fixes

inventory/prod/hosts.yml

@@ -19,4 +19,4 @@ all:
           ansible_host: 192.168.99.42
 
         rocky9-template:
-          ansible_host: 172.20.21.103
+          ansible_host: 192.168.99.43

playbooks/rocky9.yml

@@ -20,8 +20,9 @@
   vars:
     #ansible_ssh_user: root
     #ansible_ssh_password: nmklop90
+    epel_repo: true
     reboot_system: false
-    hostname: rocky9-template.local.mrwho.ru
+    hostname: "{{ ansible_hostname }}.local.mrwho.ru"
 
     openssh_password_authentication: false
     openssh_permit_root_login: "no"  # Completely disable root SSH
@@ -30,8 +31,8 @@
     openssh_enable_persourcepenalties: true
     openssh_persource_authfail_penalty: "10s"  # Aggressive penalty
     openssh_persource_maxstartups: "5:30:10"   # Very restrictive
-    # Disable all forwarding (prevent lateral movement)
-    openssh_disable_forwarding_comprehensive: true
+    # Disable all port forwarding 
+    openssh_disable_forwarding_comprehensive: false
     openssh_x11_forwarding: false
     # Restrict to strongest cryptography only
     openssh_ciphers:

roles/linux_dnf_automatic_rhel9/defaults/main.yml

@@ -7,7 +7,7 @@ linux_dnf_automatic_enabled: true
 linux_dnf_automatic_apply_updates: "security"
 
 # Email notifications (optional – requires mail setup)
-linux_dnf_automatic_email_notify: true
+linux_dnf_automatic_email_notify: false
 linux_dnf_automatic_email_to: "root@localhost"
 linux_dnf_automatic_email_from: "dnf-automatic@{{ ansible_fqdn }}"
 

roles/linux_login_banner_rhel9/tasks/tasks.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Deploy CyberAar pre-login banner (/etc/issue.net)"
+- name: "Deploy pre-login banner (/etc/issue.net)"
   when: "linux_login_banner_prelogin | bool"
   ansible.builtin.template:
     src: "issue.net.j2"
@@ -11,7 +11,7 @@
   register: "prelogin_banner_result"
   changed_when: "prelogin_banner_result.changed"
 
-- name: "Deploy CyberAar post-login banner (/etc/motd)"
+- name: "Deploy post-login banner (/etc/motd)"
   when: "linux_login_banner_postlogin | bool"
   ansible.builtin.template:
     src: "motd.j2"
@@ -23,7 +23,7 @@
   register: "motd_result"
   changed_when: "motd_result.changed"
 
-- name: "Deploy CyberAar console login banner (/etc/issue)"
+- name: "Deploy console login banner (/etc/issue)"
   when: "linux_login_banner_issue | bool"
   ansible.builtin.template:
     src: "issue.j2"

roles/rocky9/tasks/install_packages.yml

@@ -32,9 +32,11 @@
   community.general.dnf_config_manager:
     name: crb
     state: enabled
+  when: crb_repo is defined
 
 - name: Install EPEL repo
   ansible.builtin.include_tasks: install-epel-repo.yml
+  when: epel_repo is defined
 
 # - name: Upgrade all packages
 #  ansible.builtin.dnf:

roles/rocky9/tasks/ip_forward.yml

@@ -18,16 +18,22 @@
 # Если в таблице маршрутизации есть маршрут на сеть, с которой пришёл пакет (src ip)
 # и он ссылается на данный интерфейс, то такой пакет будет принят.
 # остальные будут отброшены.
+# Когда rp_filter нужно отключать (0) или ослаблять (2):
+# - Использование асимметричной маршрутизации (когда пакеты приходят через провайдера А, а уходят через провайдера Б).
+# - Настройка сложных схем балансировки трафика (BGP, Multipath).
+# - Использование политик маршрутизации (Policy Based Routing via ip rule). 
+#   При строгом режиме 1 ядро проверяет обратный путь по дефолтной таблице main,
+#   игнорируя кастомные таблицы, что приводит к ложному отбрасыванию пакетов.
 - name: net.ipv4.conf.default.rp_filter
   ansible.posix.sysctl:
     name: net.ipv4.conf.default.rp_filter
-    value: 1
+    value: 0
     state: present
     sysctl_file: /etc/sysctl.d/ip_forward.conf
 - name: net.ipv4.conf.all.rp_filter
   ansible.posix.sysctl:
     name: net.ipv4.conf.all.rp_filter
-    value: 1
+    value: 0
     state: present
     sysctl_file: /etc/sysctl.d/ip_forward.conf
 - name: net.ipv4.conf.lo.rp_filter
@@ -43,13 +49,13 @@
     state: present
     sysctl_file: /etc/sysctl.d/ip_forward.conf
 
-# - name: net.ipv4.conf.default.send_redirects
-#  ansible.posix.sysctl:
-#    name: net.ipv4.conf.default.send_redirects
-#    value: 0
-#    state: present
-#    reload: true
-#    sysctl_file: /etc/sysctl.d/ip_forward.conf
+- name: net.ipv4.conf.default.send_redirects
+  ansible.posix.sysctl:
+    name: net.ipv4.conf.default.send_redirects
+    value: 0
+    state: present
+    reload: true
+    sysctl_file: /etc/sysctl.d/ip_forward.conf
 
 - name: net.ipv4.conf.all.accept_redirects
   ansible.posix.sysctl: