1422 lines
46 KiB
YAML
1422 lines
46 KiB
YAML
---
|
|
|
|
|
|
# ---
|
|
# Remount Filesystem writable
|
|
# ---
|
|
|
|
- name: Remount "/ro/" writable
|
|
shell: remountrw
|
|
|
|
# ---
|
|
# Install/Uodate git firewall repository
|
|
# ---
|
|
|
|
- name: Install/update firewall repository
|
|
git:
|
|
repo: '{{ git_firewall_repository.repo }}'
|
|
dest: '{{ git_firewall_repository.dest }}'
|
|
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
|
|
|
|
# ---
|
|
# Some Checks
|
|
# ---
|
|
|
|
- name: Check if file '/ro/etc/ipt-firewall/main_ipv4.conf' exists
|
|
stat:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: main_ipv4_exists
|
|
|
|
- name: Check if file '/ro/etc/ipt-firewall/main_ipv6.conf' exists
|
|
stat:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: main_ipv6_exists
|
|
|
|
- name: Check if file '/ro/etc/ipt-firewall/interfaces_ipv4.conf' exists
|
|
stat:
|
|
path: /ro/etc/ipt-firewall/interfaces_ipv4.conf
|
|
register: interfaces_ipv4_exists
|
|
|
|
- name: Check if file '/ro/etc/ipt-firewall/interfaces_ipv6.conf' exists
|
|
stat:
|
|
path: /ro/etc/ipt-firewall/interfaces_ipv6.conf
|
|
register: interfaces_ipv6_exists
|
|
|
|
|
|
# ---
|
|
# Adjust some lines
|
|
# ---
|
|
|
|
- name: addjust line 'jitsi_tcp_ports' (IPv4)
|
|
lineinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
regexp: '^jitsi_tcp_ports='
|
|
line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'
|
|
|
|
- name: addjust line 'jitsi_tcp_ports' (IPv6)
|
|
lineinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
regexp: '^jitsi_tcp_ports='
|
|
line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
|
|
- name: addjust line 'jitsi_udp_ports' (IPv4)
|
|
lineinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
regexp: '^jitsi_udp_ports='
|
|
line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'
|
|
|
|
- name: addjust line 'jitsi_udp_ports' (IPv6)
|
|
lineinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
regexp: '^jitsi_udp_ports='
|
|
line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
|
|
- name: addjust line 'brscan_port' (IPv4)
|
|
lineinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
regexp: '^brscan_port='
|
|
line: 'brscan_port="$standard_brother_brscan_port"'
|
|
|
|
- name: addjust line 'brscan_port' (IPv6)
|
|
lineinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
regexp: '^brscan_port='
|
|
line: 'brscan_port="$standard_brother_brscan_port"'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
|
|
|
|
# ---
|
|
# allow_ms_skype_teams_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_ms_skype_teams_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_ms_skype_teams_out=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: ms_skype_teams_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "ms_skype_teams_out_ipv4_present.rc > 1"
|
|
changed_when: "ms_skype_teams_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (ms teams)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_ms_skype_teams_out'
|
|
line: 'allow_ms_skype_teams_out=true'
|
|
insertafter: '^#?\s*allow_bigbluebutton_video_conference_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- ms_skype_teams_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_ms_skype_teams_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_ms_skype_teams_out=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: ms_skype_teams_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "ms_skype_teams_out_ipv6_present.rc > 1"
|
|
changed_when: "ms_skype_teams_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (ms teams)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_ms_skype_teams_out'
|
|
line: 'allow_ms_skype_teams_out=true'
|
|
insertafter: '^#?\s*allow_bigbluebutton_video_conference_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- ms_skype_teams_out_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# allow_jitsi_video_conference_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_jitsi_video_conference_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_jitsi_video_conference_out=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: jitsi_video_conference_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "jitsi_video_conference_out_ipv4_present.rc > 1"
|
|
changed_when: "jitsi_video_conference_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_jitsi_video_conference_out'
|
|
line: 'allow_jitsi_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- jitsi_video_conference_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_jitsi_video_conference_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_jitsi_video_conference_out=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: jitsi_video_conference_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "jitsi_video_conference_out_ipv6_present.rc > 1"
|
|
changed_when: "jitsi_video_conference_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_jitsi_video_conference_out'
|
|
line: 'allow_jitsi_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- jitsi_video_conference_out_ipv6_present is changed
|
|
|
|
# ---
|
|
# allow_nc_talk_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_nc_talk_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_nc_talk_out=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: nc_talk_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "nc_talk_out_ipv4_present.rc > 1"
|
|
changed_when: "nc_talk_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (nc_talk)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_nc_talk_out'
|
|
line: 'allow_nc_talk_out=true'
|
|
insertafter: '^#?\s*allow_jitsi_video_conference_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- nc_talk_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_nc_talk_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_nc_talk_out=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: nc_talk_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "nc_talk_out_ipv6_present.rc > 1"
|
|
changed_when: "nc_talk_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (nc_talk)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_nc_talk_out'
|
|
line: 'allow_nc_talk_out=true'
|
|
insertafter: '^#?\s*allow_jitsi_video_conference_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- nc_talk_out_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# allow_webex_video_conference_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_webex_video_conference_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_webex_video_conference_out=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: webex_video_conference_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "webex_video_conference_out_ipv4_present.rc > 1"
|
|
changed_when: "webex_video_conference_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (webex)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_webex_video_conference_out'
|
|
line: 'allow_webex_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_bigbluebutton_video_conference_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- webex_video_conference_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_webex_video_conference_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_webex_video_conference_out=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: webex_video_conference_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "webex_video_conference_out_ipv6_present.rc > 1"
|
|
changed_when: "webex_video_conference_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (webex)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_webex_video_conference_out'
|
|
line: 'allow_webex_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_bigbluebutton_video_conference_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- webex_video_conference_out_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# allow_alfaview_video_conference_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_alfaview_video_conference_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_alfaview_video_conference_out=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: alfaview_video_conference_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "alfaview_video_conference_out_ipv4_present.rc > 1"
|
|
changed_when: "alfaview_video_conference_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_alfaview_video_conference_out'
|
|
line: 'allow_alfaview_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- alfaview_video_conference_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_alfaview_video_conference_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_alfaview_video_conference_out=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: alfaview_video_conference_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "alfaview_video_conference_out_ipv6_present.rc > 1"
|
|
changed_when: "alfaview_video_conference_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton)
|
|
lineinfile:
|
|
dest: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_alfaview_video_conference_out'
|
|
line: 'allow_alfaview_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- alfaview_video_conference_out_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# Remote VPN ports
|
|
# ---
|
|
|
|
- name: Check if String '# Remote VPN ports..' (IPv4) is present
|
|
shell: grep -q -E "^# Remote VPN ports=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: vpn_out_ports_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "vpn_out_ports_ipv4_present.rc > 1"
|
|
changed_when: "vpn_out_ports_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (Remote VPN ports)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*vpn_local_net_ports'
|
|
block: |
|
|
# Remote VPN ports
|
|
#
|
|
vpn_out_ports="$standard_vpn_port"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- vpn_out_ports_ipv4_present is changed
|
|
|
|
- name: Check if String '# Remote VPN ports..' (IPv6) is present
|
|
shell: grep -q -E "^# Remote VPN ports=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: vpn_out_ports_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "vpn_out_ports_ipv6_present.rc > 1"
|
|
changed_when: "vpn_out_ports_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (Remote VPN ports)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*vpn_local_net_ports'
|
|
block: |
|
|
# Remote VPN ports
|
|
#
|
|
vpn_out_ports="$standard_vpn_port"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (vpn_out_ports)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- vpn_out_ports_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# u.a. Cisco VPN
|
|
# ---
|
|
|
|
- name: Check if String '# Remote WireGuard Ports..' (IPv4) is present
|
|
shell: grep -q -E "^# Remote WireGuard Ports" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: wg_out_ports_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "wg_out_ports_ipv4_present.rc > 1"
|
|
changed_when: "wg_out_ports_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (Cisco VPN)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*wg_local_net_ports'
|
|
block: |
|
|
# Remote WireGuard Ports
|
|
#
|
|
wg_out_ports="$standard_wg_port"
|
|
|
|
|
|
# ======
|
|
# - Cisco VPN
|
|
# ======
|
|
|
|
cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
|
|
cisco_vpn_out_protocol="esp"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- wg_out_ports_ipv4_present is changed
|
|
|
|
- name: Check if String '# Remote WireGuard Ports..' (IPv6) is present
|
|
shell: grep -q -E "^# Remote WireGuard Ports" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: wg_out_ports_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "wg_out_ports_ipv6_present.rc > 1"
|
|
changed_when: "wg_out_ports_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (Cisco VPN)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*wg_local_net_ports'
|
|
block: |
|
|
# Remote WireGuard Ports
|
|
#
|
|
wg_out_ports="$standard_wg_port"
|
|
|
|
|
|
# ======
|
|
# - Cisco VPN
|
|
# ======
|
|
|
|
cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
|
|
cisco_vpn_out_protocol="esp"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (cisco_vpn)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- wg_out_ports_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# WireGuard Service
|
|
# ---
|
|
|
|
- name: Check if String 'local_wg_service..' (IPv4) is present
|
|
shell: grep -q -E "^local_wg_service=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: local_wg_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "local_wg_service_ipv4_present.rc > 1"
|
|
changed_when: "local_wg_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (local_wg_service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*vpn_local_net_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - WireGuard Service
|
|
# ======
|
|
|
|
# - WireGuard Service on Gateway?
|
|
# -
|
|
local_wg_service=true
|
|
wg_gw_ports="$standard_wg_port"
|
|
|
|
# - WireGuard Services DMZ (reachable also from WAN)
|
|
# -
|
|
# - wg_server_dmz_arr=[<ip-address>]=<dsl-device>
|
|
# -
|
|
# - Note:
|
|
# - Each extern interface can have only one thuch service
|
|
# -
|
|
# - wg_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
|
|
# - wg_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1
|
|
# -
|
|
# - Multiple settins of this parameter is possible
|
|
# -
|
|
declare -A wg_server_dmz_arr
|
|
|
|
# - Local WireGuard Ports
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
wg_local_net_ports="$standard_wg_port"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (local_wg_service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- local_wg_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'local_wg_service..' (IPv6) is present
|
|
shell: grep -q -E "^local_wg_service=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: local_wg_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "local_wg_service_ipv6_present.rc > 1"
|
|
changed_when: "local_wg_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (local_wg_service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*vpn_local_net_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - WireGuard Service
|
|
# ======
|
|
|
|
# - WireGuard Service on Gateway?
|
|
# -
|
|
local_wg_service=true
|
|
wg_gw_ports="$standard_wg_port"
|
|
|
|
# - WireGuard Services DMZ (reachable also from WAN)
|
|
# -
|
|
# - wg_server_dmz_arr=[<ip-address>]=<dsl-device>
|
|
# -
|
|
# - Note:
|
|
# - Each extern interface can have only one thuch service
|
|
# -
|
|
# - wg_server_dmz_arr[2001:6f8:107e:63::20]=$ext_if_dsl_2
|
|
# - wg_server_dmz_arr[2001:6f8:107e:63::40]=$ext_if_dsl_1
|
|
# -
|
|
# - Multiple settins of this parameter is possible
|
|
# -
|
|
declare -A wg_server_dmz_arr
|
|
|
|
# - Local WireGuard Ports
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
wg_local_net_ports="$standard_wg_port"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (local_wg_service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- local_wg_service_ipv6_present is changed
|
|
|
|
|
|
- name: Check if String 'allow_wg_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_wg_out=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: allow_wg_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "allow_wg_out_ipv4_present.rc > 1"
|
|
changed_when: "allow_wg_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_wg_out)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*vpn_out_ports'
|
|
block: |
|
|
# WireGuard
|
|
#
|
|
allow_wg_out=true
|
|
wg_out_ports="$standard_wg_port"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_wg_out)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- allow_wg_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_wg_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_wg_out=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: allow_wg_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "allow_wg_out_ipv6_present.rc > 1"
|
|
changed_when: "allow_wg_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (allow_wg_out)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*vpn_out_ports'
|
|
block: |
|
|
# WireGuard
|
|
#
|
|
allow_wg_out=true
|
|
wg_out_ports="$standard_wg_port"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_wg_out)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- allow_wg_out_ipv6_present is changed
|
|
|
|
|
|
- name: Check if String 'wg_ifs..' (IPv4) is present
|
|
shell: grep -q -E "^wg_ifs=" /ro/etc/ipt-firewall/interfaces_ipv4.conf
|
|
register: wg_ifs_ipv4_present
|
|
when: interfaces_ipv4_exists.stat.exists
|
|
failed_when: "wg_ifs_ipv4_present.rc > 1"
|
|
changed_when: "wg_ifs_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/interfaces_ipv4.conf' (wg_ifs)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/interfaces_ipv4.conf
|
|
insertafter: '^#?\s*vpn_ifs'
|
|
block: |
|
|
# - WireGuard Interfaces
|
|
# -
|
|
# - (blank separated list)
|
|
# -
|
|
wg_ifs="wg+"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (wg_ifs)"
|
|
when:
|
|
- interfaces_ipv4_exists.stat.exists
|
|
- wg_ifs_ipv4_present is changed
|
|
|
|
- name: Check if String 'wg_ifs..' (IPv6) is present
|
|
shell: grep -q -E "^wg_ifs=" /ro/etc/ipt-firewall/interfaces_ipv6.conf
|
|
register: wg_ifs_ipv6_present
|
|
when: interfaces_ipv6_exists.stat.exists
|
|
failed_when: "wg_ifs_ipv6_present.rc > 1"
|
|
changed_when: "wg_ifs_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/interfaces_ipv6.conf' (wg_ifs)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/interfaces_ipv6.conf
|
|
insertafter: '^#?\s*vpn_ifs'
|
|
block: |
|
|
# - WireGuard Interfaces
|
|
# -
|
|
# - (blank separated list)
|
|
# -
|
|
wg_ifs="wg+"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (wg_ifs)"
|
|
when:
|
|
- interfaces_ipv6_exists.stat.exists
|
|
- wg_ifs_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# Allow local services from ALL extern netwoks
|
|
# ---
|
|
|
|
- name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv4) is present
|
|
shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: allow_all_ext_traffic_to_local_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 1"
|
|
changed_when: "allow_all_ext_traffic_to_local_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_all_ext_traffic_to_local_service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*any_access_from_inet_networks'
|
|
block: |
|
|
|
|
# =============
|
|
# - Allow local services from ALL extern netwoks
|
|
# =============
|
|
|
|
# - allow_all_ext_traffic_to_local_service
|
|
# -
|
|
# - allow_all_ext_traffic_to_local_service="local-address:port:protocol [local-address:port:protocol] .."
|
|
# -
|
|
# - Note:
|
|
# - =====
|
|
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
|
|
# -
|
|
# - Example:
|
|
# - allow extern traffic to service at 83.223.73.210 on port 1036
|
|
# - allow extern traffic to https service at 83.223.73.204
|
|
# -
|
|
# - allow_ext_net_to_local_service="
|
|
# - 83.223.73.210:1036:tcp
|
|
# - 83.223.73.204:$standard_https_port:tcp
|
|
# - "
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
allow_all_ext_traffic_to_local_service=""
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- allow_all_ext_traffic_to_local_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_all_ext_traffic_to_local_service..' (IPv6) is present
|
|
shell: grep -q -E "^allow_all_ext_traffic_to_local_service=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: allow_all_ext_traffic_to_local_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 1"
|
|
changed_when: "allow_all_ext_traffic_to_local_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (allow_all_ext_traffic_to_local_service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*any_access_from_inet_networks'
|
|
block: |
|
|
|
|
|
|
# =============
|
|
# - Allow local services from ALL extern netwoks
|
|
# =============
|
|
|
|
# - allow_all_ext_traffic_to_local_service
|
|
# -
|
|
# - allow_all_ext_traffic_to_local_service="local-address,port,protocol [local-address,port,protocol] .."
|
|
# -
|
|
# - Note:
|
|
# - =====
|
|
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
|
|
# -
|
|
# - Example:
|
|
# - allow extern traffic to service at 2a01:30:1fff:fd00::210 on port 1036
|
|
# - allow extern traffic to https service at 2a01:30:1fff:fd00::204
|
|
# -
|
|
# - allow_ext_net_to_local_service="
|
|
# - 2a01:30:1fff:fd00::210,1036,tcp
|
|
# - 2a01:30:1fff:fd00::204,$standard_https_port,tcp
|
|
# - "
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
allow_all_ext_traffic_to_local_service=""
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_all_ext_traffic_to_local_service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- allow_all_ext_traffic_to_local_service_ipv6_present is changed
|
|
|
|
|
|
|
|
# ---
|
|
# Allow extern services / networks
|
|
# ---
|
|
|
|
- name: Check if String 'allow_to_ext_service..' (IPv4) is present
|
|
shell: grep -q -E "^allow_to_ext_service=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: allow_to_ext_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "allow_to_ext_service_ipv4_present.rc > 1"
|
|
changed_when: "allow_to_ext_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_to_ext_service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*allow_local_net_to_ext_net'
|
|
block: |
|
|
|
|
# =============
|
|
# - Allow extern service
|
|
# =============
|
|
|
|
# - allow_to_ext_service
|
|
# -
|
|
# - allow_to_ext_service="<ext-ip:port:protocol> [ext-ip:port:protocol> [.."
|
|
# -
|
|
# - All traffic to the given (extern) service is allowed
|
|
# -
|
|
# - Example:
|
|
# - allow_to_ext_service="83.223.86.98:3306:tcp
|
|
# - 83.223.86.98:10194:udp"
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
allow_to_ext_service=""
|
|
|
|
|
|
|
|
# =============
|
|
# - Allow extern network
|
|
# =============
|
|
|
|
# - allow_to_ext_net
|
|
# -
|
|
# - Allow all traffic to given extern network
|
|
# -
|
|
# - allow_to_ext_net="<ext-net> [<ext-net> [.."
|
|
# -
|
|
# - All traffic to the given (extern) network is allowed
|
|
# -
|
|
# - Example:
|
|
# - allow_to_ext_net="83.223.86.98/32
|
|
# - 83.223.86.101/32
|
|
# - 192.68.11.81/27"
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
allow_to_ext_net=""
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_to_ext_service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- allow_to_ext_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_to_ext_service..' (IPv6) is present
|
|
shell: grep -q -E "^allow_to_ext_service=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: allow_to_ext_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "allow_to_ext_service_ipv6_present.rc > 1"
|
|
changed_when: "allow_to_ext_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (allow_to_ext_service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*allow_local_net_to_ext_net'
|
|
block: |
|
|
|
|
# =============
|
|
# - Allow extern service
|
|
# =============
|
|
|
|
# - allow_to_ext_service
|
|
# -
|
|
# - Allow all traffic to given extern service
|
|
# -
|
|
# - allow_to_ext_service="<ext-ip,port,protocol> [ext-ip,port,protocol> [.."
|
|
# -
|
|
# - All traffic to the given (extern) service is allowed
|
|
# -
|
|
# - Example:
|
|
# - allow_to_ext_service="2a01:30:0:13:211:84ff:feb7:7f9c,3306,tcp
|
|
# - 2a01:30:0:13:211:84ff:feb7:7f9c,10194,tcp"
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
allow_to_ext_service=""
|
|
|
|
|
|
|
|
# =============
|
|
# - Allow extern network
|
|
# =============
|
|
|
|
# - allow_to_ext_net
|
|
# -
|
|
# - Allow all traffic to given extern network
|
|
# -
|
|
# - allow_to_ext_net="<local-net,ext-net> [<local-net,ext-net> [.."
|
|
# -
|
|
# - All traffic from the given (local) network to the given (extern) network is allowed
|
|
# -
|
|
# - Example:
|
|
# - allow_to_ext_net="2a01:30:0:13:211:84ff:feb7:7f9c/64
|
|
# - 2001:678:a40:3000::/64"
|
|
# -
|
|
# - Blank separated list
|
|
# -
|
|
allow_to_ext_net=""
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_to_ext_service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- allow_to_ext_service_ipv6_present is changed
|
|
|
|
|
|
|
|
# ---
|
|
# Epson Network Scanner
|
|
# ---
|
|
|
|
- name: Check if String 'epson_scanner_ips..' (IPv4) is present
|
|
shell: grep -q -E "^epson_scanner_ips=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: epson_scanner_ips_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "epson_scanner_ips_ipv4_present.rc > 1"
|
|
changed_when: "epson_scanner_ips_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (epson_scanner)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*brscan_port'
|
|
block: |
|
|
# ======
|
|
# - Epson Network Scan
|
|
# ======
|
|
|
|
# - IP Adresses Epson Network Scanner
|
|
# -
|
|
# - Blank seoarated list
|
|
# -
|
|
epson_scanner_ips=""
|
|
epson_scan_port="$standard_epson_network_scan_port"
|
|
|
|
marker: "# Marker set by modify-ipt-gateway.yml (epson_scanner)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- epson_scanner_ips_ipv4_present is changed
|
|
|
|
- name: Check if String 'epson_scanner_ips..' (IPv6) is present
|
|
shell: grep -q -E "^epson_scanner_ips=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: epson_scanner_ips_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "epson_scanner_ips_ipv6_present.rc > 1"
|
|
changed_when: "epson_scanner_ips_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (epson_scanner)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*brscan_port'
|
|
block: |
|
|
# ======
|
|
# - Epson Network Scan
|
|
# ======
|
|
|
|
# - IP Adresses Epson Network Scanner
|
|
# -
|
|
# - Blank seoarated list
|
|
# -
|
|
epson_scanner_ips=""
|
|
epson_scan_port="$standard_epson_network_scan_port"
|
|
|
|
marker: "# Marker set by modify-ipt-gateway.yml (epson_scanner)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- epson_scanner_ips_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# Skype for Business Online und Microsoft Teams
|
|
# ---
|
|
|
|
- name: Check if String 'ms_skype_teams_tcp_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^ms_skype_teams_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: ms_skype_teams_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "ms_skype_teams_ipv4_present.rc > 1"
|
|
changed_when: "ms_skype_teams_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (ms teams service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*bigbluebutton_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Skype for Business Online und Microsoft Teams
|
|
# ======
|
|
|
|
# - Skype for Business Online und Microsoft Teams
|
|
# -
|
|
# - TCP 80,443
|
|
# -
|
|
# - UDP 3478,3479,3480,3481 --> 13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14
|
|
# -
|
|
# - Example:
|
|
# -
|
|
# - standard_ms_skype_teams_tcp_ports="80,443"
|
|
# - standard_ms_skype_teams_udp4_ports="3478,3479,3480,3481"
|
|
# - standard_ms_skype_teams_udp4_hosts="
|
|
# - 13.107.64.0/18
|
|
# - 52.112.0.0/14
|
|
# - 52.120.0.0/14
|
|
# - "
|
|
# -
|
|
# - Set to default values:
|
|
# - ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports"
|
|
# - ms_skype_teams_udp4_ports="$standard_ms_skype_teams_udp4_ports"
|
|
# - ms_skype_teams_udp4_hosts="$standard_ms_skype_teams_udp4_hosts"
|
|
# -
|
|
ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports"
|
|
ms_skype_teams_udp4_ports="$standard_ms_skype_teams_udp4_ports"
|
|
ms_skype_teams_udp4_hosts="$standard_ms_skype_teams_udp4_hosts"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (ms teams service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- ms_skype_teams_ipv4_present is changed
|
|
|
|
- name: Check if String 'ms_skype_teams_tcp_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^ms_skype_teams_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: ms_skype_teams_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "ms_skype_teams_ipv6_present.rc > 1"
|
|
changed_when: "ms_skype_teams_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (ms teams service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*bigbluebutton_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Skype for Business Online und Microsoft Teams
|
|
# ======
|
|
|
|
# - Skype for Business Online und Microsoft Teams
|
|
# -
|
|
# - TCP 80,443
|
|
# -
|
|
# - Example:
|
|
# -
|
|
# - standard_ms_skype_teams_tcp_ports="80,443"
|
|
# - standard_ms_skype_teams_udp6_ports="3478,3479,3480,3481"
|
|
# - standard_ms_skype_teams_udp6_hosts="
|
|
# - 2a01:30:0:13:5054:ff:fe9f:422f/64
|
|
# - 2a01:4f8:231:19a7::2/52
|
|
# - "
|
|
# -
|
|
# - Set to default values:
|
|
# - ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports"
|
|
# - ms_skype_teams_udp6_ports="$standard_ms_skype_teams_udp6_ports"
|
|
# - ms_skype_teams_udp6_hosts="$standard_ms_skype_teams_udp6_hosts"
|
|
# -
|
|
ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports"
|
|
ms_skype_teams_udp6_ports="$standard_ms_skype_teams_udp6_ports"
|
|
ms_skype_teams_udp6_hosts="$standard_ms_skype_teams_udp6_hosts"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (ms teams service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- ms_skype_teams_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# jitsi video conference service
|
|
# ---
|
|
|
|
- name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: jitsi_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "jitsi_service_ipv4_present.rc > 1"
|
|
changed_when: "jitsi_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Jitsi Video Conference Service
|
|
# ======
|
|
|
|
# - Jitsi Video Conference Service Gateway
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_jitsi_video_conference_service=false
|
|
|
|
# - Jitsi Video Conference Service Ports
|
|
# -
|
|
# - TCP 80: Webinterface.
|
|
# - TCP 443: Webinterface (SSL)
|
|
# -
|
|
# - UDP 10000-20000: Virtual Media for Remote Console
|
|
# -
|
|
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
|
|
jitsi_udp_ports="$standard_jitsi_udp_port_range"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- jitsi_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: jitsi_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "jitsi_service_ipv6_present.rc > 1"
|
|
changed_when: "jitsi_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Jitsi Video Conference Service
|
|
# ======
|
|
|
|
# - Jitsi Video Conference Service Gateway
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_jitsi_video_conference_service=false
|
|
|
|
# - Jitsi Video Conference Service Ports
|
|
# -
|
|
# - TCP 80: Webinterface.
|
|
# - TCP 443: Webinterface (SSL)
|
|
# -
|
|
# - UDP 10000-20000: Virtual Media for Remote Console
|
|
# -
|
|
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
|
|
jitsi_udp_ports="$standard_jitsi_udp_port_range"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- jitsi_service_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# webex video conference service
|
|
# ---
|
|
|
|
- name: Check if String 'webex_tcp_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^webex_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: webex_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "webex_service_ipv4_present.rc > 1"
|
|
changed_when: "webex_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (webex service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*bigbluebutton_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Webex Meeting
|
|
# ======
|
|
|
|
# - Webex Meeting (Videokonferenz)
|
|
# -
|
|
# - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming)
|
|
# -
|
|
# - UDP 9000: Outbound (VoIP and RTP)
|
|
# -
|
|
# - ---
|
|
# -
|
|
# - TCP 5004: Fall-back ports for media connectivity when UDP port 9000
|
|
# - is not open in the firewall
|
|
# -
|
|
webex_tcp_ports="$standard_webex_tcp_ports"
|
|
webex_udp_ports="$standard_webex_udp_ports"
|
|
|
|
webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (webex service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- webex_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'webex_tcp_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^webex_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: webex_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "webex_service_ipv6_present.rc > 1"
|
|
changed_when: "webex_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (webex service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*bigbluebutton_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Webex Meeting
|
|
# ======
|
|
|
|
# - Webex Meeting (Videokonferenz)
|
|
# -
|
|
# - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming)
|
|
# -
|
|
# - UDP 9000: Outbound (VoIP and RTP)
|
|
# -
|
|
# - ---
|
|
# -
|
|
# - TCP 5004: Fall-back ports for media connectivity when UDP port 9000
|
|
# - is not open in the firewall
|
|
# -
|
|
webex_tcp_ports="$standard_webex_tcp_ports"
|
|
webex_udp_ports="$standard_webex_udp_ports"
|
|
|
|
webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (webex service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- webex_service_ipv6_present is changed
|
|
|
|
|
|
|
|
# ---
|
|
# alfaview video conference service
|
|
# ---
|
|
|
|
- name: Check if String 'alfaview_tcp_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^alfaview_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: alfaview_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "alfaview_service_ipv4_present.rc > 1"
|
|
changed_when: "alfaview_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (alfaview service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - alfaview - Video Conferencing Systems
|
|
# ======
|
|
|
|
# - alfaview Service Ports
|
|
# -
|
|
alfaview_tcp_ports="$standard_alfaview_service_tcp_ports"
|
|
alfaview_udp_ports="$standard_alfaview_service_udp_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (alfaview service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- alfaview_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'alfaview_tcp_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^alfaview_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: alfaview_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "alfaview_service_ipv6_present.rc > 1"
|
|
changed_when: "alfaview_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (alfaview service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - alfaview - Video Conferencing Systems
|
|
# ======
|
|
|
|
# - alfaview Service Ports
|
|
# -
|
|
alfaview_tcp_ports="$standard_alfaview_service_tcp_ports"
|
|
alfaview_udp_ports="$standard_alfaview_service_udp_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (alfaview service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- alfaview_service_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# ---
|
|
|
|
- name: Check if String 'nc_turn_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: nc_turn_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "nc_turn_service_ipv4_present.rc > 1"
|
|
changed_when: "nc_turn_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (nc's turn service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*jitsi_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# ======
|
|
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_nc_turn_service=""
|
|
|
|
# - Ports used by local TURN Server (Stun Server)
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
nc_turn_ports="$standard_turn_service_ports"
|
|
nc_turn_udp_ports="$standard_turn_service_udp_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- nc_turn_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'nc_turn_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: nc_turn_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "nc_turn_service_ipv6_present.rc > 1"
|
|
changed_when: "nc_turn_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*jitsi_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# ======
|
|
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_nc_turn_service=""
|
|
|
|
# - Ports used by local TURN Server (Stun Server)
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
nc_turn_ports="$standard_turn_service_ports"
|
|
nc_turn_udp_ports="$standard_turn_service_udp_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- nc_turn_service_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# Allow Outbound Streamin / Echo360 Video Streaming
|
|
# ---
|
|
|
|
- name: Check if String 'allow_outbound_streaming..' (IPv4) is present
|
|
shell: grep -q -E "^allow_outbound_streaming=" /ro/etc/ipt-firewall/main_ipv4.conf
|
|
register: allow_outbound_streaming_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "allow_outbound_streaming_ipv4_present.rc > 1"
|
|
changed_when: "allow_outbound_streaming_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (allow_outbound_streaming)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
block: |
|
|
allow_outbound_streaming=true
|
|
allow_echo360_video_streaming=true
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_outbound_streaming)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- allow_outbound_streaming_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_outbound_streaming..' (IPv6) is present
|
|
shell: grep -q -E "^allow_outbound_streaming=" /ro/etc/ipt-firewall/main_ipv6.conf
|
|
register: allow_outbound_streaming_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "allow_outbound_streaming_ipv6_present.rc > 1"
|
|
changed_when: "allow_outbound_streaming_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (allow_outbound_streaming)
|
|
blockinfile:
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
block: |
|
|
allow_outbound_streaming=true
|
|
allow_echo360_video_streaming=true
|
|
marker: "# Marker set by modify-ipt-gateway.yml (allow_outbound_streaming)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- allow_outbound_streaming_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# Remove Marker set by blockinfile
|
|
# ---
|
|
|
|
- name: Remove marker IPv4 (main_ipv4.conf)
|
|
replace :
|
|
path: /ro/etc/ipt-firewall/main_ipv4.conf
|
|
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv4_removed
|
|
#failed_when: "marker_ipv4_removed.rc > 1"
|
|
#changed_when: "marker_ipv4_removed.rc < 1"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
|
|
- name: Remove marker IPv6 (main_ipv6.conf)
|
|
replace :
|
|
path: /ro/etc/ipt-firewall/main_ipv6.conf
|
|
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv6_removed
|
|
#failed_when: "marker_ipv6_removed.rc > 1"
|
|
#changed_when: "marker_ipv6_removed.rc < 1"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
|
|
- name: Remove marker IPv4 (interfaces_ipv4.conf)
|
|
replace :
|
|
path: /ro/etc/ipt-firewall/interfaces_ipv4.conf
|
|
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv4_removed
|
|
#failed_when: "marker_ipv4_removed.rc > 1"
|
|
#changed_when: "marker_ipv4_removed.rc < 1"
|
|
when:
|
|
- interfaces_ipv4_exists.stat.exists
|
|
|
|
- name: Remove marker IPv6 (interfaces_ipv6.conf)
|
|
replace :
|
|
path: /ro/etc/ipt-firewall/interfaces_ipv6.conf
|
|
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv6_removed
|
|
#failed_when: "marker_ipv6_removed.rc > 1"
|
|
#changed_when: "marker_ipv6_removed.rc < 1"
|
|
when:
|
|
- interfaces_ipv6_exists.stat.exists
|
|
|
|
# ---
|
|
# Confiuration Files
|
|
# ---
|
|
|
|
- name: Check if configuration files are latest
|
|
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
|
|
changed_when: "diff_script_output.rc > 0"
|
|
# diff_output.rc
|
|
# 0 -> unchanged
|
|
# 1 -> changed
|
|
# 2 -> not present
|
|
failed_when: "diff_script_output.rc > 2"
|
|
when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
|
|
loop:
|
|
- default_ports.conf
|
|
- default_ipv4.conf
|
|
- default_ipv6.conf
|
|
- default_basic_behavior.conf
|
|
- include_functions.conf
|
|
- load_modules_ipv4.conf
|
|
- load_modules_ipv6.conf
|
|
- logging_ipv4.conf
|
|
- logging_ipv6.conf
|
|
- post_decalrations.conf
|
|
register: diff_script_output
|
|
|
|
- name: Ensure configuration files are latest
|
|
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }}
|
|
loop:
|
|
- default_ports.conf
|
|
- default_ipv4.conf
|
|
- default_ipv6.conf
|
|
- default_basic_behavior.conf
|
|
- include_functions.conf
|
|
- load_modules_ipv4.conf
|
|
- load_modules_ipv6.conf
|
|
- logging_ipv4.conf
|
|
- logging_ipv6.conf
|
|
- post_decalrations.conf
|
|
when:
|
|
- (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
|
|
- diff_script_output.changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
- Restart IPv6 Firewall
|
|
|
|
# ---
|
|
# Firewall scripts
|
|
# ---
|
|
|
|
- name: Check if firewall scripts are latest
|
|
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }} > /dev/null 2>&1'
|
|
changed_when: "diff_script_output.rc > 0"
|
|
# diff_output.rc
|
|
# 0 -> unchanged
|
|
# 1 -> changed
|
|
# 2 -> not present
|
|
failed_when: "diff_script_output.rc > 2"
|
|
when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
|
|
loop:
|
|
- ipt-firewall-gateway
|
|
- ip6t-firewall-gateway
|
|
register: diff_script_output
|
|
|
|
- name: Ensure firewall scripts are latest
|
|
command: cp {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }}
|
|
loop:
|
|
- ipt-firewall-gateway
|
|
- ip6t-firewall-gateway
|
|
when:
|
|
- (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
|
|
- diff_script_output.changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
- Restart IPv6 Firewall
|
|
|
|
# ---
|
|
# Remount Filesystem readonly
|
|
# ---
|
|
|
|
- name: Remount "/ro/" readonly
|
|
shell: remountro
|
|
register: remountro_cmd
|
|
failed_when: remountro_cmd.rc != 0 and remountro_cmd.rc != 32
|