update..

host_vars/a.ns.oopen.de.yml

@@ -137,7 +137,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/b.mx.oopen.de.yml

@@ -89,7 +89,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/b.ns.oopen.de.yml

@@ -131,7 +131,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/backup.oopen.de.yml

@@ -88,7 +88,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/bbb-server.b3-bornim.netz.yml

@@ -136,7 +136,7 @@ resolved_domains:
   - ~.
   - b3-bornim.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/cl-fm.oopen.de.yml

@@ -91,7 +91,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/cl-irights.oopen.de.yml

@@ -91,7 +91,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/cl-opp.oopen.de.yml

@@ -91,7 +91,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/cl-test.oopen.de.yml

@@ -88,7 +88,7 @@ resolved_nameserver:
 resolved_domains:
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/cp-01.oopen.de.yml

@@ -93,7 +93,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/d.mx.oopen.de.yml

@@ -91,7 +91,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/dc-opp.oopen.de.yml

@@ -91,7 +91,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/dns1.warenform.de.yml

@@ -89,7 +89,7 @@ resolved_domains:
   - ~.
   - warenform.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/e.mx.oopen.de.yml

@@ -91,7 +91,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/file-blkr-alt.blkr.netz.yml

@@ -157,7 +157,7 @@ resolved_domains:
   - ~.
   - blkr.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/file-blkr.blkr.netz.yml

@@ -157,7 +157,7 @@ resolved_domains:
   - ~.
   - blkr.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/file-ebs.ebs.netz.yml

@@ -166,7 +166,7 @@ resolved_domains:
   - ~.
   - ebs.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/file-fhxb.fhxb.netz.yml

@@ -136,7 +136,7 @@ resolved_domains:
   - ~.
   - fhxb.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/ga-nh-gw.oopen.de.yml

@@ -206,7 +206,7 @@ resolved_domains:
   - ga.netz
   - ga.intra
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/git.oopen.de.yml

@@ -88,7 +88,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-123.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   - 123.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-ak.oopen.de.yml

@@ -148,7 +148,7 @@ resolved_domains:
   - ~.
   - ak.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-akb.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   - akb.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-b3.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   - b3-bornim.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-blkr.oopen.de.yml

@@ -219,7 +219,7 @@ resolved_domains:
   - ~.
   - blkr.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-ckubu.local.netz.yml

@@ -94,7 +94,7 @@ resolved_domains:
   - ~.
   - local.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-d11.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   - wf.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-ebs.oopen.de.yml

@@ -149,7 +149,7 @@ resolved_domains:
   - ~.
   - ebs.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-elster.oopen.de.yml

@@ -214,7 +214,7 @@ resolved_domains:
   - ~.
   - elster.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-fhxb.oopen.de.yml

@@ -148,7 +148,7 @@ resolved_domains:
   - ~.
   - fhxb.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-irights.oopen.de.yml

@@ -209,7 +209,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-opp.oopen.de.yml

@@ -148,7 +148,7 @@ resolved_domains:
   - ~.
   - opp.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-replacment.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   -local.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-replacment2.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   -local.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-replacment3.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   -local.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/gw-spr.oopen.de.yml

@@ -103,7 +103,7 @@ resolved_domains:
   - ~.
   - sprachenatelier.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/lists.mx.warenform.de.yml

@@ -91,7 +91,7 @@ resolved_domains:
   - ~.
   - warenform.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/matomo-01.oopen.de.yml

@@ -92,7 +92,7 @@ resolved_nameserver:
 resolved_domains:
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/meet.oopen.de.yml

@@ -94,7 +94,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/mm-irights.oopen.de.yml

@@ -92,7 +92,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/mm.oopen.de.yml

@@ -92,7 +92,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/munin.oopen.de.yml

@@ -92,7 +92,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/o23.oopen.de.yml

@@ -212,7 +212,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/o24.oopen.de.yml

@@ -214,7 +214,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/o27.oopen.de.yml

@@ -214,7 +214,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/o28.oopen.de.yml

@@ -321,7 +321,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/o29.oopen.de.yml

@@ -210,7 +210,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/rage.so36.net.yml

@@ -88,7 +88,7 @@ resolved_domains:
   - ~.
   - so36.net
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/server18.warenform.de.yml

@@ -211,7 +211,7 @@ resolved_domains:
   - ~.
   - warenform.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/server23.warenform.de.yml

@@ -211,7 +211,7 @@ resolved_domains:
   - ~.
   - warenform.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/server26.warenform.de.yml

@@ -221,7 +221,7 @@ resolved_domains:
   - ~.
   - warenform.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/server28.warenform.de.yml

@@ -217,7 +217,7 @@ resolved_domains:
   - ~.
   - warenform.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/stolpersteine.oopen.de.yml

@@ -83,7 +83,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/web-02.oopen.de.yml

@@ -92,7 +92,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/web-03.oopen.de.yml

@@ -92,7 +92,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/web-test.oopen.de.yml

