--- # --- # Remount Filesystem writable # --- - name: Remount "/ro/" writable shell: remountrw # --- # Install/Uodate git firewall repository # --- - name: Install/update firewall repository git: repo: '{{ git_firewall_repository.repo }}' dest: '{{ git_firewall_repository.dest }}' when: git_firewall_repository is defined and git_firewall_repository|length > 0 # --- # Some Checks # --- - name: Check if file '/ro/etc/ipt-firewall/main_ipv4.conf' exists stat: path: /ro/etc/ipt-firewall/main_ipv4.conf register: main_ipv4_exists - name: Check if file '/ro/etc/ipt-firewall/main_ipv6.conf' exists stat: path: /ro/etc/ipt-firewall/main_ipv6.conf register: main_ipv6_exists - name: Check if file '/ro/etc/ipt-firewall/interfaces_ipv4.conf' exists stat: path: /ro/etc/ipt-firewall/interfaces_ipv4.conf register: interfaces_ipv4_exists - name: Check if file '/ro/etc/ipt-firewall/interfaces_ipv6.conf' exists stat: path: /ro/etc/ipt-firewall/interfaces_ipv6.conf register: interfaces_ipv6_exists # --- # Adjust some lines # --- - name: addjust line 'zoom_udp_ports' (IPv4) lineinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf regexp: '^zoom_udp_ports=' line: 'zoom_udp_ports="$standard_zoom_udp_ports"' when: - main_ipv4_exists.stat.exists notify: - Restart IPv4 Firewall - name: addjust line 'zoom_udp_ports' (IPv6) lineinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf regexp: '^zoom_udp_ports=' line: 'zoom_udp_ports="$standard_zoom_udp_ports"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall - name: addjust line 'jitsi_udp_ports' (IPv4) lineinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_ports"' when: - main_ipv4_exists.stat.exists notify: - Restart IPv4 Firewall - name: addjust line 'jitsi_udp_ports' (IPv6) lineinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_ports"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall # --- # Allow local services from ALL extern netwoks # --- - name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv4) is present shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /ro/etc/ipt-firewall/main_ipv4.conf register: allow_all_ext_traffic_to_local_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 1" changed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_all_ext_traffic_to_local_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*any_access_from_inet_networks' block: | # ============= # - Allow local services from ALL extern netwoks # ============= # - allow_all_ext_traffic_to_local_service # - # - allow_all_ext_traffic_to_local_service="local-address:port:protocol [local-address:port:protocol] .." # - # - Note: # - ===== # - - Only 'tcp' and 'udp' are allowed valuse for protocol. # - # - Example: # - allow extern traffic to service at 83.223.73.210 on port 1036 # - allow extern traffic to https service at 83.223.73.204 # - # - allow_ext_net_to_local_service=" # - 83.223.73.210:1036:tcp # - 83.223.73.204:$standard_https_port:tcp # - " # - # - Blank separated list # - allow_all_ext_traffic_to_local_service="" marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)" when: - main_ipv4_exists.stat.exists - allow_all_ext_traffic_to_local_service_ipv4_present is changed - name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv6) is present shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /ro/etc/ipt-firewall/main_ipv6.conf register: allow_all_ext_traffic_to_local_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 1" changed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (allow_all_ext_traffic_to_local_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*any_access_from_inet_networks' block: | # ============= # - Allow local services from ALL extern netwoks # ============= # - allow_all_ext_traffic_to_local_service # - # - allow_all_ext_traffic_to_local_service="local-address,port,protocol [local-address,port,protocol] .." # - # - Note: # - ===== # - - Only 'tcp' and 'udp' are allowed valuse for protocol. # - # - Example: # - allow extern traffic to service at 2a01:30:1fff:fd00::210 on port 1036 # - allow extern traffic to https service at 2a01:30:1fff:fd00::204 # - # - allow_ext_net_to_local_service=" # - 2a01:30:1fff:fd00::210,1036,tcp # - 2a01:30:1fff:fd00::204,$standard_https_port,tcp # - " # - # - Blank separated list # - allow_all_ext_traffic_to_local_service="" marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)" when: - main_ipv6_exists.stat.exists - allow_all_ext_traffic_to_local_service_ipv6_present is changed # --- # jitsi video conference service # --- - name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf register: jitsi_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "jitsi_service_ipv4_present.rc > 1" changed_when: "jitsi_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv4_exists.stat.exists - jitsi_service_ipv4_present is changed - name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf register: jitsi_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "jitsi_service_ipv6_present.rc > 1" changed_when: "jitsi_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - jitsi_service_ipv6_present is changed # --- # TURN Server (Stun Server) (for Nextcloud 'talk' app) # --- - name: Check if String 'nc_turn_ports=..' (IPv4) is present shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv4.conf register: nc_turn_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "nc_turn_service_ipv4_present.rc > 1" changed_when: "nc_turn_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (nc's turn service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)" when: - main_ipv4_exists.stat.exists - nc_turn_service_ipv4_present is changed - name: Check if String 'nc_turn_ports=..' (IPv6) is present shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv6.conf register: nc_turn_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "nc_turn_service_ipv6_present.rc > 1" changed_when: "nc_turn_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - nc_turn_service_ipv6_present is changed # --- # Remove Marker set by blockinfile # --- - name: Remove marker IPv4 (main_ipv4.conf) replace : path: /ro/etc/ipt-firewall/main_ipv4.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - main_ipv4_exists.stat.exists - name: Remove marker IPv6 (main_ipv6.conf) replace : path: /ro/etc/ipt-firewall/main_ipv6.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - main_ipv6_exists.stat.exists - name: Remove marker IPv4 (interfaces_ipv4.conf) replace : path: /ro/etc/ipt-firewall/interfaces_ipv4.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - interfaces_ipv4_exists.stat.exists - name: Remove marker IPv6 (interfaces_ipv6.conf) replace : path: /ro/etc/ipt-firewall/interfaces_ipv6.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - interfaces_ipv6_exists.stat.exists # --- # Confiuration Files # --- - name: Check if configuration files are latest shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) loop: - default_ports.conf - default_ipv4.conf - default_ipv6.conf - default_basic_behavior.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf register: diff_script_output - name: Ensure configuration files are latest command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }} loop: - default_ports.conf - default_ipv4.conf - default_ipv6.conf - default_basic_behavior.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf when: - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Firewall scripts # --- - name: Check if firewall scripts are latest shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) loop: - ipt-firewall-gateway - ip6t-firewall-gateway register: diff_script_output - name: Ensure firewall scripts are latest command: cp {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }} loop: - ipt-firewall-gateway - ip6t-firewall-gateway when: - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Remount Filesystem readonly # --- - name: Remount "/ro/" readonly shell: remountro register: remountro_cmd failed_when: remountro_cmd.rc != 0 and remountro_cmd.rc != 32