1

playbooks/mrwho/vm03-firewall.yml

@@ -96,11 +96,26 @@
 #        zone: external
 #        state: enabled
 #        permanent: true
-      - policy: lan-to-wan
+#      - policy: lan-to-wan
-        state: enabled
+#        state: enabled
-        permanent: true
+#        permanent: true
-        masquerade: true
+#        masquerade: true
-        ingress_zones:
+#        ingress_zones:
-          - internal
+#          - internal
-        egress_zones:
+#        egress_zones:
-          - public
+#          - public
+
+  post-tasks:
+    - name: Создаем политику firewalld
+      ansible.builtin.command: >
+        firewall-cmd --permanent --new-policy lan-to-wan
+      failed_when: false # Игнорируем ошибку, если политика уже создана
+
+    - name: Настраиваем зоны и правила для политики
+      ansible.builtin.command: "{{ item }}"
+      loop:
+        - "firewall-cmd --permanent --policy lan-to-wan --add-ingress-zone internal"
+        - "firewall-cmd --permanent --policy lan-to-wan --add-egress-zone public"
+        - "firewall-cmd --permanent --policy lan-to-wan --set-target ACCEPT"
+        - "firewall-cmd --permanent --policy lan-to-wan --masquerade"
+      notify: Reload firewalld