@@ -88,7 +88,7 @@ resolved_domains:
   - ~.
   - oopen.de
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

host_vars/zapata.opp.netz.yml

@@ -136,7 +136,7 @@ resolved_domains:
   - ~.
   - opp.netz
 
-resolved_dnssec: true
+resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #

roles/modify-ipt-server/tasks/ipt-server.yml

@@ -299,7 +299,7 @@
 
 
 # ---
-# Mattermost (MM) Service
+# Mattermost (MM) Service (add a block)
 # ---
 
 - name: Check if String 'mm_server_ips=..' is present
@@ -366,113 +366,43 @@
 
 
 # ---
-# Protection against and Limit Connections settings
+# Per IP Connection Limit (add a line)
 # ---
 
-- name: Check if String 'protection_against_syn_flooding=..' is present
+- name: Check if String 'per_IP_connection_limit=..' is present
-  shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv4.conf
+  shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv4.conf
-  register: protect_settings_ipv4_present
+  register: per_ip_connection_limit_settings_ipv4_present
   when: main_ipv4_exists.stat.exists
-  failed_when: "protect_settings_ipv4_present.rc > 1"
+  failed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 1"
-  changed_when: "protect_settings_ipv4_present.rc > 0"
+  changed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 0"
 
 - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
-  blockinfile:
+  lineinfile:
     path: /etc/ipt-firewall/main_ipv4.conf
-    insertafter: '^#?\s*create_iperf_rules'
+    insertafter: '^#?\s*limit_connections_per_source_IP'
-    block: |
+    line: per_IP_connection_limit=$default_per_IP_connection_limit
-
-      # -------------
-      # - Protection against ...
-      # -------------
-
-      # - Protection against syn-flooding
-      # -
-      protection_against_syn_flooding=true
-
-      # - Protection against port scanning
-      # -
-      protection_against_port_scanning=true
-
-      # - Protection against SSH brute-force attacks
-      # -
-      protection_against_ssh_brute_force_attacks=true
-
-
-      # -------------
-      # - Limit Connections
-      # -------------
-
-      # - Limit connections per source IP
-      # -
-      limit_connections_per_source_IP=true
-
-      # - Limit RST packets
-      # -
-      limit_rst_packets=true
-
-      # - Limit new TCP connections per second per source IP
-      # -
-      limit_new_tcp_connections_per_seconds_per_source_IP=true
-
-    marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
   when:
     - main_ipv4_exists.stat.exists
-    - protect_settings_ipv4_present is changed
+    - per_ip_connection_limit_settings_ipv4_present is changed
   notify:
     - Restart IPv4 Firewall
 
 
-- name: Check if String 'protection_against_syn_flooding=..' is present
+- name: Check if String 'per_IP_connection_limit=..' is present
-  shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv6.conf
+  shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv6.conf
-  register: protect_settings_ipv6_present
+  register: per_ip_connection_limit_settings_ipv6_present
   when: main_ipv6_exists.stat.exists
-  failed_when: "protect_settings_ipv6_present.rc > 1"
+  failed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 1"
-  changed_when: "protect_settings_ipv6_present.rc > 0"
+  changed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 0"
 
 - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
-  blockinfile:
+  lineinfile:
-    path: /etc/ipt-firewall/main_ipv6.conf
+    dest: /etc/ipt-firewall/main_ipv6.conf
-    insertafter: '^#?\s*create_iperf_rules'
+    insertafter: '^#?\s*limit_connections_per_source_IP'
-    block: |
+    line: per_IP_connection_limit=$default_per_IP_connection_limit
-
-      # -------------
-      # - Protection against ...
-      # -------------
-
-      # - Protection against syn-flooding
-      # -
-      protection_against_syn_flooding=true
-
-      # - Protection against port scanning
-      # -
-      protection_against_port_scanning=true
-
-      # - Protection against SSH brute-force attacks
-      # -
-      protection_against_ssh_brute_force_attacks=true
-
-
-      # -------------
-      # - Limit Connections
-      # -------------
-
-      # - Limit connections per source IP
-      # -
-      limit_connections_per_source_IP=true
-
-      # - Limit RST packets
-      # -
-      limit_rst_packets=true
-
-      # - Limit new TCP connections per second per source IP
-      # -
-      limit_new_tcp_connections_per_seconds_per_source_IP=true
-
-    marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
   when:
     - main_ipv6_exists.stat.exists
-    - protect_settings_ipv6_present is changed
+    - per_ip_connection_limit_settings_ipv6_present is changed
   notify:
     - Restart IPv6 Firewall
 
@@ -534,7 +464,7 @@
   when: 
     - git_firewall_repository is defined and git_firewall_repository|length > 0
   loop:
-     - default_ports.conf
+     - default_settings.conf
      - include_functions.conf
      - load_modules_ipv4.conf
      - load_modules_ipv6.conf
@@ -546,7 +476,7 @@
 - name: Ensure configuration files are latest
   command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
   loop:
-     - default_ports.conf
+     - default_settings.conf
      - include_functions.conf
      - load_modules_ipv4.conf
      - load_modules_ipv6.conf