rc > 0"
|
|
||||||
# diff_output.rc
|
|
||||||
# 0 -> unchanged
|
|
||||||
# 1 -> changed
|
|
||||||
# 2 -> not present
|
|
||||||
failed_when: "diff_script_output.rc > 2"
|
|
||||||
when:
|
|
||||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
||||||
loop:
|
|
||||||
- ipt-firewall-server
|
|
||||||
- ip6t-firewall-server
|
|
||||||
register: diff_script_output
|
|
||||||
|
|
||||||
- name: Ensure firewall scripts are latest
|
|
||||||
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
|
|
||||||
loop:
|
|
||||||
- ipt-firewall-server
|
|
||||||
- ip6t-firewall-server
|
|
||||||
when:
|
|
||||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
||||||
- diff_script_output.changed
|
|
||||||
notify:
|
|
||||||
- Restart IPv4 Firewall
|
|
||||||
- Restart IPv6 Firewall
|
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user