ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
19617c6a5c
oopen-server/roles/modify-ipt-gateway/tasks/main.yml
ckubu 98fbed31b7 update..
2024-08-30 22:41:08 +02:00

444 lines
13 KiB
YAML
Raw Blame History

---
# ---
# Install/Uodate git firewall repository
# ---
- name: Install/update firewall repository
git:
repo: '{{ git_firewall_repository.repo }}'
dest: '{{ git_firewall_repository.dest }}'
when: git_firewall_repository is defined and git_firewall_repository|length > 0
# ---
# Some Checks
# ---
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv4.conf
register: main_ipv4_exists
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
stat:
path: /etc/ipt-firewall/main_ipv6.conf
register: main_ipv6_exists
- name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists
stat:
path: /etc/ipt-firewall/interfaces_ipv4.conf
register: interfaces_ipv4_exists
- name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists
stat:
path: /etc/ipt-firewall/interfaces_ipv6.conf
register: interfaces_ipv6_exists
# ---
# Adjust some lines
# ---
- name: addjust line 'zoom_udp_ports' (IPv4)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^zoom_udp_ports='
line: 'zoom_udp_ports="$standard_zoom_udp_ports"'
when:
- main_ipv4_exists.stat.exists
notify:
- Restart IPv4 Firewall
- name: addjust line 'zoom_udp_ports' (IPv6)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^zoom_udp_ports='
line: 'zoom_udp_ports="$standard_zoom_udp_ports"'
when:
- main_ipv6_exists.stat.exists
notify:
- Restart IPv6 Firewall
- name: addjust line 'jitsi_udp_ports' (IPv4)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^jitsi_udp_ports='
line: 'jitsi_udp_ports="$standard_jitsi_udp_ports"'
when:
- main_ipv4_exists.stat.exists
notify:
- Restart IPv4 Firewall
- name: addjust line 'jitsi_udp_ports' (IPv6)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^jitsi_udp_ports='
line: 'jitsi_udp_ports="$standard_jitsi_udp_ports"'
when:
- main_ipv6_exists.stat.exists
notify:
- Restart IPv6 Firewall
- name: addjust line 'bigbluebutton_udp_ports' (IPv4)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^bigbluebutton_udp_ports='
line: 'bigbluebutton_udp_ports="$standard_bigbluebutton_udp_ports"'
when:
- main_ipv4_exists.stat.exists
notify:
- Restart IPv4 Firewall
- name: addjust line 'bigbluebutton_udp_ports' (IPv6)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^bigbluebutton_udp_ports='
line: 'bigbluebutton_udp_ports="$standard_bigbluebutton_udp_ports"'
when:
- main_ipv6_exists.stat.exists
notify:
- Restart IPv6 Firewall
- name: addjust line 'adjust_kernel_parameters' (IPv6)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^adjust_kernel_parameters='
line: '#adjust6_kernel_parameters=true'
when:
- main_ipv6_exists.stat.exists
notify:
- Restart IPv6 Firewall
- name: addjust line 'protect_against_several_attack' (IPv6)
lineinfile:
path: /etc/ipt-firewall/main_ipv6.conf
regexp: '^protect_against_several_attacks='
line: '#protect6_against_several_attacks=true'
when:
- main_ipv6_exists.stat.exists
notify:
- Restart IPv6 Firewall
- name: addjust line 'blocked_ips' (IPv4)
lineinfile:
path: /etc/ipt-firewall/main_ipv4.conf
regexp: '^blocked_ips='
line: 'blocked_ips=""'
when:
- main_ipv4_exists.stat.exists
notify:
- Restart IPv4 Firewall
# ---
# FreeIPA Service
# ---
- name: Check if String 'freeipa_udp_in_ports..' (IPv4) is present
shell: grep -q -E "^#?freeipa_udp_in_ports=" /etc/ipt-firewall/main_ipv4.conf
register: freeipa_udp_in_ports_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "freeipa_udp_in_ports_ipv4_present.rc > 1"
changed_when: "freeipa_udp_in_ports_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (FreeIPA Service)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*snmp_trap_port'
block: |
# ======
# - FreeIPA Service
# ======
# - FreeIPA services local Networks
# -
freeipa_server_ips=""
# - FreeIPA (in) Ports
# -
freeipa_tcp_in_ports="$standard_freeipa_tcp_in_ports"
freeipa_udp_in_ports="$standard_freeipa_udp_in_ports"
marker: "# Marker set by modify-ipt-gateway.yml (FreeIPA Service)"
when:
- main_ipv4_exists.stat.exists
- freeipa_udp_in_ports_ipv4_present is changed
- name: Check if String 'freeipa_udp_in_ports..' (IPv6) is present
shell: grep -q -E "^#?freeipa_udp_in_ports=" /etc/ipt-firewall/main_ipv6.conf
register: freeipa_udp_in_ports_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "freeipa_udp_in_ports_ipv6_present.rc > 1"
changed_when: "freeipa_udp_in_ports_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (FreeIPA Service)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*vpn_out_ports='
block: |
# ======
# - FreeIPA Service
# ======
# - FreeIPA services local Networks
# -
freeipa_server_ips=""
# - FreeIPA (in) Ports
# -
freeipa_tcp_in_ports="$standard_freeipa_tcp_in_ports"
freeipa_udp_in_ports="$standard_freeipa_udp_in_ports"
marker: "# Marker set by modify-ipt-gateway.yml (FreeIPA Service)"
when:
- main_ipv6_exists.stat.exists
- freeipa_udp_in_ports_ipv6_present is changed
# ---
# Restrict VPN Networks
# ---
- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv4) is present
shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv4.conf
register: restrict_vpn_net_to_local_service_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 1"
changed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (restrict_vpn_net_to_local_service)
blockinfile:
path: /etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*vpn_out_ports='
