From 03b00e796790210bc44e12b630b07e92666a68b9 Mon Sep 17 00:00:00 2001
From: "a.kazantsev" <a.kazantsev@gigacoms.ru>
Date: Sat, 11 Jul 2026 02:13:05 +0300
Subject: [PATCH] 1

---
 .../__pycache__/ipaddr.cpython-39.pyc         | Bin 240 -> 252 bytes
 playbooks/mrwho/vm03-firewall.yml             |  31 +++++++++++++-----
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/filter_plugins/__pycache__/ipaddr.cpython-39.pyc b/filter_plugins/__pycache__/ipaddr.cpython-39.pyc
index da8c8f4817c5abe51a024c2ad11253df1653a303..0c1484fe66b4efc9b60d06508737c55c85d5fd6d 100644
GIT binary patch
delta 54
zcmeys_=k}@k(ZZ?0SI_im?v`2kayM3$j?pHPt?m!tV+x)DNZfZPtPpT%PlI;$k!_>
Iow&^k0F&Yo8~^|S

delta 42
wcmeyv_<@l-k(ZZ?0SIEwX-?#xA#ACik)NBYpIcO(k*{A?oSdJMI`NPd00o#0#sB~S

diff --git a/playbooks/mrwho/vm03-firewall.yml b/playbooks/mrwho/vm03-firewall.yml
index 817aa9b..b6623a3 100644
--- a/playbooks/mrwho/vm03-firewall.yml
+++ b/playbooks/mrwho/vm03-firewall.yml
@@ -96,11 +96,26 @@
 #        zone: external
 #        state: enabled
 #        permanent: true
-      - policy: lan-to-wan
-        state: enabled
-        permanent: true
-        masquerade: true
-        ingress_zones:
-          - internal
-        egress_zones:
-          - public
+#      - policy: lan-to-wan
+#        state: enabled
+#        permanent: true
+#        masquerade: true
+#        ingress_zones:
+#          - internal
+#        egress_zones:
+#          - public
+
+  post-tasks:
+    - name: Создаем политику firewalld
+      ansible.builtin.command: >
+        firewall-cmd --permanent --new-policy lan-to-wan
+      failed_when: false # Игнорируем ошибку, если политика уже создана
+
+    - name: Настраиваем зоны и правила для политики
+      ansible.builtin.command: "{{ item }}"
+      loop:
+        - "firewall-cmd --permanent --policy lan-to-wan --add-ingress-zone internal"
+        - "firewall-cmd --permanent --policy lan-to-wan --add-egress-zone public"
+        - "firewall-cmd --permanent --policy lan-to-wan --set-target ACCEPT"
+        - "firewall-cmd --permanent --policy lan-to-wan --masquerade"
+      notify: Reload firewalld
\ No newline at end of file