new major update

roles/init-server/tasks/contingent/pkg/iptables.yml

@@ -0,0 +1,101 @@
+- name: Getting public IP addresses
+  block:
+    - name: Getting public IPv4 address
+      community.general.ipify_facts:
+        validate_certs: false
+        timeout: 20
+    - name: Getting public IPv6 address
+      when: ipv6_enabled
+      ansible.builtin.shell:
+        cmd: curl -6 icanhazip.com
+      register: ipify_public_ip6
+- name: Getting available network interfaces
+  ansible.builtin.shell:
+    cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
+  register: intrfaces
+- name: Turning acquired network interfaces into list
+  ansible.builtin.set_fact:
+    main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
+- name: Pre-emptively allowing inbound connections already established and related to outbound requests
+  ansible.builtin.iptables:
+    ip_version: both
+    chain: INPUT
+    match:
+      - conntrack
+    ctstate:
+      - ESTABLISHED
+      - RELATED
+    jump: ACCEPT
+    comment: allowing inbound replies
+- name: Pre-emptively establishing fiirewall rules for inbound ICMP requests
+  become: true
+  block:
+    - name: Pre-emptively allowing inbound IPv4 ICMP connections
+      ansible.builtin.iptables:
+        ip_version: ipv4
+        chain: INPUT
+        destination: "! {{ ipify_public_ip }}"
+        protocol: icmp
+        jump: ACCEPT
+        comment: ping
+    - name: Pre-emptively allowing inbound IPv6 ICMP connections
+      when: ipv6_enabled
+      ansible.builtin.iptables:
+        ip_version: ipv6
+        chain: INPUT
+        destination: "! {{ ipify_public_ip6.stdout }}"
+        protocol: icmp
+        jump: ACCEPT
+        comment: ping
+- name: Pre-emptively establishing firewall rules for loopback interface
+  become: true
+  block:
+    - name: Pre-emptively allowing all inbound connections on loopback device
+      ansible.builtin.iptables:
+        ip_version: both
+        chain: INPUT
+        in_interface: lo
+        jump: ACCEPT
+        comment: loopback
+- name: Pre-emptively allowing inbound SSH
+  become: true
+  ansible.builtin.iptables:
+    ip_version: both
+    chain: INPUT
+    protocol: tcp
+    destination_port: 22
+    in_interface: "{{ item }}"
+    jump: ACCEPT
+    comment: ssh
+  loop: "{{ main_interfaces }}"
+- name: Crafting additional exceptions to the inbound default policy
+  become: true
+  when: iptables.allow.inbound is defined and iptables.allow.inbound != None 
+  ansible.builtin.iptables:
+    ip_version: both
+    chain: INPUT
+    protocol: "{{ item[1].protocol | default('tcp') }}"
+    destination_port: "{{ item[1].port }}"
+    in_interface: "{{ item[1].interface | default(item[0]) }}"
+    jump: ACCEPT
+    comment: "{{ item[1].desc | default('srvr') }}"
+  loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
+- name: Setting default policy for inbound connections
+  become: true
+  ansible.builtin.iptables:
+    chain: INPUT
+    policy: DROP
+- name: Setting default policy for outbound connections
+  become: true
+  ansible.builtin.iptables:
+    chain: OUTPUT
+    policy: ACCEPT
+- name: Backing up firewall rules
+  become: true
+  community.general.iptables_state:
+    ip_version: "{{ item[0] }}"
+    state: saved
+    path: /etc/iptables/initial_rules.{{ item[1] }}
+  loop:
+    - ["ipv4", "v4"]
+    - ["ipv6", "v6"]