block: |
# -----
# - Restrict VPN Network to local Service
# -----#
# - restrict_vpn_net_to_local_service
# -
# - allow_ext_net_to_local_service="vpn-net:local-address:port:protocol [vpn-net:local-address:port:protocol] [..]"
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - restrict_vpn_net_to_local_service="
# - 10.100.112.0/24:192.168.112.192/27:80:tcp
# - 10.100.112.0/24:192.168.112.192/27:443:tcp
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_service=""
# -----
# - Restrict VPN Network to local (Sub) network
# -----
# - restrict_vpn_net_to_local_subnet
# -
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>:<dst-local-net> [<src-vpn-net>:<dst-local-net>} [..]
# -
# - Example:
# - restrict_vpn_net_to_local_subnet="
# - 10.100.112.0/24:192.168.112.192/27
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_subnet=""
marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
when:
- main_ipv4_exists.stat.exists
- restrict_vpn_net_to_local_service_ipv4_present is changed
- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv6) is present
shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv6.conf
register: restrict_vpn_net_to_local_service_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 1"
changed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 0"
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (restrict_vpn_net_to_local_service)
blockinfile:
path: /etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*vpn_out_ports='
block: |
# -----
# - Restrict VPN Network to local Service
# -----#
# - restrict_vpn_net_to_local_service
# -
# - allow_ext_net_to_local_service="vpn-net,local-address,port,protocol [vpn-net,local-address,port,protocol] [..]"
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - restrict_vpn_net_to_local_service="
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,80,tcp
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,443,tcp
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_service=""
# -----
# - Restrict VPN Network to local (Sub) network
# -----
# - restrict_vpn_net_to_local_subnet
# -
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>,<dst-local-net> [<src-vpn-net>,<dst-local-net>} [..]
# -
# - Example:
# - restrict_vpn_net_to_local_subnet="
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_subnet=""
marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
when:
- main_ipv6_exists.stat.exists
- restrict_vpn_net_to_local_service_ipv6_present is changed
# ---
# Remove Marker set by blockinfile
# ---
- name: Remove marker IPv4 (main_ipv4.conf)
replace :
path: /etc/ipt-firewall/main_ipv4.conf
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
replace: ""
register: marker_ipv4_removed
#failed_when: "marker_ipv4_removed.rc > 1"
#changed_when: "marker_ipv4_removed.rc < 1"
when:
- main_ipv4_exists.stat.exists
- name: Remove marker IPv6 (main_ipv6.conf)
replace :
path: /etc/ipt-firewall/main_ipv6.conf
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
replace: ""
register: marker_ipv6_removed
#failed_when: "marker_ipv6_removed.rc > 1"
#changed_when: "marker_ipv6_removed.rc < 1"
when:
- main_ipv6_exists.stat.exists
- name: Remove marker IPv4 (interfaces_ipv4.conf)
replace :
path: /etc/ipt-firewall/interfaces_ipv4.conf
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
replace: ""
register: marker_ipv4_removed
#failed_when: "marker_ipv4_removed.rc > 1"
#changed_when: "marker_ipv4_removed.rc < 1"
when:
- interfaces_ipv4_exists.stat.exists
- name: Remove marker IPv6 (interfaces_ipv6.conf)
replace :
path: /etc/ipt-firewall/interfaces_ipv6.conf
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
replace: ""
register: marker_ipv6_removed
#failed_when: "marker_ipv6_removed.rc > 1"
#changed_when: "marker_ipv6_removed.rc < 1"
when:
- interfaces_ipv6_exists.stat.exists
# ---
# Confiuration Files
# ---
- name: Check if configuration files are latest
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
changed_when: "diff_script_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_script_output.rc > 2"
when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
loop:
- default_ports.conf
- default_ipv4.conf
- default_ipv6.conf
- default_basic_behavior.conf
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- post_decalrations.conf
register: diff_script_output
- name: Ensure configuration files are latest
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
loop:
- default_ports.conf
- default_ipv4.conf
- default_ipv6.conf
- default_basic_behavior.conf
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- post_decalrations.conf
when:
- (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
- diff_script_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
# ---
# Firewall scripts
# ---
- name: Check if firewall scripts are latest
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
changed_when: "diff_script_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_script_output.rc > 2"
when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
loop:
- ipt-firewall-gateway
- ip6t-firewall-gateway
register: diff_script_output
- name: Ensure firewall scripts are latest
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
loop:
- ipt-firewall-gateway
- ip6t-firewall-gateway
when:
- (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
- diff_script_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
Reference in New Issue View Git Blame Copy Permalink