- name: Getting public IP addresses
  block:
    - name: Getting public IPv4 address
      community.general.ipify_facts:
        validate_certs: false
        timeout: 20
    - name: Getting public IPv6 address
      when: ipv6_enabled
      ansible.builtin.shell:
        cmd: curl -6 icanhazip.com
      register: ipify_public_ip6
- name: Getting available network interfaces
  ansible.builtin.shell:
    cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
  register: intrfaces
- name: Turning acquired network interfaces into list
  ansible.builtin.set_fact:
    main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
- name: Pre-emptively allowing inbound connections already established and related to outbound requests
  ansible.builtin.iptables:
    ip_version: both
    chain: INPUT
    match:
      - conntrack
    ctstate:
      - ESTABLISHED
      - RELATED
    jump: ACCEPT
    comment: allowing inbound replies
- name: Pre-emptively establishing fiirewall rules for inbound ICMP requests
  become: true
  block:
    - name: Pre-emptively allowing inbound IPv4 ICMP connections
      ansible.builtin.iptables:
        ip_version: ipv4
        chain: INPUT
        destination: "! {{ ipify_public_ip }}"
        protocol: icmp
        jump: ACCEPT
        comment: ping
    - name: Pre-emptively allowing inbound IPv6 ICMP connections
      when: ipv6_enabled
      ansible.builtin.iptables:
        ip_version: ipv6
        chain: INPUT
        destination: "! {{ ipify_public_ip6.stdout }}"
        protocol: icmp
        jump: ACCEPT
        comment: ping
- name: Pre-emptively establishing firewall rules for loopback interface
  become: true
  block:
    - name: Pre-emptively allowing all inbound connections on loopback device
      ansible.builtin.iptables:
        ip_version: both
        chain: INPUT
        in_interface: lo
        jump: ACCEPT
        comment: loopback
- name: Pre-emptively allowing inbound SSH
  become: true
  ansible.builtin.iptables:
    ip_version: both
    chain: INPUT
    protocol: tcp
    destination_port: 22
    in_interface: "{{ item }}"
    jump: ACCEPT
    comment: ssh
  loop: "{{ main_interfaces }}"
- name: Crafting additional exceptions to the inbound default policy
  become: true
  when: iptables.allow.inbound is defined and iptables.allow.inbound != None 
  ansible.builtin.iptables:
    ip_version: both
    chain: INPUT
    protocol: "{{ item[1].protocol | default('tcp') }}"
    destination_port: "{{ item[1].port }}"
    in_interface: "{{ item[1].interface | default(item[0]) }}"
    jump: ACCEPT
    comment: "{{ item[1].desc | default('srvr') }}"
  loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
- name: Setting default policy for inbound connections
  become: true
  ansible.builtin.iptables:
    chain: INPUT
    policy: DROP
- name: Setting default policy for outbound connections
  become: true
  ansible.builtin.iptables:
    chain: OUTPUT
    policy: ACCEPT
- name: Backing up firewall rules
  become: true
  community.general.iptables_state:
    ip_version: "{{ item[0] }}"
    state: saved
    path: /etc/iptables/initial_rules.{{ item[1] }}
  loop:
    - ["ipv4", "v4"]
    - ["ipv6", "v6"]