#!/usr/bin/env bash # {{ ansible_managed }} {# Variables shared between IPv4 and IPv6 can be overridden for IPv6 only by defining _v6 (e.g. fw_mail_server_ips_v6: ""). #} ## ---------------------------------------------------------------- ## --- Main Configurations IPv6 Firewall ## ---------------------------------------------------------------- # ------------- # --- Bridged / LXC traffic # ------------- do_not_firewall_bridged_traffic={{ (fw_do_not_firewall_bridged_traffic_v6 | default(fw_do_not_firewall_bridged_traffic)) | lower }} do_not_firewall_lx_guest_systems={{ (fw_do_not_firewall_lx_guest_systems_v6 | default(fw_do_not_firewall_lx_guest_systems)) | lower }} # ------------- # --- Drop ICMP / MNDP / mDNS # ------------- drop_icmp={{ (fw_drop_icmp_v6 | default(fw_drop_icmp)) | lower }} drop_mndp={{ (fw_drop_mndp_v6 | default(fw_drop_mndp)) | lower }} drop_mdns={{ (fw_drop_mdns_v6 | default(fw_drop_mdns)) | lower }} # ------------- # --- Outgoing traffic # ------------- allow_all_outgoing_traffic={{ (fw_allow_all_outgoing_traffic_v6 | default(fw_allow_all_outgoing_traffic)) | lower }} # ------------- # --- Interface policy # ------------- blocked_ifs="{{ (fw_blocked_ifs_v6 | default(fw_blocked_ifs)) }}" unprotected_ifs="{{ (fw_unprotected_ifs_v6 | default(fw_unprotected_ifs)) }}" # ------------- # --- Forwarding / Routing # ------------- # Private IPs to forward (CIDR notation, blank separated) forward_private_ips="{{ fw_forward_private_ips_v6 }}" # ------------- # --- Access control (source-based) # --- Note: IPv6 uses comma as field separator (not colon) # ------------- # restrict_local_service_to_net="ext-net,local-address,port,protocol" restrict_local_service_to_net="{{ fw_restrict_local_service_to_net_v6 }}" # restrict_local_net_to_net="," restrict_local_net_to_net="{{ fw_restrict_local_net_to_net_v6 }}" # allow_ext_service=",," allow_ext_service="{{ fw_allow_ext_service_v6 }}" # allow_ext_net="" (blank separated) allow_ext_net="{{ fw_allow_ext_net_v6 }}" # allow_local_service="," (blank separated) allow_local_service="{{ fw_allow_local_service_v6 }}" # allow_local_service_from_networks=",," allow_local_service_from_networks="{{ fw_allow_local_service_from_networks_v6 }}" # ------------- # --- Services: VPN / WireGuard # ------------- vpn_server_ips="{{ (fw_vpn_server_ips_v6 | default(fw_vpn_server_ips)) }}" forward_vpn_server_ips="{{ (fw_forward_vpn_server_ips_v6 | default(fw_forward_vpn_server_ips)) }}" vpn_ports="{{ (fw_vpn_ports_v6 | default(fw_vpn_ports)) }}" wireguard_server_ips="{{ (fw_wireguard_server_ips_v6 | default(fw_wireguard_server_ips)) }}" forward_wireguard_server_ips="{{ (fw_forward_wireguard_server_ips_v6 | default(fw_forward_wireguard_server_ips)) }}" wireguard_server_ports="{{ (fw_wireguard_server_ports_v6 | default(fw_wireguard_server_ports)) }}" wireguard_out_ports="{{ (fw_wireguard_out_ports_v6 | default(fw_wireguard_out_ports)) }}" # ------------- # --- Services: NTP # ------------- local_ntp_service={{ (fw_local_ntp_service_v6 | default(fw_local_ntp_service)) | lower }} ntp_port="{{ (fw_ntp_port_v6 | default(fw_ntp_port)) }}" ntp_allowed_net="{{ (fw_ntp_allowed_net_v6 | default(fw_ntp_allowed_net)) }}" # ------------- # --- Services: DNS # ------------- dns_server_ips="{{ (fw_dns_server_ips_v6 | default(fw_dns_server_ips)) }}" forward_dns_server_ips="{{ (fw_forward_dns_server_ips_v6 | default(fw_forward_dns_server_ips)) }}" local_resolver_service={{ (fw_local_resolver_service_v6 | default(fw_local_resolver_service)) | lower }} resolver_port="{{ (fw_resolver_port_v6 | default(fw_resolver_port)) }}" # resolver_allowed_networks="2001:678:a40:3000::/64" resolver_allowed_networks="{{ fw_resolver_allowed_networks_v6 }}" # ------------- # --- Services: SSH # ------------- ssh_server_ips="{{ (fw_ssh_server_ips_v6 | default(fw_ssh_server_ips)) }}" forward_ssh_server_ips="{{ (fw_forward_ssh_server_ips_v6 | default(fw_forward_ssh_server_ips)) }}" ssh_ports="{{ (fw_ssh_ports_v6 | default(fw_ssh_ports)) }}" # ------------- # --- Services: HTTP(S) # ------------- http_server_ips="{{ (fw_http_server_ips_v6 | default(fw_http_server_ips)) }}" forward_http_server_ips="{{ (fw_forward_http_server_ips_v6 | default(fw_forward_http_server_ips)) }}" http_ports="{{ (fw_http_ports_v6 | default(fw_http_ports)) }}" log_cgi_traffic_out={{ (fw_log_cgi_traffic_out_v6 | default(fw_log_cgi_traffic_out)) | lower }} cgi_script_users="{{ (fw_cgi_script_users_v6 | default(fw_cgi_script_users)) }}" # Restrictions on HTTP(S) connections to counteract attacks set_max_new_http_conn_per_ip_per_second={{ (fw_set_max_new_http_conn_per_ip_per_second_v6 | default(fw_set_max_new_http_conn_per_ip_per_second)) | lower }} max_http_new_conn_per_ip_per_second="{{ (fw_max_http_new_conn_per_ip_per_second_v6 | default(fw_max_http_new_conn_per_ip_per_second)) }}" set_max_concurrent_http_conn_per_ip={{ (fw_set_max_concurrent_http_conn_per_ip_v6 | default(fw_set_max_concurrent_http_conn_per_ip)) | lower }} max_concurrent_http_conn_per_ip="{{ (fw_max_concurrent_http_conn_per_ip_v6 | default(fw_max_concurrent_http_conn_per_ip)) }}" set_max_new_http_conn_per_second={{ (fw_set_max_new_http_conn_per_second_v6 | default(fw_set_max_new_http_conn_per_second)) | lower }} max_new_http_conn_per_second="{{ (fw_max_new_http_conn_per_second_v6 | default(fw_max_new_http_conn_per_second)) }}" # Clamp the advertised MSS of incoming HTTPS SYN packets throttle_tcp6_mss_for_https={{ fw_throttle_tcp6_mss_for_https | lower }} tcp6_mss_for_https_val="{{ fw_tcp6_mss_for_https_val }}" # ------------- # --- Services: Mattermost # ------------- mm_server_ips="{{ (fw_mm_server_ips_v6 | default(fw_mm_server_ips)) }}" forward_mm_server_ips="{{ (fw_forward_mm_server_ips_v6 | default(fw_forward_mm_server_ips)) }}" mm_udp_ports_in="{{ (fw_mm_udp_ports_in_v6 | default(fw_mm_udp_ports_in)) }}" mm_tcp_ports_in="{{ (fw_mm_tcp_ports_in_v6 | default(fw_mm_tcp_ports_in)) }}" mm_udp_ports_out="{{ (fw_mm_udp_ports_out_v6 | default(fw_mm_udp_ports_out)) }}" # ------------- # --- Services: Mail (SMTP / IMAP / POP) # ------------- smtpd_ips="{{ (fw_smtpd_ips_v6 | default(fw_smtpd_ips)) }}" forward_smtpd_ips="{{ (fw_forward_smtpd_ips_v6 | default(fw_forward_smtpd_ips)) }}" smtpd_additional_listen_ports="{{ (fw_smtpd_additional_listen_ports_v6 | default(fw_smtpd_additional_listen_ports)) }}" smtpd_additional_outgoung_ports="{{ (fw_smtpd_additional_outgoing_ports_v6 | default(fw_smtpd_additional_outgoing_ports)) }}" mail_server_ips="{{ (fw_mail_server_ips_v6 | default(fw_mail_server_ips)) }}" forward_mail_server_ips="{{ (fw_forward_mail_server_ips_v6 | default(fw_forward_mail_server_ips)) }}" mail_user_ports="{{ (fw_mail_user_ports_v6 | default(fw_mail_user_ports)) }}" mail_client_ips="{{ (fw_mail_client_ips_v6 | default(fw_mail_client_ips)) }}" forward_mail_client_ips="{{ (fw_forward_mail_client_ips_v6 | default(fw_forward_mail_client_ips)) }}" dovecot_auth_service={{ (fw_dovecot_auth_service_v6 | default(fw_dovecot_auth_service)) | lower }} dovecot_auth_port="{{ (fw_dovecot_auth_port_v6 | default(fw_dovecot_auth_port)) }}" # dovecot_auth_allowed_networks="2001:678:a40:3000::/64 2a01:30:0:13:2f7:50ff:fed2:cef7" dovecot_auth_allowed_networks="{{ fw_dovecot_auth_allowed_networks_v6 }}" # ------------- # --- Services: FTP # ------------- ftp_server_ips="{{ (fw_ftp_server_ips_v6 | default(fw_ftp_server_ips)) }}" forward_ftp_server_ips="{{ (fw_forward_ftp_server_ips_v6 | default(fw_forward_ftp_server_ips)) }}" ftp_passive_port_range="{{ (fw_ftp_passive_port_range_v6 | default(fw_ftp_passive_port_range)) }}" # ------------- # --- Services: XMPP (Jabber / Prosody) # ------------- xmpp_server_ips="{{ (fw_xmpp_server_ips_v6 | default(fw_xmpp_server_ips)) }}" forward_xmpp_server_ips="{{ (fw_forward_xmpp_server_ips_v6 | default(fw_forward_xmpp_server_ips)) }}" xmmp_tcp_in_ports="{{ (fw_xmmp_tcp_in_ports_v6 | default(fw_xmmp_tcp_in_ports)) }}" xmmp_tcp_out_ports="{{ (fw_xmmp_tcp_out_ports_v6 | default(fw_xmmp_tcp_out_ports)) }}" # xmmp_remote_out_services="2a01:4f8:221:3b4e::247,44444" xmmp_remote_out_services="{{ fw_xmmp_remote_out_services_v6 }}" # ------------- # --- Services: Mumble # ------------- mumble_server_ips="{{ (fw_mumble_server_ips_v6 | default(fw_mumble_server_ips)) }}" forward_mumble_server_ips="{{ (fw_forward_mumble_server_ips_v6 | default(fw_forward_mumble_server_ips)) }}" mumble_ports="{{ (fw_mumble_ports_v6 | default(fw_mumble_ports)) }}" # ------------- # --- Services: Jitsi / Jibri # ------------- jitsi_server_ips="{{ (fw_jitsi_server_ips_v6 | default(fw_jitsi_server_ips)) }}" forward_jitsi_server_ips="{{ (fw_forward_jitsi_server_ips_v6 | default(fw_forward_jitsi_server_ips)) }}" jitsi_tcp_ports="{{ (fw_jitsi_tcp_ports_v6 | default(fw_jitsi_tcp_ports)) }}" jitsi_udp_port_range="{{ (fw_jitsi_udp_port_range_v6 | default(fw_jitsi_udp_port_range)) }}" jitsi_tcp_ports_out="{{ (fw_jitsi_tcp_ports_out_v6 | default(fw_jitsi_tcp_ports_out)) }}" jitsi_udp_ports_out="{{ (fw_jitsi_udp_ports_out_v6 | default(fw_jitsi_udp_ports_out)) }}" jitsi_dovecot_auth={{ (fw_jitsi_dovecot_auth_v6 | default(fw_jitsi_dovecot_auth)) | lower }} jitsi_dovecot_host="{{ (fw_jitsi_dovecot_host_v6 | default(fw_jitsi_dovecot_host)) }}" jitsi_dovecot_port="{{ fw_jitsi_dovecot_port }}" jitsi_jibri_remote_auth={{ (fw_jitsi_jibri_remote_auth_v6 | default(fw_jitsi_jibri_remote_auth)) | lower }} jitsi_jibri_remote_ips="{{ (fw_jitsi_jibri_remote_ips_v6 | default(fw_jitsi_jibri_remote_ips)) }}" jitsi_jibri_remote_auth_port="{{ fw_jitsi_jibri_remote_auth_port }}" jibri_server_ips="{{ (fw_jibri_server_ips_v6 | default(fw_jibri_server_ips)) }}" forward_jibri_server_ips="{{ (fw_forward_jibri_server_ips_v6 | default(fw_forward_jibri_server_ips)) }}" jibri_remote_jitsi_server="{{ (fw_jibri_remote_jitsi_server_v6 | default(fw_jibri_remote_jitsi_server)) }}" jibri_remote_auth_port="{{ fw_jibri_remote_auth_port }}" # ------------- # --- Services: TURN / STUN (Nextcloud Talk) # ------------- nc_turn_server_ips="{{ (fw_nc_turn_server_ips_v6 | default(fw_nc_turn_server_ips)) }}" forward_nc_turn_server_ips="{{ (fw_forward_nc_turn_server_ips_v6 | default(fw_forward_nc_turn_server_ips)) }}" nc_turn_ports="{{ (fw_nc_turn_ports_v6 | default(fw_nc_turn_ports)) }}" nc_turn_udp_ports="{{ (fw_nc_turn_udp_ports_v6 | default(fw_nc_turn_udp_ports)) }}" # ------------- # --- Services: TFTP (not yet implemented) # ------------- tftp_server_ips="{{ (fw_tftp_server_ips_v6 | default(fw_tftp_server_ips)) }}" # ------------- # --- Services: Prometheus # ------------- prometheus_local_server_ips="{{ (fw_prometheus_local_server_ips_v6 | default(fw_prometheus_local_server_ips)) }}" prometheus_remote_client_ports="{{ fw_prometheus_remote_client_ports }}" prometheus_local_client_ips="{{ (fw_prometheus_local_client_ips_v6 | default(fw_prometheus_local_client_ips)) }}" prometheus_local_client_ports="{{ fw_prometheus_local_client_ports }}" prometheus_remote_server_ips="{{ (fw_prometheus_remote_server_ips_v6 | default(fw_prometheus_remote_server_ips)) }}" # ------------- # --- Services: Munin # ------------- munin_server_ips="{{ (fw_munin_server_ips_v6 | default(fw_munin_server_ips)) }}" forward_munin_server_ips="{{ (fw_forward_munin_server_ips_v6 | default(fw_forward_munin_server_ips)) }}" munin_remote_port="{{ (fw_munin_remote_port_v6 | default(fw_munin_remote_port)) }}" munin_remote_ip="{{ munin_remote_ipv6 }}" munin_local_port="{{ (fw_munin_local_port_v6 | default(fw_munin_local_port)) }}" # ------------- # --- Services: Xymon (not yet implemented) # ------------- xymon_server_ips="{{ (fw_xymon_server_ips_v6 | default(fw_xymon_server_ips)) }}" local_xymon_client={{ (fw_local_xymon_client_v6 | default(fw_local_xymon_client)) | lower }} xymon_port="{{ (fw_xymon_port_v6 | default(fw_xymon_port)) }}" # ------------- # --- Protocols out: Rsync # ------------- rsync_out_ips="{{ (fw_rsync_out_ips_v6 | default(fw_rsync_out_ips)) }}" forward_rsync_out_ips="{{ (fw_forward_rsync_out_ips_v6 | default(fw_forward_rsync_out_ips)) }}" rsync_ports="{{ (fw_rsync_ports_v6 | default(fw_rsync_ports)) }}" # ------------- # --- Special ports (OUT) # ------------- tcp_out_ports="{{ (fw_tcp_out_ports_v6 | default(fw_tcp_out_ports)) }}" forward_tcp_out_ports="{{ (fw_forward_tcp_out_ports_v6 | default(fw_forward_tcp_out_ports)) }}" udp_out_ports="{{ (fw_udp_out_ports_v6 | default(fw_udp_out_ports)) }}" forward_udp_out_ports="{{ (fw_forward_udp_out_ports_v6 | default(fw_forward_udp_out_ports)) }}" # ============= # --- Portforwarding (IPv6) # --- Format: ",,,," # ============= portforward_tcp="{{ fw_portforward_tcp_v6 }}" portforward_udp="{{ fw_portforward_udp_v6 }}" # ------------- # --- Blocked IPs / Ports # ------------- blocked_ips="{{ fw_blocked_ips_v6 }}" # Prefix length for entries in ban_ipv6.list given without mask ban_ipv6_mask="{{ fw_ban_ipv6_mask }}" block_tcp_ports="{{ (fw_block_tcp_ports_v6 | default(fw_block_tcp_ports)) }}" block_udp_ports="{{ (fw_block_udp_ports_v6 | default(fw_block_udp_ports)) }}" # ------------- # --- Special / Counters # ------------- create_traffic_counter={{ (fw_create_traffic_counter_v6 | default(fw_create_traffic_counter)) | lower }} create_iperf_rules={{ (fw_create_iperf_rules_v6 | default(fw_create_iperf_rules)) | lower }} # ------------- # --- Protection # ------------- protection_against_syn_flooding={{ (fw_protection_against_syn_flooding_v6 | default(fw_protection_against_syn_flooding)) | lower }} protection_against_port_scanning={{ (fw_protection_against_port_scanning_v6 | default(fw_protection_against_port_scanning)) | lower }} protection_against_ssh_brute_force_attacks={{ (fw_protection_against_ssh_brute_force_attacks_v6 | default(fw_protection_against_ssh_brute_force_attacks)) | lower }} # ------------- # --- Connection limits # ------------- limit_connections_per_source_IP={{ (fw_limit_connections_per_source_IP_v6 | default(fw_limit_connections_per_source_IP)) | lower }} per_IP_connection_limit={{ (fw_per_IP_connection_limit_v6 | default(fw_per_IP_connection_limit)) }} limit_new_tcp_connections_per_seconds_per_source_IP={{ (fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6 | default(fw_limit_new_tcp_connections_per_seconds_per_source_IP)) | lower }} limit_new_tcp_connections_per_seconds_ports="{{ (fw_limit_new_tcp_connections_per_seconds_ports_v6 | default(fw_limit_new_tcp_connections_per_seconds_ports)) }}" # ------------- # --- Kernel parameters (IPv6) # ------------- kernel_forward_between_interfaces={{ fw_kernel_forward_between_interfaces | lower }} kernel_deactivate_source_route={{ fw_kernel_deactivate_source_route | lower }} kernel_dont_accept_redirects={{ fw_kernel_dont_accept_redirects | lower }}