109 lines
2.6 KiB
Plaintext
109 lines
2.6 KiB
Plaintext
Start firewalld:
|
|
service.running:
|
|
- name: firewalld
|
|
- enable: True
|
|
|
|
Configure wireguard service:
|
|
firewalld.service:
|
|
- name: wireguard
|
|
- ports:
|
|
- {{ pillar['wireguard']['port'] }}/udp
|
|
|
|
Configure container registry service:
|
|
firewalld.service:
|
|
- name: registry
|
|
- ports:
|
|
- 5000/tcp
|
|
|
|
Configure firewalld for external interface:
|
|
firewalld.present:
|
|
- name: external
|
|
- masquerade: True
|
|
- prune_ports: True
|
|
- prune_services: True
|
|
- prune_interfaces: True
|
|
- prune_sources: True
|
|
- interfaces:
|
|
- {{ pillar['network']['external'] }}
|
|
- services:
|
|
- ssh
|
|
- wireguard
|
|
|
|
Configure firewalld for public networks:
|
|
firewalld.present:
|
|
- name: public
|
|
- prune_ports: True
|
|
- prune_services: True
|
|
- prune_interfaces: True
|
|
- prune_sources: True
|
|
- interfaces:
|
|
- {{ pillar['network']['interface'] }}
|
|
- {{ pillar['wireguard']['iface'] }}
|
|
- {{ pillar['network']['wireless'] }}
|
|
- {{ pillar['network']['bridge'] }}
|
|
{% for vlan in pillar['network']['vlan'] -%}
|
|
{% if vlan['zone'] == 'public' -%}
|
|
- vlan.{{ vlan['id'] }}
|
|
{% endif -%}
|
|
{% endfor %}
|
|
- sources:
|
|
- {{ pillar['network']['ip'][0:-1] }}0/24
|
|
{% for vlan in pillar['network']['vlan'] -%}
|
|
{% set ip = vlan['address'] -%}
|
|
{% if vlan['zone'] == 'public' -%}
|
|
- {{ ip[0:-1] }}0/24
|
|
{% endif -%}
|
|
{% endfor %}
|
|
- services:
|
|
- ssh
|
|
- dhcp
|
|
- tftp
|
|
- http
|
|
- https
|
|
- dns
|
|
- ntp
|
|
- registry
|
|
- nfs
|
|
- nfs3
|
|
|
|
Configure firewalld for airgap networks:
|
|
firewalld.present:
|
|
- name: airgap
|
|
- prune_ports: True
|
|
- prune_services: True
|
|
- prune_interfaces: True
|
|
- prune_sources: True
|
|
- interfaces:
|
|
{% for vlan in pillar['network']['vlan'] -%}
|
|
{% if vlan['zone'] == 'airgap' -%}
|
|
- vlan.{{ vlan['id'] }}
|
|
{% endif -%}
|
|
{% endfor %}
|
|
- sources:
|
|
{% for vlan in pillar['network']['vlan'] -%}
|
|
{% set ip = vlan['address'] -%}
|
|
{% if vlan['zone'] == 'airgap' -%}
|
|
- {{ ip[0:-1] }}0/24
|
|
{% endif -%}
|
|
{% endfor %}
|
|
- services:
|
|
- ssh
|
|
- dhcp
|
|
- tftp
|
|
- http
|
|
- https
|
|
- dns
|
|
- ntp
|
|
- registry
|
|
|
|
Add forwarding on Internal zone:
|
|
cmd.run:
|
|
- name: firewall-cmd --permanent --zone=public --add-forward
|
|
- unless: bash -c "if [[ \"$(firewall-cmd --zone=public --list-all | sed -n 's/.* forward. \(.*\)$/\1/p')\" = \"yes\" ]]; then exit 0; else exit 1;fi"
|
|
|
|
Reload firewalld:
|
|
cmd.run:
|
|
- name: firewall-cmd --reload
|
|
- onchanges:
|
|
- cmd: Add forwarding on Internal zone
|