102 lines
3.2 KiB
YAML
102 lines
3.2 KiB
YAML
- name: Getting public IP addresses
|
|
block:
|
|
- name: Getting public IPv4 address
|
|
community.general.ipify_facts:
|
|
validate_certs: false
|
|
timeout: 20
|
|
- name: Getting public IPv6 address
|
|
when: ipv6_enabled
|
|
ansible.builtin.shell:
|
|
cmd: curl -6 icanhazip.com
|
|
register: ipify_public_ip6
|
|
- name: Getting available network interfaces
|
|
ansible.builtin.shell:
|
|
cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
|
|
register: intrfaces
|
|
- name: Turning acquired network interfaces into list
|
|
ansible.builtin.set_fact:
|
|
main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
|
|
- name: Pre-emptively allowing inbound connections already established and related to outbound requests
|
|
ansible.builtin.iptables:
|
|
ip_version: both
|
|
chain: INPUT
|
|
match:
|
|
- conntrack
|
|
ctstate:
|
|
- ESTABLISHED
|
|
- RELATED
|
|
jump: ACCEPT
|
|
comment: allowing inbound replies
|
|
- name: Pre-emptively establishing fiirewall rules for inbound ICMP requests
|
|
become: true
|
|
block:
|
|
- name: Pre-emptively allowing inbound IPv4 ICMP connections
|
|
ansible.builtin.iptables:
|
|
ip_version: ipv4
|
|
chain: INPUT
|
|
destination: "! {{ ipify_public_ip }}"
|
|
protocol: icmp
|
|
jump: ACCEPT
|
|
comment: ping
|
|
- name: Pre-emptively allowing inbound IPv6 ICMP connections
|
|
when: ipv6_enabled
|
|
ansible.builtin.iptables:
|
|
ip_version: ipv6
|
|
chain: INPUT
|
|
destination: "! {{ ipify_public_ip6.stdout }}"
|
|
protocol: icmp
|
|
jump: ACCEPT
|
|
comment: ping
|
|
- name: Pre-emptively establishing firewall rules for loopback interface
|
|
become: true
|
|
block:
|
|
- name: Pre-emptively allowing all inbound connections on loopback device
|
|
ansible.builtin.iptables:
|
|
ip_version: both
|
|
chain: INPUT
|
|
in_interface: lo
|
|
jump: ACCEPT
|
|
comment: loopback
|
|
- name: Pre-emptively allowing inbound SSH
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
ip_version: both
|
|
chain: INPUT
|
|
protocol: tcp
|
|
destination_port: 22
|
|
in_interface: "{{ item }}"
|
|
jump: ACCEPT
|
|
comment: ssh
|
|
loop: "{{ main_interfaces }}"
|
|
- name: Crafting additional exceptions to the inbound default policy
|
|
become: true
|
|
when: iptables.allow.inbound is defined and iptables.allow.inbound != None
|
|
ansible.builtin.iptables:
|
|
ip_version: both
|
|
chain: INPUT
|
|
protocol: "{{ item[1].protocol | default('tcp') }}"
|
|
destination_port: "{{ item[1].port }}"
|
|
in_interface: "{{ item[1].interface | default(item[0]) }}"
|
|
jump: ACCEPT
|
|
comment: "{{ item[1].desc | default('srvr') }}"
|
|
loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
|
|
- name: Setting default policy for inbound connections
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
policy: DROP
|
|
- name: Setting default policy for outbound connections
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
chain: OUTPUT
|
|
policy: ACCEPT
|
|
- name: Backing up firewall rules
|
|
become: true
|
|
community.general.iptables_state:
|
|
ip_version: "{{ item[0] }}"
|
|
state: saved
|
|
path: /etc/iptables/initial_rules.{{ item[1] }}
|
|
loop:
|
|
- ["ipv4", "v4"]
|
|
- ["ipv6", "v6"]
|