107 lines
2 KiB
YAML
107 lines
2 KiB
YAML
---
|
|
- name: Install firewall
|
|
hosts: vm03
|
|
roles:
|
|
- firewall
|
|
|
|
vars:
|
|
###### Firewalld configuration ######
|
|
firewall:
|
|
# - previous: replaced # flush previous rules
|
|
- zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- ntp
|
|
- dns
|
|
- bgp
|
|
- http
|
|
- https
|
|
source:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
|
|
- zone: internal
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
- zone: public
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- ntp
|
|
- dns
|
|
- bgp
|
|
- http
|
|
- https
|
|
ports:
|
|
- 179/tcp
|
|
- 179/udp
|
|
- 443/tcp
|
|
- 443/udp
|
|
- 1790/tcp
|
|
- 1790/udp
|
|
- 5201/tcp
|
|
- 5201/udp
|
|
- 9443/tcp
|
|
- 33434-33534/udp
|
|
|
|
|
|
- zone: public
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
- zone: public
|
|
masquerade: true
|
|
state: enabled
|
|
permanent: true
|
|
# - set_default_zone: internal
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
# - interface: eth1
|
|
# zone: internal
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
# - interface: eth2
|
|
# zone: internal
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
- interface: eth0
|
|
zone: public
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: vpns0
|
|
zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
|
|
# - interface: tun1
|
|
# zone: external
|
|
# state: enabled
|
|
# permanent: true
|
|
- policy: lan-to-wan
|
|
state: enabled
|
|
permanent: true
|
|
masquerade: true
|
|
ingress_zones:
|
|
- internal
|
|
egress_zones:
|
|
- public
|