--- # --- # Install/Uodate git firewall repository # --- - name: Install/update firewall repository git: repo: '{{ git_firewall_repository.repo }}' dest: '{{ git_firewall_repository.dest }}' when: git_firewall_repository is defined and git_firewall_repository|length > 0 # --- # Some Checks # --- - name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists stat: path: /etc/ipt-firewall/main_ipv4.conf register: main_ipv4_exists notify: - Restart IPv4 Firewall - name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists stat: path: /etc/ipt-firewall/main_ipv6.conf register: main_ipv6_exists notify: - Restart IPv6 Firewall - name: addjust line 'jitsi_tcp_ports' (IPv4) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^jitsi_tcp_ports=' line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"' when: - main_ipv4_exists.stat.exists notify: - Restart IPv4 Firewall - name: addjust line 'jitsi_tcp_ports' (IPv6) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^jitsi_tcp_ports=' line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall - name: addjust line 'jitsi_udp_ports' (IPv4) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"' when: - main_ipv4_exists.stat.exists notify: - Restart IPv4 Firewall - name: addjust line 'jitsi_udp_ports' (IPv6) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall - name: addjust line 'brscan_port' (IPv4) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^brscan_port=' line: 'brscan_port="$standard_brother_brscan_port"' when: - main_ipv4_exists.stat.exists notify: - Restart IPv4 Firewall - name: addjust line 'brscan_port' (IPv6) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^brscan_port=' line: 'brscan_port="$standard_brother_brscan_port"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall # --- # allow_jitsi_video_conference_out # --- - name: Check if String 'allow_jitsi_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf register: jitsi_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "jitsi_video_conference_out_ipv4_present.rc > 1" changed_when: "jitsi_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_jitsi_video_conference_out' line: 'allow_jitsi_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv4_exists.stat.exists - jitsi_video_conference_out_ipv4_present is changed - name: Check if String 'allow_jitsi_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf register: jitsi_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "jitsi_video_conference_out_ipv6_present.rc > 1" changed_when: "jitsi_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_jitsi_video_conference_out' line: 'allow_jitsi_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv6_exists.stat.exists - jitsi_video_conference_out_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # allow_nc_talk_out # --- - name: Check if String 'allow_nc_talk_out..' (IPv4) is present shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv4.conf register: nc_talk_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "nc_talk_out_ipv4_present.rc > 1" changed_when: "nc_talk_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_nc_talk_out' line: 'allow_nc_talk_out=true' insertafter: '^#?\s*allow_jitsi_video_conference_out' when: - main_ipv4_exists.stat.exists - nc_talk_out_ipv4_present is changed - name: Check if String 'allow_nc_talk_out..' (IPv6) is present shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv6.conf register: nc_talk_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "nc_talk_out_ipv6_present.rc > 1" changed_when: "nc_talk_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_nc_talk_out' line: 'allow_nc_talk_out=true' insertafter: '^#?\s*allow_jitsi_video_conference_out' when: - main_ipv6_exists.stat.exists - nc_talk_out_ipv6_present is changed # --- # allow_bigbluebutton_video_conference_out # --- - name: Check if String 'allow_bigbluebutton_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_bigbluebutton_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf register: bigbluebutton_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "bigbluebutton_video_conference_out_ipv4_present.rc > 1" changed_when: "bigbluebutton_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_bigbluebutton_video_conference_out' line: 'allow_bigbluebutton_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv4_exists.stat.exists - bigbluebutton_video_conference_out_ipv4_present is changed - name: Check if String 'allow_bigbluebutton_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_bigbluebutton_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf register: bigbluebutton_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "bigbluebutton_video_conference_out_ipv6_present.rc > 1" changed_when: "bigbluebutton_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_bigbluebutton_video_conference_out' line: 'allow_bigbluebutton_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv6_exists.stat.exists - bigbluebutton_video_conference_out_ipv6_present is changed # --- # allow_webex_video_conference_out # --- - name: Check if String 'allow_webex_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_webex_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf register: webex_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "webex_video_conference_out_ipv4_present.rc > 1" changed_when: "webex_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (webex) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_webex_video_conference_out' line: 'allow_webex_video_conference_out=true' insertafter: '^#?