109 lines
4 KiB
YAML
109 lines
4 KiB
YAML
---
|
||
- name: Добавить таблицу маршрутизации в rt_tables
|
||
ansible.builtin.lineinfile:
|
||
path: /etc/iproute2/rt_tables
|
||
line: "{{ policy_routing_table_id }}\t{{ policy_routing_table_name }}"
|
||
regexp: "^{{ policy_routing_table_id }}\\s"
|
||
owner: root
|
||
group: root
|
||
mode: "0644"
|
||
create: true
|
||
|
||
- name: Установить rp_filter в loose mode
|
||
ansible.posix.sysctl:
|
||
name: "{{ item }}"
|
||
value: "{{ policy_routing_rp_filter_mode }}"
|
||
sysctl_file: /etc/sysctl.d/50-policy-routing.conf
|
||
reload: true
|
||
loop:
|
||
- net.ipv4.conf.all.rp_filter
|
||
- net.ipv4.conf.default.rp_filter
|
||
|
||
- name: Установить/обновить systemd unit policy-routing
|
||
ansible.builtin.template:
|
||
src: policy-routing.service.j2
|
||
dest: /etc/systemd/system/policy-routing.service
|
||
owner: root
|
||
group: root
|
||
mode: "0644"
|
||
notify: Restart policy-routing
|
||
|
||
- name: Включить и запустить policy-routing
|
||
ansible.builtin.systemd:
|
||
name: policy-routing
|
||
enabled: true
|
||
state: started
|
||
masked: false
|
||
daemon_reload: true
|
||
|
||
# ── ECMP-режим: маркировка OUTPUT (только если policy_routing_balancers пустой) ─
|
||
- name: Маркировать исходящие DNS-ответы (ECMP-режим)
|
||
ansible.builtin.command:
|
||
cmd: >
|
||
firewall-cmd --permanent --direct --add-rule
|
||
ipv4 mangle OUTPUT 0 -p {{ item }} --sport {{ policy_routing_src_port }}
|
||
-j MARK --set-xmark {{ policy_routing_fwmark }}
|
||
loop: "{{ policy_routing_protocols }}"
|
||
register: result
|
||
changed_when: "'ALREADY_ENABLED' not in result.stderr"
|
||
notify: Reload firewalld
|
||
when: policy_routing_balancers | length == 0
|
||
|
||
# ── MAC-matching режим ───────────────────────────────────────────────────────
|
||
- name: MAC-matching режим
|
||
when: policy_routing_balancers | length > 0
|
||
block:
|
||
|
||
- name: Добавить дополнительные таблицы маршрутизации в rt_tables
|
||
ansible.builtin.lineinfile:
|
||
path: /etc/iproute2/rt_tables
|
||
line: "{{ item.table_id }}\t{{ item.table_name }}"
|
||
regexp: "^{{ item.table_id }}\\s"
|
||
owner: root
|
||
group: root
|
||
mode: "0644"
|
||
create: true
|
||
loop: "{{ policy_routing_balancers }}"
|
||
|
||
- name: Удалить старое правило MARK OUTPUT (несовместимо с CONNMARK)
|
||
ansible.builtin.command:
|
||
cmd: >
|
||
firewall-cmd --permanent --direct --remove-rule
|
||
ipv4 mangle OUTPUT 0 -p {{ item }} --sport {{ policy_routing_src_port }}
|
||
-j MARK --set-xmark {{ policy_routing_fwmark }}
|
||
loop: "{{ policy_routing_protocols }}"
|
||
register: remove_result
|
||
failed_when: false
|
||
changed_when: remove_result.rc == 0
|
||
notify: Reload firewalld
|
||
|
||
- name: Добавить CONNMARK PREROUTING по MAC для каждого балансировщика
|
||
ansible.builtin.include_tasks: connmark-prerouting.yml
|
||
loop: "{{ policy_routing_balancers }}"
|
||
loop_control:
|
||
loop_var: balancer
|
||
|
||
- name: Добавить CONNMARK restore в OUTPUT (UDP)
|
||
ansible.builtin.command:
|
||
cmd: >
|
||
firewall-cmd --permanent --direct --add-rule
|
||
ipv4 mangle OUTPUT 0
|
||
-p udp --sport {{ policy_routing_src_port }}
|
||
-m connmark ! --mark 0
|
||
-j CONNMARK --restore-mark
|
||
register: result
|
||
changed_when: "'ALREADY_ENABLED' not in result.stderr"
|
||
notify: Reload firewalld
|
||
|
||
- name: Добавить CONNMARK restore в OUTPUT (TCP)
|
||
ansible.builtin.command:
|
||
cmd: >
|
||
firewall-cmd --permanent --direct --add-rule
|
||
ipv4 mangle OUTPUT 0
|
||
-p tcp --sport {{ policy_routing_src_port }}
|
||
-m connmark ! --mark 0
|
||
-j CONNMARK --restore-mark
|
||
register: result
|
||
changed_when: "'ALREADY_ENABLED' not in result.stderr"
|
||
notify: Reload firewalld
|