60 lines
2 KiB
YAML
60 lines
2 KiB
YAML
---
|
||
# Запрет на передачу пакетов через сервер (т.е. работу его как шлюза)
|
||
- name: net.ipv4.ip_forward
|
||
ansible.posix.sysctl:
|
||
name: net.ipv4.ip_forward
|
||
value: 0
|
||
state: present
|
||
sysctl_file: /etc/sysctl.d/ip_forward.conf
|
||
|
||
# Запрет на маршрутизацию на основе соответствующей опции в пакете (безопасность)
|
||
- name: net.ipv4.conf.default.accept_source_route
|
||
ansible.posix.sysctl:
|
||
name: net.ipv4.conf.default.accept_source_route
|
||
value: 0
|
||
state: present
|
||
sysctl_file: /etc/sysctl.d/ip_forward.conf
|
||
|
||
# Если в таблице маршрутизации есть маршрут на сеть, с которой пришёл пакет (src ip)
|
||
# и он ссылается на данный интерфейс, то такой пакет будет принят.
|
||
# остальные будут отброшены.
|
||
- name: net.ipv4.conf.default.rp_filter
|
||
ansible.posix.sysctl:
|
||
name: net.ipv4.conf.default.rp_filter
|
||
value: 1
|
||
state: present
|
||
sysctl_file: /etc/sysctl.d/ip_forward.conf
|
||
- name: net.ipv4.conf.all.rp_filter
|
||
ansible.posix.sysctl:
|
||
name: net.ipv4.conf.all.rp_filter
|
||
value: 1
|
||
state: present
|
||
sysctl_file: /etc/sysctl.d/ip_forward.conf
|
||
- name: net.ipv4.conf.lo.rp_filter
|
||
ansible.posix.sysctl:
|
||
name: net.ipv4.conf.lo.rp_filter
|
||
value: 1
|
||
state: present
|
||
sysctl_file: /etc/sysctl.d/ip_forward.conf
|
||
- name: net.ipv4.conf.all.send_redirects
|
||
ansible.posix.sysctl:
|
||
name: net.ipv4.conf.all.send_redirects
|
||
value: 0
|
||
state: present
|
||
sysctl_file: /etc/sysctl.d/ip_forward.conf
|
||
|
||
# - name: net.ipv4.conf.default.send_redirects
|
||
# ansible.posix.sysctl:
|
||
# name: net.ipv4.conf.default.send_redirects
|
||
# value: 0
|
||
# state: present
|
||
# reload: true
|
||
# sysctl_file: /etc/sysctl.d/ip_forward.conf
|
||
|
||
- name: net.ipv4.conf.all.accept_redirects
|
||
ansible.posix.sysctl:
|
||
name: net.ipv4.conf.all.accept_redirects
|
||
value: 0
|
||
state: present
|
||
sysctl_file: /etc/sysctl.d/ip_forward.conf
|