--- # === # Install/Uodate git firewall repository # === #- meta: end_play # when: # - inventory_hostname in groups['gateway_server'] or inventory_hostname in groups['no_ipt_firewall'] or git_firewall_repository is not defined or git_firewall_repository|length < 1 - name: Install/update firewall repository git: repo: '{{ git_firewall_repository.repo }}' dest: '{{ git_firewall_repository.dest }}' when: git_firewall_repository is defined and git_firewall_repository|length > 0 # === # Some Checks # === - name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists stat: path: /etc/ipt-firewall/main_ipv6.conf register: main_ipv6_exists - name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists stat: path: /etc/ipt-firewall/main_ipv4.conf register: main_ipv4_exists - name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists stat: path: /etc/ipt-firewall/interfaces_ipv6.conf register: interfaces_ipv6_exists - name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists stat: path: /etc/ipt-firewall/interfaces_ipv4.conf register: interfaces_ipv4_exists - name: Check if file '/etc/munin/munin-node.conf' exists stat: path: /etc/munin/munin-node.conf register: munin_node_exists # === # Adjust/Correct some values.. # === - name: addjust line 'munin_remote_ip' (IPv4) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^munin_remote_ip=' line: 'munin_remote_ip="{{ munin_remote_ipv4 }}"' when: - main_ipv4_exists.stat.exists notify: - Restart IPv4 Firewall - name: addjust line 'munin_remote_ip' (IPv6) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^munin_remote_ip=' line: 'munin_remote_ip="{{ munin_remote_ipv6 }}"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall - name: addjust line 'vpn_ifs' (IPv4) lineinfile: path: /etc/ipt-firewall/interfaces_ipv4.conf regexp: '^vpn_ifs=' line: 'vpn_ifs="tun+"' when: - interfaces_ipv4_exists.stat.exists notify: - Restart IPv4 Firewall - name: addjust line 'vpn_ifs' (IPv6) lineinfile: path: /etc/ipt-firewall/interfaces_ipv6.conf regexp: '^vpn_ifs=' line: 'vpn_ifs="tun+"' when: - interfaces_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall # === # Add some Code Block. # === # --- # Wireguard Service # --- - name: Check if String 'wg_ifs=..' is present in interfaces_ipv4.conf shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv4.conf register: wg_ifs_interfaces_ipv4_present when: interfaces_ipv4_exists.stat.exists failed_when: "wg_ifs_interfaces_ipv4_present.rc > 1" changed_when: "wg_ifs_interfaces_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (wg_ifs) blockinfile: path: /etc/ipt-firewall/interfaces_ipv4.conf insertafter: '^#?\s*vpn_ifs' block: | # - Wireguard Interfaces # - (comma separated list 'wg+' is also possible) wg_ifs="wg+" marker: "# Marker set by modify-ipt-server.yml (wg_ifs)" when: - interfaces_ipv4_exists.stat.exists - wg_ifs_interfaces_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'wg_ifs=..' is present in interfaces_ipv6.conf shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv6.conf register: wg_ifs_interfaces_ipv6_present when: interfaces_ipv6_exists.stat.exists failed_when: "wg_ifs_interfaces_ipv6_present.rc > 1" changed_when: "wg_ifs_interfaces_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (wg_ifs) blockinfile: path: /etc/ipt-firewall/interfaces_ipv6.conf insertafter: '^#?\s*vpn_ifs' block: | # - Wireguard Interfaces # - (comma separated list 'wg+' is also possible) wg_ifs="wg+" marker: "# Marker set by modify-ipt-server.yml (wg_ifs)" when: - interfaces_ipv6_exists.stat.exists - wg_ifs_interfaces_ipv6_present is changed notify: - Restart IPv6 Firewall - name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv4.conf shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv4.conf register: lxc_guest_ips_interfaces_ipv4_present when: interfaces_ipv4_exists.stat.exists failed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 1" changed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (lxc_guest_ips) blockinfile: path: /etc/ipt-firewall/interfaces_ipv4.conf insertafter: '^#?\s*local_3_ip' block: | local_ips="$local_1_ip $local_2_ip $local_3_ip" # ------------- # --- IP-Addresses LXC Guest sSystems # ------------- # for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done # NOT IN USE lxc_guest_1_ip="" # NOT IN USE lxc_guest_2_ip="" # NOT IN USE lxc_guest_3_ip="" # NOT IN USE lxc_guest_4_ip="" # NOT IN USE lxc_guest_5_ip="" # NOT IN USE lxc_guest_6_ip="" # NOT IN USE lxc_guest_7_ip="" lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip" marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)" when: - interfaces_ipv4_exists.stat.exists - lxc_guest_ips_interfaces_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv6.conf shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv6.conf register: lxc_guest_ips_interfaces_ipv6_present when: interfaces_ipv6_exists.stat.exists failed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 1" changed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (lxc_guest_ips) blockinfile: path: /etc/ipt-firewall/interfaces_ipv6.conf insertafter: '^#?\s*local_3_ip' block: | local_ips="$local_1_ip $local_2_ip $local_3_ip" # ------------- # --- IP-Addresses LXC Guest sSystems # ------------- # for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done # NOT IN USE lxc_guest_1_ip="" # NOT IN USE lxc_guest_2_ip="" # NOT IN USE lxc_guest_3_ip="" # NOT IN USE lxc_guest_4_ip="" # NOT IN USE lxc_guest_5_ip="" # NOT IN USE lxc_guest_6_ip="" # NOT IN USE lxc_guest_7_ip="" lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip" marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)" when: - interfaces_ipv6_exists.stat.exists - lxc_guest_ips_interfaces_ipv6_present is changed notify: - Restart IPv6 Firewall - name: Check if String 'do_not_firewall_lx_guest_systems=..' is present shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv4.conf register: wireguard_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "wireguard_service_ipv4_present.rc > 1" changed_when: "wireguard_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (do_not_firewall_lx_guest_systems) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*do_not_firewall_bridged_traffic' block: | # ------------- # --- Do not firewall traffic from and to LX Gust Systems # ------------- # - Traffic to hosted LX containers are not firewalled here. # - do_not_firewall_lx_guest_systems=false marker: "# Marker set by modify-ipt-server.yml (wireguard_service)" when: - main_ipv4_exists.stat.exists - wireguard_service_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'do_not_firewall_lx_guest_systems=..' is present shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv6.conf register: wireguard_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "wireguard_service_ipv6_present.rc > 1" changed_when: "wireguard_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (do_not_firewall_lx_guest_systems) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*do_not_firewall_bridged_traffic' block: | # ------------- # --- Do not firewall traffic from and to LX Gust Systems # ------------- # - Traffic to hosted LX containers are not firewalled here. # - do_not_firewall_lx_guest_systems=false marker: "# Marker set by modify-ipt-server.yml (wireguard_service)" when: - main_ipv6_exists.stat.exists - wireguard_service_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # Mattermost (MM) Service (add a block) # --- - name: Check if String 'mm_server_ips=..' is present shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv4.conf register: mattermost_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "mattermost_service_ipv4_present.rc > 1" changed_when: "mattermost_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mattermost_service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*http_ports' block: | # - Mattermost (MM) Service # - mm_server_ips="" forward_mm_server_ips="" # - UDP Ports IN and OUT used by MM Servive # - mm_udp_ports_in="$stansard_mattermost_udp_ports_in" mm_udp_ports_out="$stansard_mattermost_udp_ports_out" marker: "# Marker set by modify-ipt-server.yml (mattermost_service)" when: - main_ipv4_exists.stat.exists - mattermost_service_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'mm_server_ips=..' is present shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv6.conf register: mattermost_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "mattermost_service_ipv6_present.rc > 1" changed_when: "mattermost_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mattermost_service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*http_ports' block: | # - Mattermost (MM) Service # - mm_server_ips="" forward_mm_server_ips="" # - UDP Ports IN and OUT used by MM Servive # - mm_udp_ports_in="$stansard_mattermost_udp_ports_in" mm_udp_ports_out="$stansard_mattermost_udp_ports_out" marker: "# Marker set by modify-ipt-server.yml (mattermost_service)" when: - main_ipv6_exists.stat.exists - mattermost_service_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # Per IP Connection Limit (add a line) # --- - name: Check if String 'per_IP_connection_limit=..' is present shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv4.conf register: per_ip_connection_limit_settings_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 1" changed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*limit_connections_per_source_IP' line: per_IP_connection_limit=$default_per_IP_connection_limit when: - main_ipv4_exists.stat.exists - per_ip_connection_limit_settings_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'per_IP_connection_limit=..' is present shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv6.conf register: per_ip_connection_limit_settings_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 1" changed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*limit_connections_per_source_IP' line: per_IP_connection_limit=$default_per_IP_connection_limit when: - main_ipv6_exists.stat.exists - per_ip_connection_limit_settings_ipv6_present is changed notify: - Restart IPv6 Firewall # === # Remove Marker set by blockinfile # === - name: Remove marker IPv4 replace : path: /etc/ipt-firewall/main_ipv4.conf regexp: "^# Marker set by modify-ipt-server.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - main_ipv4_exists.stat.exists - name: Remove marker IPv6 replace : path: /etc/ipt-firewall/main_ipv6.conf regexp: "^# Marker set by modify-ipt-server.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - main_ipv6_exists.stat.exists - name: Remove marker IPv4 from interfaces_ipv4.conf replace : path: /etc/ipt-firewall/interfaces_ipv4.conf regexp: "^# Marker set by modify-ipt-server.yml.*$" replace: "" when: - interfaces_ipv4_exists.stat.exists - name: Remove marker IPv6 from interfaces_ipv6.conf replace : path: /etc/ipt-firewall/interfaces_ipv6.conf regexp: "^# Marker set by modify-ipt-server.yml.*$" replace: "" when: - interfaces_ipv6_exists.stat.exists # === # Confiuration Files # === - name: Check if configuration files are latest shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: - git_firewall_repository is defined and git_firewall_repository|length > 0 loop: - default_settings.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf register: diff_script_output - name: Ensure configuration files are latest command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} loop: - default_settings.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf when: - git_firewall_repository is defined and git_firewall_repository|length > 0 - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # === # Firewall scripts # === - name: Check if firewall scripts are latest shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: - git_firewall_repository is defined and git_firewall_repository|length > 0 loop: - ipt-firewall-server - ip6t-firewall-server register: diff_script_output - name: Ensure firewall scripts are latest command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} loop: - ipt-firewall-server - ip6t-firewall-server when: - git_firewall_repository is defined and git_firewall_repository|length > 0 - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall