72 lines
2.3 KiB
YAML
72 lines
2.3 KiB
YAML
- name: Getting public IP addresses
|
|
block:
|
|
- name: Getting public IPv4 address
|
|
community.general.ipify_facts:
|
|
validate_certs: false
|
|
timeout: 20
|
|
- name: Getting public IPv6 address
|
|
when: ipv6_enabled
|
|
ansible.builtin.shell:
|
|
cmd: curl -6 icanhazip.com
|
|
register: ipify_public_ip6
|
|
- name: Getting available network interfaces
|
|
ansible.builtin.shell:
|
|
cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
|
|
register: intrfaces
|
|
- name: Turning acquired network interfaces into list
|
|
ansible.builtin.set_fact:
|
|
main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
|
|
- name: Enabling UFW startup
|
|
become: true
|
|
ansible.builtin.systemd_service:
|
|
name: ufw
|
|
scope: system
|
|
state: started
|
|
enabled: true
|
|
- name: Enabling firewall startup
|
|
community.general.ufw:
|
|
state: enabled
|
|
- name: Pre-emptively establishing firewall rules for loopback interface
|
|
become: true
|
|
block:
|
|
- name: Pre-emptively allowing inbound connections on loopback interface
|
|
community.general.ufw:
|
|
rule: allow
|
|
direction: in
|
|
interface: lo
|
|
- name: Allowing outbound connections on loopback interface
|
|
community.general.ufw:
|
|
rule: allow
|
|
direction: out
|
|
interface: lo
|
|
- name: Denying inbound connections from loopback address on rest of interfaces
|
|
community.general.ufw:
|
|
rule: deny
|
|
direction: in
|
|
interface: "{{ item[1] }}"
|
|
from_ip: "{{ item[0] }}"
|
|
loop: "{{ ['127.0.0.0/8', '::/128'] | product(main_interfaces) }}"
|
|
- name: Pre-emptively allowing rate-limited inbound SSH
|
|
become: true
|
|
community.general.ufw:
|
|
rule: allow
|
|
name: ssh
|
|
- name: Crafting additional exceptions to the inbound default policy
|
|
become: true
|
|
community.general.ufw:
|
|
rule: allow
|
|
direction: in
|
|
proto: "{{ item[1].protocol | default('tcp') }}"
|
|
interface: "{{ item[1].interface | default(item[0]) }}"
|
|
port: "{{ item[1].port }}"
|
|
loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
|
|
- name: Setting default policy for inbound connections
|
|
become: true
|
|
community.general.ufw:
|
|
direction: incoming
|
|
default: deny
|
|
- name: Setting default policy for outbound connections
|
|
become: true
|
|
community.general.ufw:
|
|
direction: outgoing
|
|
default: allow |