--- # --- # Remount Filesystem writable # --- - name: Remount "/ro/" writable shell: remountrw # --- # Install/Uodate git firewall repository # --- - name: Install/update firewall repository git: repo: '{{ git_firewall_repository.repo }}' dest: '{{ git_firewall_repository.dest }}' when: git_firewall_repository is defined and git_firewall_repository|length > 0 # --- # Some Checks # --- - name: Check if file '/ro/etc/ipt-firewall/main_ipv4.conf' exists stat: path: /ro/etc/ipt-firewall/main_ipv4.conf register: main_ipv4_exists - name: Check if file '/ro/etc/ipt-firewall/main_ipv6.conf' exists stat: path: /ro/etc/ipt-firewall/main_ipv6.conf register: main_ipv6_exists - name: Check if file '/ro/etc/ipt-firewall/interfaces_ipv4.conf' exists stat: path: /ro/etc/ipt-firewall/interfaces_ipv4.conf register: interfaces_ipv4_exists - name: Check if file '/ro/etc/ipt-firewall/interfaces_ipv6.conf' exists stat: path: /ro/etc/ipt-firewall/interfaces_ipv6.conf register: interfaces_ipv6_exists # --- # Adjust some lines # --- - name: addjust line 'jitsi_tcp_ports' (IPv4) lineinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf regexp: '^jitsi_tcp_ports=' line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"' - name: addjust line 'jitsi_tcp_ports' (IPv6) lineinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf regexp: '^jitsi_tcp_ports=' line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"' when: - main_ipv6_exists.stat.exists - name: addjust line 'jitsi_udp_ports' (IPv4) lineinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"' - name: addjust line 'jitsi_udp_ports' (IPv6) lineinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"' when: - main_ipv6_exists.stat.exists - name: addjust line 'brscan_port' (IPv4) lineinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf regexp: '^brscan_port=' line: 'brscan_port="$standard_brother_brscan_port"' - name: addjust line 'brscan_port' (IPv6) lineinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf regexp: '^brscan_port=' line: 'brscan_port="$standard_brother_brscan_port"' when: - main_ipv6_exists.stat.exists # --- # allow_ms_skype_teams_out # --- - name: Check if String 'allow_ms_skype_teams_out..' (IPv4) is present shell: grep -q -E "^allow_ms_skype_teams_out=" /ro/etc/ipt-firewall/main_ipv4.conf register: ms_skype_teams_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "ms_skype_teams_out_ipv4_present.rc > 1" changed_when: "ms_skype_teams_out_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (ms teams) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_ms_skype_teams_out' line: 'allow_ms_skype_teams_out=true' insertafter: '^#?\s*allow_bigbluebutton_video_conference_out' when: - main_ipv4_exists.stat.exists - ms_skype_teams_out_ipv4_present is changed - name: Check if String 'allow_ms_skype_teams_out..' (IPv6) is present shell: grep -q -E "^allow_ms_skype_teams_out=" /ro/etc/ipt-firewall/main_ipv6.conf register: ms_skype_teams_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "ms_skype_teams_out_ipv6_present.rc > 1" changed_when: "ms_skype_teams_out_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (ms teams) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_ms_skype_teams_out' line: 'allow_ms_skype_teams_out=true' insertafter: '^#?\s*allow_bigbluebutton_video_conference_out' when: - main_ipv6_exists.stat.exists - ms_skype_teams_out_ipv6_present is changed # --- # allow_jitsi_video_conference_out # --- - name: Check if String 'allow_jitsi_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_jitsi_video_conference_out=" /ro/etc/ipt-firewall/main_ipv4.conf register: jitsi_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "jitsi_video_conference_out_ipv4_present.rc > 1" changed_when: "jitsi_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_jitsi_video_conference_out' line: 'allow_jitsi_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv4_exists.stat.exists - jitsi_video_conference_out_ipv4_present is changed - name: Check if String 'allow_jitsi_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_jitsi_video_conference_out=" /ro/etc/ipt-firewall/main_ipv6.conf register: jitsi_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "jitsi_video_conference_out_ipv6_present.rc > 1" changed_when: "jitsi_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_jitsi_video_conference_out' line: 'allow_jitsi_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv6_exists.stat.exists - jitsi_video_conference_out_ipv6_present is changed # --- # allow_nc_talk_out # --- - name: Check if String 'allow_nc_talk_out..' (IPv4) is present shell: grep -q -E "^allow_nc_talk_out=" /ro/etc/ipt-firewall/main_ipv4.conf register: nc_talk_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "nc_talk_out_ipv4_present.rc > 1" changed_when: "nc_talk_out_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (nc_talk) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_nc_talk_out' line: 'allow_nc_talk_out=true' insertafter: '^#?\s*allow_jitsi_video_conference_out' when: - main_ipv4_exists.stat.exists - nc_talk_out_ipv4_present is changed - name: Check if String 'allow_nc_talk_out..' (IPv6) is present shell: grep -q -E "^allow_nc_talk_out=" /ro/etc/ipt-firewall/main_ipv6.conf register: nc_talk_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "nc_talk_out_ipv6_present.rc > 1" changed_when: "nc_talk_out_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (nc_talk) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_nc_talk_out' line: 'allow_nc_talk_out=true' insertafter: '^#?\s*allow_jitsi_video_conference_out' when: - main_ipv6_exists.stat.exists - nc_talk_out_ipv6_present is changed # --- # allow_webex_video_conference_out # --- - name: Check if String 'allow_webex_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_webex_video_conference_out=" /ro/etc/ipt-firewall/main_ipv4.conf register: webex_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "webex_video_conference_out_ipv4_present.rc > 1" changed_when: "webex_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (webex) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_webex_video_conference_out' line: 'allow_webex_video_conference_out=true' insertafter: '^#?\s*allow_bigbluebutton_video_conference_out' when: - main_ipv4_exists.stat.exists - webex_video_conference_out_ipv4_present is changed - name: Check if String 'allow_webex_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_webex_video_conference_out=" /ro/etc/ipt-firewall/main_ipv6.conf register: webex_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "webex_video_conference_out_ipv6_present.rc > 1" changed_when: "webex_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (webex) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_webex_video_conference_out' line: 'allow_webex_video_conference_out=true' insertafter: '^#?\s*allow_bigbluebutton_video_conference_out' when: - main_ipv6_exists.stat.exists - webex_video_conference_out_ipv6_present is changed # --- # allow_alfaview_video_conference_out # --- - name: Check if String 'allow_alfaview_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_alfaview_video_conference_out=" /ro/etc/ipt-firewall/main_ipv4.conf register: alfaview_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "alfaview_video_conference_out_ipv4_present.rc > 1" changed_when: "alfaview_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_alfaview_video_conference_out' line: 'allow_alfaview_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv4_exists.stat.exists - alfaview_video_conference_out_ipv4_present is changed - name: Check if String 'allow_alfaview_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_alfaview_video_conference_out=" /ro/etc/ipt-firewall/main_ipv6.conf register: alfaview_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "alfaview_video_conference_out_ipv6_present.rc > 1" changed_when: "alfaview_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton) lineinfile: dest: /ro/etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_alfaview_video_conference_out' line: 'allow_alfaview_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv6_exists.stat.exists - alfaview_video_conference_out_ipv6_present is changed # --- # WireGuard Service # --- - name: Check if String 'local_wg_service..' (IPv4) is present shell: grep -q -E "^local_wg_service=" /ro/etc/ipt-firewall/main_ipv4.conf register: local_wg_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "local_wg_service_ipv4_present.rc > 1" changed_when: "local_wg_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (local_wg_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*vpn_local_net_ports' block: | # ====== # - WireGuard Service # ====== # - WireGuard Service on Gateway? # - local_wg_service=true wg_gw_ports="$standard_wg_port" # - WireGuard Services DMZ (reachable also from WAN) # - # - wg_server_dmz_arr=[]= # - # - Note: # - Each extern interface can have only one thuch service # - # - wg_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2 # - wg_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1 # - # - Multiple settins of this parameter is possible # - declare -A wg_server_dmz_arr # - Local WireGuard Ports # - # - Blank separated list # - wg_local_net_ports="$standard_wg_port" marker: "# Marker set by modify-ipt-gateway.yml (local_wg_service)" when: - main_ipv4_exists.stat.exists - local_wg_service_ipv4_present is changed - name: Check if String 'local_wg_service..' (IPv6) is present shell: grep -q -E "^local_wg_service=" /ro/etc/ipt-firewall/main_ipv6.conf register: local_wg_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "local_wg_service_ipv6_present.rc > 1" changed_when: "local_wg_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (local_wg_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*vpn_local_net_ports' block: | # ====== # - WireGuard Service # ====== # - WireGuard Service on Gateway? # - local_wg_service=true wg_gw_ports="$standard_wg_port" # - WireGuard Services DMZ (reachable also from WAN) # - # - wg_server_dmz_arr=[]= # - # - Note: # - Each extern interface can have only one thuch service # - # - wg_server_dmz_arr[2001:6f8:107e:63::20]=$ext_if_dsl_2 # - wg_server_dmz_arr[2001:6f8:107e:63::40]=$ext_if_dsl_1 # - # - Multiple settins of this parameter is possible # - declare -A wg_server_dmz_arr # - Local WireGuard Ports # - # - Blank separated list # - wg_local_net_ports="$standard_wg_port" marker: "# Marker set by modify-ipt-gateway.yml (local_wg_service)" when: - main_ipv6_exists.stat.exists - local_wg_service_ipv6_present is changed - name: Check if String 'allow_wg_out..' (IPv4) is present shell: grep -q -E "^allow_wg_out=" /ro/etc/ipt-firewall/main_ipv4.conf register: allow_wg_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "allow_wg_out_ipv4_present.rc > 1" changed_when: "allow_wg_out_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_wg_out) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*vpn_out_ports' block: | # WireGuard # allow_wg_out=true wg_out_ports="$standard_wg_port" marker: "# Marker set by modify-ipt-gateway.yml (allow_wg_out)" when: - main_ipv4_exists.stat.exists - allow_wg_out_ipv4_present is changed - name: Check if String 'allow_wg_out..' (IPv6) is present shell: grep -q -E "^allow_wg_out=" /ro/etc/ipt-firewall/main_ipv6.conf register: allow_wg_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "allow_wg_out_ipv6_present.rc > 1" changed_when: "allow_wg_out_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (allow_wg_out) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*vpn_out_ports' block: | # WireGuard # allow_wg_out=true wg_out_ports="$standard_wg_port" marker: "# Marker set by modify-ipt-gateway.yml (allow_wg_out)" when: - main_ipv6_exists.stat.exists - allow_wg_out_ipv6_present is changed - name: Check if String 'wg_ifs..' (IPv4) is present shell: grep -q -E "^wg_ifs=" /ro/etc/ipt-firewall/interfaces_ipv4.conf register: wg_ifs_ipv4_present when: interfaces_ipv4_exists.stat.exists failed_when: "wg_ifs_ipv4_present.rc > 1" changed_when: "wg_ifs_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/interfaces_ipv4.conf' (wg_ifs) blockinfile: path: /ro/etc/ipt-firewall/interfaces_ipv4.conf insertafter: '^#?\s*vpn_ifs' block: | # - WireGuard Interfaces # - # - (blank separated list) # - wg_ifs="wg+" marker: "# Marker set by modify-ipt-gateway.yml (wg_ifs)" when: - interfaces_ipv4_exists.stat.exists - wg_ifs_ipv4_present is changed - name: Check if String 'wg_ifs..' (IPv6) is present shell: grep -q -E "^wg_ifs=" /ro/etc/ipt-firewall/interfaces_ipv6.conf register: wg_ifs_ipv6_present when: interfaces_ipv6_exists.stat.exists failed_when: "wg_ifs_ipv6_present.rc > 1" changed_when: "wg_ifs_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/interfaces_ipv6.conf' (wg_ifs) blockinfile: path: /ro/etc/ipt-firewall/interfaces_ipv6.conf insertafter: '^#?\s*vpn_ifs' block: | # - WireGuard Interfaces # - # - (blank separated list) # - wg_ifs="wg+" marker: "# Marker set by modify-ipt-gateway.yml (wg_ifs)" when: - interfaces_ipv6_exists.stat.exists - wg_ifs_ipv6_present is changed # --- # Allow local services from ALL extern netwoks # --- - name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv4) is present shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /ro/etc/ipt-firewall/main_ipv4.conf register: allow_all_ext_traffic_to_local_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 1" changed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_all_ext_traffic_to_local_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*any_access_from_inet_networks' block: | # ============= # - Allow local services from ALL extern netwoks # ============= # - allow_all_ext_traffic_to_local_service # - # - allow_all_ext_traffic_to_local_service="local-address:port:protocol [local-address:port:protocol] .." # - # - Note: # - ===== # - - Only 'tcp' and 'udp' are allowed valuse for protocol. # - # - Example: # - allow extern traffic to service at 83.223.73.210 on port 1036 # - allow extern traffic to https service at 83.223.73.204 # - # - allow_ext_net_to_local_service=" # - 83.223.73.210:1036:tcp # - 83.223.73.204:$standard_https_port:tcp # - " # - # - Blank separated list # - allow_all_ext_traffic_to_local_service="" marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)" when: - main_ipv4_exists.stat.exists - allow_all_ext_traffic_to_local_service_ipv4_present is changed - name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv6) is present shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /ro/etc/ipt-firewall/main_ipv6.conf register: allow_all_ext_traffic_to_local_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 1" changed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (allow_all_ext_traffic_to_local_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*any_access_from_inet_networks' block: | # ============= # - Allow local services from ALL extern netwoks # ============= # - allow_all_ext_traffic_to_local_service # - # - allow_all_ext_traffic_to_local_service="local-address,port,protocol [local-address,port,protocol] .." # - # - Note: # - ===== # - - Only 'tcp' and 'udp' are allowed valuse for protocol. # - # - Example: # - allow extern traffic to service at 2a01:30:1fff:fd00::210 on port 1036 # - allow extern traffic to https service at 2a01:30:1fff:fd00::204 # - # - allow_ext_net_to_local_service=" # - 2a01:30:1fff:fd00::210,1036,tcp # - 2a01:30:1fff:fd00::204,$standard_https_port,tcp # - " # - # - Blank separated list # - allow_all_ext_traffic_to_local_service="" marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)" when: - main_ipv6_exists.stat.exists - allow_all_ext_traffic_to_local_service_ipv6_present is changed # --- # Allow extern services / networks # --- - name: Check if String 'allow_to_ext_service..' (IPv4) is present shell: grep -q -E "^allow_to_ext_service=" /ro/etc/ipt-firewall/main_ipv4.conf register: allow_to_ext_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "allow_to_ext_service_ipv4_present.rc > 1" changed_when: "allow_to_ext_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_to_ext_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*allow_local_net_to_ext_net' block: | # ============= # - Allow extern service # ============= # - allow_to_ext_service # - # - allow_to_ext_service=" [ext-ip:port:protocol> [.." # - # - All traffic to the given (extern) service is allowed # - # - Example: # - allow_to_ext_service="83.223.86.98:3306:tcp # - 83.223.86.98:10194:udp" # - # - Blank separated list # - allow_to_ext_service="" # ============= # - Allow extern network # ============= # - allow_to_ext_net # - # - Allow all traffic to given extern network # - # - allow_to_ext_net=" [ [.." # - # - All traffic to the given (extern) network is allowed # - # - Example: # - allow_to_ext_net="83.223.86.98/32 # - 83.223.86.101/32 # - 192.68.11.81/27" # - # - Blank separated list # - allow_to_ext_net="" marker: "# Marker set by modify-ipt-gateway.yml (allow_to_ext_service)" when: - main_ipv4_exists.stat.exists - allow_to_ext_service_ipv4_present is changed - name: Check if String 'allow_to_ext_service..' (IPv6) is present shell: grep -q -E "^allow_to_ext_service=" /ro/etc/ipt-firewall/main_ipv6.conf register: allow_to_ext_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "allow_to_ext_service_ipv6_present.rc > 1" changed_when: "allow_to_ext_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (allow_to_ext_service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*allow_local_net_to_ext_net' block: | # ============= # - Allow extern service # ============= # - allow_to_ext_service # - # - Allow all traffic to given extern service # - # - allow_to_ext_service=" [ext-ip,port,protocol> [.." # - # - All traffic to the given (extern) service is allowed # - # - Example: # - allow_to_ext_service="2a01:30:0:13:211:84ff:feb7:7f9c,3306,tcp # - 2a01:30:0:13:211:84ff:feb7:7f9c,10194,tcp" # - # - Blank separated list # - allow_to_ext_service="" # ============= # - Allow extern network # ============= # - allow_to_ext_net # - # - Allow all traffic to given extern network # - # - allow_to_ext_net=" [ [.." # - # - All traffic from the given (local) network to the given (extern) network is allowed # - # - Example: # - allow_to_ext_net="2a01:30:0:13:211:84ff:feb7:7f9c/64 # - 2001:678:a40:3000::/64" # - # - Blank separated list # - allow_to_ext_net="" marker: "# Marker set by modify-ipt-gateway.yml (allow_to_ext_service)" when: - main_ipv6_exists.stat.exists - allow_to_ext_service_ipv6_present is changed # --- # Epson Network Scanner # --- - name: Check if String 'epson_scanner_ips..' (IPv4) is present shell: grep -q -E "^epson_scanner_ips=" /ro/etc/ipt-firewall/main_ipv4.conf register: epson_scanner_ips_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "epson_scanner_ips_ipv4_present.rc > 1" changed_when: "epson_scanner_ips_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (epson_scanner) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*brscan_port' block: | # ====== # - Epson Network Scan # ====== # - IP Adresses Epson Network Scanner # - # - Blank seoarated list # - epson_scanner_ips="" epson_scan_port="$standard_epson_network_scan_port" marker: "# Marker set by modify-ipt-gateway.yml (epson_scanner)" when: - main_ipv4_exists.stat.exists - epson_scanner_ips_ipv4_present is changed - name: Check if String 'epson_scanner_ips..' (IPv6) is present shell: grep -q -E "^epson_scanner_ips=" /ro/etc/ipt-firewall/main_ipv6.conf register: epson_scanner_ips_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "epson_scanner_ips_ipv6_present.rc > 1" changed_when: "epson_scanner_ips_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (epson_scanner) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*brscan_port' block: | # ====== # - Epson Network Scan # ====== # - IP Adresses Epson Network Scanner # - # - Blank seoarated list # - epson_scanner_ips="" epson_scan_port="$standard_epson_network_scan_port" marker: "# Marker set by modify-ipt-gateway.yml (epson_scanner)" when: - main_ipv6_exists.stat.exists - epson_scanner_ips_ipv6_present is changed # --- # Skype for Business Online und Microsoft Teams # --- - name: Check if String 'ms_skype_teams_tcp_ports=..' (IPv4) is present shell: grep -q -E "^ms_skype_teams_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf register: ms_skype_teams_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "ms_skype_teams_ipv4_present.rc > 1" changed_when: "ms_skype_teams_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (ms teams service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*bigbluebutton_udp_ports' block: | # ====== # - Skype for Business Online und Microsoft Teams # ====== # - Skype for Business Online und Microsoft Teams # - # - TCP 80,443 # - # - UDP 3478,3479,3480,3481 --> 13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14 # - # - Example: # - # - standard_ms_skype_teams_tcp_ports="80,443" # - standard_ms_skype_teams_udp4_ports="3478,3479,3480,3481" # - standard_ms_skype_teams_udp4_hosts=" # - 13.107.64.0/18 # - 52.112.0.0/14 # - 52.120.0.0/14 # - " # - # - Set to default values: # - ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports" # - ms_skype_teams_udp4_ports="$standard_ms_skype_teams_udp4_ports" # - ms_skype_teams_udp4_hosts="$standard_ms_skype_teams_udp4_hosts" # - ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports" ms_skype_teams_udp4_ports="$standard_ms_skype_teams_udp4_ports" ms_skype_teams_udp4_hosts="$standard_ms_skype_teams_udp4_hosts" marker: "# Marker set by modify-ipt-gateway.yml (ms teams service)" when: - main_ipv4_exists.stat.exists - ms_skype_teams_ipv4_present is changed - name: Check if String 'ms_skype_teams_tcp_ports=..' (IPv6) is present shell: grep -q -E "^ms_skype_teams_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf register: ms_skype_teams_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "ms_skype_teams_ipv6_present.rc > 1" changed_when: "ms_skype_teams_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (ms teams service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*bigbluebutton_udp_ports' block: | # ====== # - Skype for Business Online und Microsoft Teams # ====== # - Skype for Business Online und Microsoft Teams # - # - TCP 80,443 # - # - Example: # - # - standard_ms_skype_teams_tcp_ports="80,443" # - standard_ms_skype_teams_udp6_ports="3478,3479,3480,3481" # - standard_ms_skype_teams_udp6_hosts=" # - 2a01:30:0:13:5054:ff:fe9f:422f/64 # - 2a01:4f8:231:19a7::2/52 # - " # - # - Set to default values: # - ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports" # - ms_skype_teams_udp6_ports="$standard_ms_skype_teams_udp6_ports" # - ms_skype_teams_udp6_hosts="$standard_ms_skype_teams_udp6_hosts" # - ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports" ms_skype_teams_udp6_ports="$standard_ms_skype_teams_udp6_ports" ms_skype_teams_udp6_hosts="$standard_ms_skype_teams_udp6_hosts" marker: "# Marker set by modify-ipt-gateway.yml (ms teams service)" when: - main_ipv6_exists.stat.exists - ms_skype_teams_ipv6_present is changed # --- # jitsi video conference service # --- - name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf register: jitsi_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "jitsi_service_ipv4_present.rc > 1" changed_when: "jitsi_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv4_exists.stat.exists - jitsi_service_ipv4_present is changed - name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf register: jitsi_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "jitsi_service_ipv6_present.rc > 1" changed_when: "jitsi_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - jitsi_service_ipv6_present is changed # --- # webex video conference service # --- - name: Check if String 'webex_tcp_ports=..' (IPv4) is present shell: grep -q -E "^webex_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf register: webex_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "webex_service_ipv4_present.rc > 1" changed_when: "webex_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (webex service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*bigbluebutton_udp_ports' block: | # ====== # - Webex Meeting # ====== # - Webex Meeting (Videokonferenz) # - # - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming) # - # - UDP 9000: Outbound (VoIP and RTP) # - # - --- # - # - TCP 5004: Fall-back ports for media connectivity when UDP port 9000 # - is not open in the firewall # - webex_tcp_ports="$standard_webex_tcp_ports" webex_udp_ports="$standard_webex_udp_ports" webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports" marker: "# Marker set by modify-ipt-gateway.yml (webex service)" when: - main_ipv4_exists.stat.exists - webex_service_ipv4_present is changed - name: Check if String 'webex_tcp_ports=..' (IPv6) is present shell: grep -q -E "^webex_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf register: webex_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "webex_service_ipv6_present.rc > 1" changed_when: "webex_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (webex service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*bigbluebutton_udp_ports' block: | # ====== # - Webex Meeting # ====== # - Webex Meeting (Videokonferenz) # - # - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming) # - # - UDP 9000: Outbound (VoIP and RTP) # - # - --- # - # - TCP 5004: Fall-back ports for media connectivity when UDP port 9000 # - is not open in the firewall # - webex_tcp_ports="$standard_webex_tcp_ports" webex_udp_ports="$standard_webex_udp_ports" webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports" marker: "# Marker set by modify-ipt-gateway.yml (webex service)" when: - main_ipv6_exists.stat.exists - webex_service_ipv6_present is changed # --- # alfaview video conference service # --- - name: Check if String 'alfaview_tcp_ports=..' (IPv4) is present shell: grep -q -E "^alfaview_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf register: alfaview_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "alfaview_service_ipv4_present.rc > 1" changed_when: "alfaview_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (alfaview service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - alfaview - Video Conferencing Systems # ====== # - alfaview Service Ports # - alfaview_tcp_ports="$standard_alfaview_service_tcp_ports" alfaview_udp_ports="$standard_alfaview_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (alfaview service)" when: - main_ipv4_exists.stat.exists - alfaview_service_ipv4_present is changed - name: Check if String 'alfaview_tcp_ports=..' (IPv6) is present shell: grep -q -E "^alfaview_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf register: alfaview_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "alfaview_service_ipv6_present.rc > 1" changed_when: "alfaview_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (alfaview service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - alfaview - Video Conferencing Systems # ====== # - alfaview Service Ports # - alfaview_tcp_ports="$standard_alfaview_service_tcp_ports" alfaview_udp_ports="$standard_alfaview_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (alfaview service)" when: - main_ipv6_exists.stat.exists - alfaview_service_ipv6_present is changed # --- # TURN Server (Stun Server) (for Nextcloud 'talk' app) # --- - name: Check if String 'nc_turn_ports=..' (IPv4) is present shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv4.conf register: nc_turn_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "nc_turn_service_ipv4_present.rc > 1" changed_when: "nc_turn_service_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (nc's turn service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)" when: - main_ipv4_exists.stat.exists - nc_turn_service_ipv4_present is changed - name: Check if String 'nc_turn_ports=..' (IPv6) is present shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv6.conf register: nc_turn_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "nc_turn_service_ipv6_present.rc > 1" changed_when: "nc_turn_service_ipv6_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - nc_turn_service_ipv6_present is changed # --- # Allow Outbound Streamin / Echo360 Video Streaming # --- - name: Check if String 'allow_outbound_streaming..' (IPv4) is present shell: grep -q -E "^allow_outbound_streaming=" /ro/etc/ipt-firewall/main_ipv4.conf register: allow_outbound_streaming_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "allow_outbound_streaming_ipv4_present.rc > 1" changed_when: "allow_outbound_streaming_ipv4_present.rc > 0" - name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_outbound_streaming) blockinfile: path: /ro/etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*allow_mumble_request_out' block: | allow_outbound_streaming=true allow_echo360_video_streaming=true marker: "# Marker set by modify-ipt-gateway.yml (allow_outbound_streaming)" when: - main_ipv4_exists.stat.exists - allow_outbound_streaming_ipv4_present is changed - name: Check if String 'allow_outbound_streaming..' (IPv6) is present shell: grep -q -E "^allow_outbound_streaming=" /ro/etc/ipt-firewall/main_ipv6.conf register: allow_outbound_streaming_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "allow_outbound_streaming_ipv6_present.rc > 1" changed_when: "allow_outbound_streaming_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (allow_outbound_streaming) blockinfile: path: /ro/etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*allow_mumble_request_out' block: | allow_outbound_streaming=true allow_echo360_video_streaming=true marker: "# Marker set by modify-ipt-gateway.yml (allow_outbound_streaming)" when: - main_ipv6_exists.stat.exists - allow_outbound_streaming_ipv6_present is changed # --- # Remove Marker set by blockinfile # --- - name: Remove marker IPv4 (main_ipv4.conf) replace : path: /ro/etc/ipt-firewall/main_ipv4.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - main_ipv4_exists.stat.exists - name: Remove marker IPv6 (main_ipv6.conf) replace : path: /ro/etc/ipt-firewall/main_ipv6.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - main_ipv6_exists.stat.exists - name: Remove marker IPv4 (interfaces_ipv4.conf) replace : path: /ro/etc/ipt-firewall/interfaces_ipv4.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - interfaces_ipv4_exists.stat.exists - name: Remove marker IPv6 (interfaces_ipv6.conf) replace : path: /ro/etc/ipt-firewall/interfaces_ipv6.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - interfaces_ipv6_exists.stat.exists # --- # Confiuration Files # --- - name: Check if configuration files are latest shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) loop: - default_ports.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf register: diff_script_output - name: Ensure configuration files are latest command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }} loop: - default_ports.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf when: - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Firewall scripts # --- - name: Check if firewall scripts are latest shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) loop: - ipt-firewall-gateway - ip6t-firewall-gateway register: diff_script_output - name: Ensure firewall scripts are latest command: cp {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }} loop: - ipt-firewall-gateway - ip6t-firewall-gateway when: - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Remount Filesystem readonly # --- - name: Remount "/ro/" readonly shell: remountro register: remountro_cmd failed_when: remountro_cmd.rc != 0 and remountro_cmd.rc != 32