\s*allow_bigbluebutton_video_conference_out' when: - main_ipv4_exists.stat.exists - webex_video_conference_out_ipv4_present is changed - name: Check if String 'allow_webex_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_webex_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf register: webex_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "webex_video_conference_out_ipv6_present.rc > 1" changed_when: "webex_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (webex) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_webex_video_conference_out' line: 'allow_webex_video_conference_out=true' insertafter: '^#?\s*allow_bigbluebutton_video_conference_out' when: - main_ipv6_exists.stat.exists - webex_video_conference_out_ipv6_present is changed # --- # allow_alfaview_video_conference_out # --- - name: Check if String 'allow_alfaview_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_alfaview_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf register: alfaview_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "alfaview_video_conference_out_ipv4_present.rc > 1" changed_when: "alfaview_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_alfaview_video_conference_out' line: 'allow_alfaview_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv4_exists.stat.exists - alfaview_video_conference_out_ipv4_present is changed - name: Check if String 'allow_alfaview_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_alfaview_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf register: alfaview_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "alfaview_video_conference_out_ipv6_present.rc > 1" changed_when: "alfaview_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_alfaview_video_conference_out' line: 'allow_alfaview_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv6_exists.stat.exists - alfaview_video_conference_out_ipv6_present is changed # --- # Allow local services from ALL extern netwoks # --- - name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv4) is present shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /etc/ipt-firewall/main_ipv4.conf register: allow_all_ext_traffic_to_local_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 1" changed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (allow_all_ext_traffic_to_local_service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*any_access_from_inet_networks' block: | # ============= # - Allow local services from ALL extern netwoks # ============= # - allow_all_ext_traffic_to_local_service # - # - allow_all_ext_traffic_to_local_service="local-address:port:protocol [local-address:port:protocol] .." # - # - Note: # - ===== # - - Only 'tcp' and 'udp' are allowed valuse for protocol. # - # - Example: # - allow extern traffic to service at 83.223.73.210 on port 1036 # - allow extern traffic to https service at 83.223.73.204 # - # - allow_ext_net_to_local_service=" # - 83.223.73.210:1036:tcp # - 83.223.73.204:$standard_https_port:tcp # - " # - # - Blank separated list # - allow_all_ext_traffic_to_local_service="" marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)" when: - main_ipv4_exists.stat.exists - allow_all_ext_traffic_to_local_service_ipv4_present is changed - name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv6) is present shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /etc/ipt-firewall/main_ipv6.conf register: allow_all_ext_traffic_to_local_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 1" changed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (allow_all_ext_traffic_to_local_service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*any_access_from_inet_networks' block: | # ============= # - Allow local services from ALL extern netwoks # ============= # - allow_all_ext_traffic_to_local_service # - # - allow_all_ext_traffic_to_local_service="local-address,port,protocol [local-address,port,protocol] .." # - # - Note: # - ===== # - - Only 'tcp' and 'udp' are allowed valuse for protocol. # - # - Example: # - allow extern traffic to service at 2a01:30:1fff:fd00::210 on port 1036 # - allow extern traffic to https service at 2a01:30:1fff:fd00::204 # - # - allow_ext_net_to_local_service=" # - 2a01:30:1fff:fd00::210,1036,tcp # - 2a01:30:1fff:fd00::204,$standard_https_port,tcp # - " # - # - Blank separated list # - allow_all_ext_traffic_to_local_service="" marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)" when: - main_ipv6_exists.stat.exists - allow_all_ext_traffic_to_local_service_ipv6_present is changed # --- # Allow extern services / networks # --- - name: Check if String 'allow_to_ext_service..' (IPv4) is present shell: grep -q -E "^allow_to_ext_service=" /etc/ipt-firewall/main_ipv4.conf register: allow_to_ext_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "allow_to_ext_service_ipv4_present.rc > 1" changed_when: "allow_to_ext_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (allow_to_ext_service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*allow_local_net_to_ext_net' block: | # ============= # - Allow extern service # ============= # - allow_to_ext_service # - # - allow_to_ext_service=" [ext-ip:port:protocol> [.." # - # - All traffic to the given (extern) service is allowed # - # - Example: # - allow_to_ext_service="83.223.86.98:3306:tcp # - 83.223.86.98:10194:udp" # - # - Blank separated list # - allow_to_ext_service="" # ============= # - Allow extern network # ============= # - allow_to_ext_net # - # - Allow all traffic to given extern network # - # - allow_to_ext_net=" [ [.." # - # - All traffic to the given (extern) network is allowed # - # - Example: # - allow_to_ext_net="83.223.86.98/32 # - 83.223.86.101/32 # - 192.68.11.81/27" # - # - Blank separated list # - allow_to_ext_net="" marker: "# Marker set by modify-ipt-gateway.yml (allow_to_ext_service)" when: - main_ipv4_exists.stat.exists - allow_to_ext_service_ipv4_present is changed - name: Check if String 'allow_to_ext_service..' (IPv6) is present shell: grep -q -E "^allow_to_ext_service=" /etc/ipt-firewall/main_ipv6.conf register: allow_to_ext_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "allow_to_ext_service_ipv6_present.rc > 1" changed_when: "allow_to_ext_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (allow_to_ext_service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*allow_local_net_to_ext_net' block: | # ============= # - Allow extern service # ============= # - allow_to_ext_service # - # - Allow all traffic to given extern service # - # - allow_to_ext_service=" [ext-ip,port,protocol> [.." # - # - All traffic to the given (extern) service is allowed # - # - Example: # - allow_to_ext_service="2a01:30:0:13:211:84ff:feb7:7f9c,3306,tcp # - 2a01:30:0:13:211:84ff:feb7:7f9c,10194,tcp" # - # - Blank separated list # - allow_to_ext_service="" # ============= # - Allow extern network # ============= # - allow_to_ext_net # - # - Allow all traffic to given extern network # - # - allow_to_ext_net=" [ [.." # - # - All traffic from the given (local) network to the given (extern) network is allowed # - # - Example: # - allow_to_ext_net="2a01:30:0:13:211:84ff:feb7:7f9c/64 # - 2001:678:a40:3000::/64" # - # - Blank separated list # - allow_to_ext_net="" marker: "# Marker set by modify-ipt-gateway.yml (allow_to_ext_service)" when: - main_ipv6_exists.stat.exists - allow_to_ext_service_ipv6_present is changed # --- # Epson Network Scanner # --- - name: Check if String 'epson_scanner_ips..' (IPv4) is present shell: grep -q -E "^epson_scanner_ips=" /etc/ipt-firewall/main_ipv4.conf register: epson_scanner_ips_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "epson_scanner_ips_ipv4_present.rc > 1" changed_when: "epson_scanner_ips_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (epson_scanner) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*brscan_port' block: | # ====== # - Epson Network Scan # ====== # - IP Adresses Epson Network Scanner # - # - Blank seoarated list # - epson_scanner_ips="" epson_scan_port="$standard_epson_network_scan_port" marker: "# Marker set by modify-ipt-gateway.yml (epson_scanner)" when: - main_ipv4_exists.stat.exists - epson_scanner_ips_ipv4_present is changed - name: Check if String 'epson_scanner_ips..' (IPv6) is present shell: grep -q -E "^epson_scanner_ips=" /etc/ipt-firewall/main_ipv6.conf register: epson_scanner_ips_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "epson_scanner_ips_ipv6_present.rc > 1" changed_when: "epson_scanner_ips_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (epson_scanner) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*brscan_port' block: | # ====== # - Epson Network Scan # ====== # - IP Adresses Epson Network Scanner # - # - Blank seoarated list # - epson_scanner_ips="" epson_scan_port="$standard_epson_network_scan_port" marker: "# Marker set by modify-ipt-gateway.yml (epson_scanner)" when: - main_ipv6_exists.stat.exists - epson_scanner_ips_ipv6_present is changed # --- # jitsi video conference service # --- - name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf register: jitsi_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "jitsi_service_ipv4_present.rc > 1" changed_when: "jitsi_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv4_exists.stat.exists - jitsi_service_ipv4_present is changed - name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf register: jitsi_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "jitsi_service_ipv6_present.rc > 1" changed_when: "jitsi_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - jitsi_service_ipv6_present is changed # --- # webex video conference service # --- - name: Check if String 'webex_tcp_ports=..' (IPv4) is present shell: grep -q -E "^webex_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf register: webex_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "webex_service_ipv4_present.rc > 1" changed_when: "webex_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (webex service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*bigbluebutton_udp_ports' block: | # ====== # - Webex Meeting # ====== # - Webex Meeting (Videokonferenz) # - # - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming) # - # - UDP 9000: Outbound (VoIP and RTP) # - # - --- # - # - TCP 5004: Fall-back ports for media connectivity when UDP port 9000 # - is not open in the firewall # - webex_tcp_ports="$standard_webex_tcp_ports" webex_udp_ports="$standard_webex_udp_ports" webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports" marker: "# Marker set by modify-ipt-gateway.yml (webex service)" when: - main_ipv4_exists.stat.exists - webex_service_ipv4_present is changed - name: Check if String 'webex_tcp_ports=..' (IPv6) is present shell: grep -q -E "^webex_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf register: webex_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "webex_service_ipv6_present.rc > 1" changed_when: "webex_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (webex service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*bigbluebutton_udp_ports' block: | # ====== # - Webex Meeting # ====== # - Webex Meeting (Videokonferenz) # - # - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming) # - # - UDP 9000: Outbound (VoIP and RTP) # - # - --- # - # - TCP 5004: Fall-back ports for media connectivity when UDP port 9000 # - is not open in the firewall # - webex_tcp_ports="$standard_webex_tcp_ports" webex_udp_ports="$standard_webex_udp_ports" webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports" marker: "# Marker set by modify-ipt-gateway.yml (webex service)" when: - main_ipv6_exists.stat.exists - webex_service_ipv6_present is changed # --- # alfaview video conference service # --- - name: Check if String 'alfaview_tcp_ports=..' (IPv4) is present shell: grep -q -E "^alfaview_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf register: alfaview_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "alfaview_service_ipv4_present.rc > 1" changed_when: "alfaview_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (alfaview service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - alfaview - Video Conferencing Systems # ====== # - alfaview Service Ports # - alfaview_tcp_ports="$standard_alfaview_service_tcp_ports" alfaview_udp_ports="$standard_alfaview_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (alfaview service)" when: - main_ipv4_exists.stat.exists - alfaview_service_ipv4_present is changed - name: Check if String 'alfaview_tcp_ports=..' (IPv6) is present shell: grep -q -E "^alfaview_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf register: alfaview_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "alfaview_service_ipv6_present.rc > 1" changed_when: "alfaview_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (alfaview service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - alfaview - Video Conferencing Systems # ====== # - alfaview Service Ports # - alfaview_tcp_ports="$standard_alfaview_service_tcp_ports" alfaview_udp_ports="$standard_alfaview_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (alfaview service)" when: - main_ipv6_exists.stat.exists - alfaview_service_ipv6_present is changed # --- # TURN Server (Stun Server) (for Nextcloud 'talk' app) # --- - name: Check if String 'nc_turn_ports=..' (IPv4) is present shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv4.conf register: nc_turn_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "nc_turn_service_ipv4_present.rc > 1" changed_when: "nc_turn_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (nc's turn service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)" when: - main_ipv4_exists.stat.exists - nc_turn_service_ipv4_present is changed - name: Check if String 'nc_turn_ports=..' (IPv6) is present shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv6.conf register: nc_turn_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "nc_turn_service_ipv6_present.rc > 1" changed_when: "nc_turn_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - nc_turn_service_ipv6_present is changed # --- # BigBlueButton video conference service # --- - name: Check if String 'bigbluebutton_tcp_ports=..' (IPv4) is present shell: grep -q -E "^bigbluebutton_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf register: bigbluebutton_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "bigbluebutton_service_ipv4_present.rc > 1" changed_when: "bigbluebutton_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - BigBlueButton Video Conference Service # ====== # - BigBlueButton Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_bigbluebutton_video_conference_service=false # - BigBlueButton Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 16384-32768: FreeSWITCH/HTML5 RTP streams # - bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (bigbluebutton service)" when: - main_ipv4_exists.stat.exists - bigbluebutton_service_ipv4_present is changed - name: Check if String 'bigbluebutton_tcp_ports=..' (IPv6) is present shell: grep -q -E "^bigbluebutton_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf register: bigbluebutton_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "bigbluebutton_service_ipv6_present.rc > 1" changed_when: "bigbluebutton_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - BigBlueButton Video Conference Service # ====== # - BigBlueButton Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_bigbluebutton_video_conference_service=false # - BigBlueButton Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 16384-32768: FreeSWITCH/HTML5 RTP streams # - bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (bigbluebutton service)" when: - main_ipv6_exists.stat.exists - bigbluebutton_service_ipv6_present is changed # --- # Remove Marker set by blockinfile # --- - name: Remove marker IPv4 replace : path: /etc/ipt-firewall/main_ipv4.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - main_ipv4_exists.stat.exists - name: Remove marker IPv6 replace : path: /etc/ipt-firewall/main_ipv6.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - main_ipv6_exists.stat.exists # --- # Confiuration Files # --- - name: Check if configuration files are latest shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) loop: - default_ports.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf register: diff_script_output - name: Ensure configuration files are latest command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} loop: - default_ports.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf when: - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Firewall scripts # --- - name: Check if firewall scripts are latest shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) loop: - ipt-firewall-gateway - ip6t-firewall-gateway register: diff_script_output - name: Ensure firewall scripts are latest command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} loop: - ipt-firewall-gateway - ip6t-firewall-gateway when: - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall