524 lines
16 KiB
YAML
524 lines
16 KiB
YAML
---
|
|
|
|
# ===
|
|
# Install/Uodate git firewall repository
|
|
# ===
|
|
|
|
#- meta: end_play
|
|
# when:
|
|
# - inventory_hostname in groups['gateway_server'] or inventory_hostname in groups['no_ipt_firewall'] or git_firewall_repository is not defined or git_firewall_repository|length < 1
|
|
|
|
|
|
- name: Install/update firewall repository
|
|
git:
|
|
repo: '{{ git_firewall_repository.repo }}'
|
|
dest: '{{ git_firewall_repository.dest }}'
|
|
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
|
|
|
|
# ===
|
|
# Some Checks
|
|
# ===
|
|
|
|
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
register: main_ipv6_exists
|
|
|
|
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
register: main_ipv4_exists
|
|
|
|
- name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
register: interfaces_ipv6_exists
|
|
|
|
- name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
register: interfaces_ipv4_exists
|
|
|
|
- name: Check if file '/etc/munin/munin-node.conf' exists
|
|
stat:
|
|
path: /etc/munin/munin-node.conf
|
|
register: munin_node_exists
|
|
|
|
|
|
# ===
|
|
# Adjust/Correct some values..
|
|
# ===
|
|
|
|
- name: addjust line 'munin_remote_ip' (IPv4)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
regexp: '^munin_remote_ip='
|
|
line: 'munin_remote_ip="{{ munin_remote_ipv4 }}"'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: addjust line 'munin_remote_ip' (IPv6)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
regexp: '^munin_remote_ip='
|
|
line: 'munin_remote_ip="{{ munin_remote_ipv6 }}"'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
- name: addjust line 'vpn_ifs' (IPv4)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
regexp: '^vpn_ifs='
|
|
line: 'vpn_ifs="tun+"'
|
|
when:
|
|
- interfaces_ipv4_exists.stat.exists
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: addjust line 'vpn_ifs' (IPv6)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
regexp: '^vpn_ifs='
|
|
line: 'vpn_ifs="tun+"'
|
|
when:
|
|
- interfaces_ipv6_exists.stat.exists
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
# ===
|
|
# Add some Code Block.
|
|
# ===
|
|
|
|
# ---
|
|
# Wireguard Service
|
|
# ---
|
|
|
|
- name: Check if String 'wg_ifs=..' is present in interfaces_ipv4.conf
|
|
shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv4.conf
|
|
register: wg_ifs_interfaces_ipv4_present
|
|
when: interfaces_ipv4_exists.stat.exists
|
|
failed_when: "wg_ifs_interfaces_ipv4_present.rc > 1"
|
|
changed_when: "wg_ifs_interfaces_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (wg_ifs)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
insertafter: '^#?\s*vpn_ifs'
|
|
block: |
|
|
|
|
# - Wireguard Interfaces
|
|
# - (comma separated list 'wg+' is also possible)
|
|
wg_ifs="wg+"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (wg_ifs)"
|
|
when:
|
|
- interfaces_ipv4_exists.stat.exists
|
|
- wg_ifs_interfaces_ipv4_present is changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
|
|
- name: Check if String 'wg_ifs=..' is present in interfaces_ipv6.conf
|
|
shell: grep -q -E "^wg_ifs=" /etc/ipt-firewall/interfaces_ipv6.conf
|
|
register: wg_ifs_interfaces_ipv6_present
|
|
when: interfaces_ipv6_exists.stat.exists
|
|
failed_when: "wg_ifs_interfaces_ipv6_present.rc > 1"
|
|
changed_when: "wg_ifs_interfaces_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (wg_ifs)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
insertafter: '^#?\s*vpn_ifs'
|
|
block: |
|
|
|
|
# - Wireguard Interfaces
|
|
# - (comma separated list 'wg+' is also possible)
|
|
wg_ifs="wg+"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (wg_ifs)"
|
|
when:
|
|
- interfaces_ipv6_exists.stat.exists
|
|
- wg_ifs_interfaces_ipv6_present is changed
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
|
|
- name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv4.conf
|
|
shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv4.conf
|
|
register: lxc_guest_ips_interfaces_ipv4_present
|
|
when: interfaces_ipv4_exists.stat.exists
|
|
failed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 1"
|
|
changed_when: "lxc_guest_ips_interfaces_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv4.conf' (lxc_guest_ips)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
insertafter: '^#?\s*local_3_ip'
|
|
block: |
|
|
local_ips="$local_1_ip $local_2_ip $local_3_ip"
|
|
|
|
|
|
# -------------
|
|
# --- IP-Addresses LXC Guest sSystems
|
|
# -------------
|
|
|
|
# for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done
|
|
|
|
# NOT IN USE
|
|
lxc_guest_1_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_2_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_3_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_4_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_5_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_6_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_7_ip=""
|
|
|
|
lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)"
|
|
when:
|
|
- interfaces_ipv4_exists.stat.exists
|
|
- lxc_guest_ips_interfaces_ipv4_present is changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
|
|
- name: Check if String 'lxc_guest_ips=..' is present in interfaces_ipv6.conf
|
|
shell: grep -q -E "^lxc_guest_ips=" /etc/ipt-firewall/interfaces_ipv6.conf
|
|
register: lxc_guest_ips_interfaces_ipv6_present
|
|
when: interfaces_ipv6_exists.stat.exists
|
|
failed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 1"
|
|
changed_when: "lxc_guest_ips_interfaces_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/interfaces_ipv6.conf' (lxc_guest_ips)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
insertafter: '^#?\s*local_3_ip'
|
|
block: |
|
|
local_ips="$local_1_ip $local_2_ip $local_3_ip"
|
|
|
|
|
|
# -------------
|
|
# --- IP-Addresses LXC Guest sSystems
|
|
# -------------
|
|
|
|
# for _guest in $(lxc-ls) ; do echo ; lxc-info -n $_guest | grep -E "(IP:|Name:)" ; done
|
|
|
|
# NOT IN USE
|
|
lxc_guest_1_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_2_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_3_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_4_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_5_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_6_ip=""
|
|
# NOT IN USE
|
|
lxc_guest_7_ip=""
|
|
|
|
lxc_guest_ips="$lxc_guest_1_ip $lxc_guest_2_ip $lxc_guest_3_ip $lxc_guest_4_ip $lxc_guest_5_ip $lxc_guest_6_ip $lxc_guest_7_ip"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (lxc_guest_ips)"
|
|
when:
|
|
- interfaces_ipv6_exists.stat.exists
|
|
- lxc_guest_ips_interfaces_ipv6_present is changed
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
- name: Check if String 'do_not_firewall_lx_guest_systems=..' is present
|
|
shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: wireguard_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "wireguard_service_ipv4_present.rc > 1"
|
|
changed_when: "wireguard_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (do_not_firewall_lx_guest_systems)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*do_not_firewall_bridged_traffic'
|
|
block: |
|
|
|
|
# -------------
|
|
# --- Do not firewall traffic from and to LX Gust Systems
|
|
# -------------
|
|
|
|
# - Traffic to hosted LX containers are not firewalled here.
|
|
# -
|
|
do_not_firewall_lx_guest_systems=false
|
|
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- wireguard_service_ipv4_present is changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
|
|
- name: Check if String 'do_not_firewall_lx_guest_systems=..' is present
|
|
shell: grep -q -E "^do_not_firewall_lx_guest_systems=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: wireguard_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "wireguard_service_ipv6_present.rc > 1"
|
|
changed_when: "wireguard_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (do_not_firewall_lx_guest_systems)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*do_not_firewall_bridged_traffic'
|
|
block: |
|
|
|
|
# -------------
|
|
# --- Do not firewall traffic from and to LX Gust Systems
|
|
# -------------
|
|
|
|
# - Traffic to hosted LX containers are not firewalled here.
|
|
# -
|
|
do_not_firewall_lx_guest_systems=false
|
|
marker: "# Marker set by modify-ipt-server.yml (wireguard_service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- wireguard_service_ipv6_present is changed
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
# ---
|
|
# Mattermost (MM) Service (add a block)
|
|
# ---
|
|
|
|
- name: Check if String 'mm_server_ips=..' is present
|
|
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: mattermost_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "mattermost_service_ipv4_present.rc > 1"
|
|
changed_when: "mattermost_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mattermost_service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*http_ports'
|
|
block: |
|
|
|
|
# - Mattermost (MM) Service
|
|
# -
|
|
mm_server_ips=""
|
|
forward_mm_server_ips=""
|
|
|
|
# - UDP Ports IN and OUT used by MM Servive
|
|
# -
|
|
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
|
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- mattermost_service_ipv4_present is changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
|
|
- name: Check if String 'mm_server_ips=..' is present
|
|
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: mattermost_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "mattermost_service_ipv6_present.rc > 1"
|
|
changed_when: "mattermost_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mattermost_service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*http_ports'
|
|
block: |
|
|
|
|
# - Mattermost (MM) Service
|
|
# -
|
|
mm_server_ips=""
|
|
forward_mm_server_ips=""
|
|
|
|
# - UDP Ports IN and OUT used by MM Servive
|
|
# -
|
|
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
|
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- mattermost_service_ipv6_present is changed
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
|
|
# ---
|
|
# Per IP Connection Limit (add a line)
|
|
# ---
|
|
|
|
- name: Check if String 'per_IP_connection_limit=..' is present
|
|
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: per_ip_connection_limit_settings_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 1"
|
|
changed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*limit_connections_per_source_IP'
|
|
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- per_ip_connection_limit_settings_ipv4_present is changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
|
|
- name: Check if String 'per_IP_connection_limit=..' is present
|
|
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: per_ip_connection_limit_settings_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 1"
|
|
changed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
|
|
lineinfile:
|
|
dest: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*limit_connections_per_source_IP'
|
|
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- per_ip_connection_limit_settings_ipv6_present is changed
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
# ===
|
|
# Remove Marker set by blockinfile
|
|
# ===
|
|
|
|
- name: Remove marker IPv4
|
|
replace :
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv4_removed
|
|
#failed_when: "marker_ipv4_removed.rc > 1"
|
|
#changed_when: "marker_ipv4_removed.rc < 1"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
|
|
- name: Remove marker IPv6
|
|
replace :
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv6_removed
|
|
#failed_when: "marker_ipv6_removed.rc > 1"
|
|
#changed_when: "marker_ipv6_removed.rc < 1"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
|
|
- name: Remove marker IPv4 from interfaces_ipv4.conf
|
|
replace :
|
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
replace: ""
|
|
when:
|
|
- interfaces_ipv4_exists.stat.exists
|
|
|
|
- name: Remove marker IPv6 from interfaces_ipv6.conf
|
|
replace :
|
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
replace: ""
|
|
when:
|
|
- interfaces_ipv6_exists.stat.exists
|
|
|
|
# ===
|
|
# Confiuration Files
|
|
# ===
|
|
|
|
- name: Check if configuration files are latest
|
|
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
|
|
changed_when: "diff_script_output.rc > 0"
|
|
# diff_output.rc
|
|
# 0 -> unchanged
|
|
# 1 -> changed
|
|
# 2 -> not present
|
|
failed_when: "diff_script_output.rc > 2"
|
|
when:
|
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
loop:
|
|
- default_settings.conf
|
|
- include_functions.conf
|
|
- load_modules_ipv4.conf
|
|
- load_modules_ipv6.conf
|
|
- logging_ipv4.conf
|
|
- logging_ipv6.conf
|
|
- post_decalrations.conf
|
|
register: diff_script_output
|
|
|
|
- name: Ensure configuration files are latest
|
|
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
|
|
loop:
|
|
- default_settings.conf
|
|
- include_functions.conf
|
|
- load_modules_ipv4.conf
|
|
- load_modules_ipv6.conf
|
|
- logging_ipv4.conf
|
|
- logging_ipv6.conf
|
|
- post_decalrations.conf
|
|
when:
|
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
- diff_script_output.changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
- Restart IPv6 Firewall
|
|
|
|
# ===
|
|
# Firewall scripts
|
|
# ===
|
|
|
|
- name: Check if firewall scripts are latest
|
|
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
|
|
changed_when: "diff_script_output.rc > 0"
|
|
# diff_output.rc
|
|
# 0 -> unchanged
|
|
# 1 -> changed
|
|
# 2 -> not present
|
|
failed_when: "diff_script_output.rc > 2"
|
|
when:
|
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
loop:
|
|
- ipt-firewall-server
|
|
- ip6t-firewall-server
|
|
register: diff_script_output
|
|
|
|
- name: Ensure firewall scripts are latest
|
|
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
|
|
loop:
|
|
- ipt-firewall-server
|
|
- ip6t-firewall-server
|
|
when:
|
|
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
- diff_script_output.changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
- Restart IPv6 Firewall
|
|
|