slfhst/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plein de modif de partout pour être certain que ça va bien se passer lors des différentes màj des playbooks qui vont bien

Browse Source
This commit is contained in:
VC
2024-07-05 11:53:04 +02:00
parent cb25dc05ef
commit ccb15983b1
28 changed files with 130 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files

117
roles/firewall/templates/firewall.j2
View File

@@ -2,7 +2,7 @@
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
list proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
@@ -10,7 +10,7 @@ config rule
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
list proto 'icmp'
option icmp_type 'echo-request'
option target 'ACCEPT'
option family 'ipv4'
@@ -20,7 +20,7 @@ config rule
option src 'wan'
option src_ip 'fe80::/10'
option src_port '547'
option proto 'udp'
list proto 'udp'
option dest_ip 'fe80::/10'
option dest_port '546'
option target 'ACCEPT'
@@ -29,7 +29,7 @@ config rule
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
@@ -49,7 +49,7 @@ config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
@@ -61,25 +61,32 @@ config rule
option family 'ipv6'
option limit '1000/sec'
config rule
option name 'Allow-INPUT-SSH'
option src 'wan'
list proto 'tcp'
option dest_port '22'
option target 'ACCEPT'
### DMZ Rules
## General Rules
# ICMP
config rule
option name 'Allow-ICMP'
option dest 'dmz'
option proto 'icmp'
list proto 'icmp'
option target 'ACCEPT'
config rule
option name 'Allow-ICMP'
option src 'dmz'
option proto 'icmp'
list proto 'icmp'
option target 'ACCEPT'
config rule
option name 'Allow-ICMP'
option src 'dmz'
option proto 'icmp'
list proto 'icmp'
option dest '*'
option target 'ACCEPT'
@@ -88,23 +95,42 @@ config rule
option name 'Allow-DMZ-DHCP'
option dest 'dmz'
option dest_port '67-68'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-DMZ-DHCP'
option src 'dmz'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest_port '67-68'
option target 'ACCEPT'
option family 'ipv4'
# SSH rules
config rule
option name 'Allow-DMZ-SSH'
option dest 'dmz'
list proto 'tcp'
option dest_port '22'
option target 'ACCEPT'
config rule
option name 'Allow-DMZ-Syslog'
option dest 'dmz'
option dest_ip '{{ hostvars['syslog.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '514'
list proto 'udp'
option target 'ACCEPT'
# DNS Resolution
config rule
option name 'Allow-INPUT-DNS'
option src 'dmz'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest_port '53'
option target 'ACCEPT'
option family 'ipv4'
@@ -113,7 +139,7 @@ config rule
config rule
option name 'Allow-OUTPUT-NTP'
option src 'dmz'
option proto 'udp'
list proto 'udp'
option dest 'wan'
option dest_port '123'
option target 'ACCEPT'
@@ -122,7 +148,8 @@ config rule
config rule
option name 'Allow-OUTPUT-Web'
option src 'dmz'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
option dest_port '80 443'
option target 'ACCEPT'
@@ -131,7 +158,7 @@ config rule
config rule
option name 'Allow-INPUT-SSH'
option src 'wan'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_port '22'
option target 'ACCEPT'
@@ -143,7 +170,8 @@ config redirect
option name 'Allow-INPUT-v4-HTTP'
option src 'wan'
option src_dport '80'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['haproxy.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '80'
@@ -153,7 +181,8 @@ config redirect
option name 'Allow-INPUT-v4-HTTPS'
option src 'wan'
option src_dport '443'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['haproxy.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '443'
@@ -164,7 +193,8 @@ config redirect
config rule
option name 'Allow-INPUT-{{ host }}-Web'
option src 'wan'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars[host]['ansible_default_ipv6']['address'] }}'
option dest_port '80 443'
@@ -177,7 +207,8 @@ config rule
option name 'Allow-OUTPUT-BT'
option src 'dmz'
option src_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
option target 'ACCEPT'
option family 'ipv4'
@@ -186,7 +217,8 @@ config rule
option name 'Allow-OUTPUT-BT'
option src 'dmz'
option src_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
option target 'ACCEPT'
option family 'ipv6'
@@ -194,7 +226,8 @@ config rule
config rule
option name 'Allow-INPUT-BT'
option src 'wan'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_port '10010'
@@ -205,7 +238,8 @@ config redirect
option name 'Allow-INPUT-BT'
option src 'wan'
option src_dport '10010'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '10010'
@@ -216,7 +250,7 @@ config redirect
config rule
option name 'Allow-INPUT-ProxmoxVE-{{ hostvars[host]['ansible_hostname'] }}'
option src 'wan'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars[host]['ansible_default_ipv6']['address'] }}'
option dest_port '8006'
@@ -229,7 +263,8 @@ config rule
option name 'Allow-OUTPUT-XMPP-s2s'
option src 'dmz'
option src_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv4']['address']}}'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
option dest_port '5269'
option target 'ACCEPT'
@@ -239,7 +274,8 @@ config rule
option name 'Allow-OUTPUT-XMPP-s2s'
option src 'dmz'
option src_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
option dest_port '5269'
option target 'ACCEPT'
@@ -249,7 +285,8 @@ config redirect
option name 'Allow-INPUT-XMPP-c2s'
option src 'wan'
option src_dport '5222'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '5222'
@@ -259,7 +296,8 @@ config redirect
option name 'Allow-INPUT-XMPP-s2s'
option src 'wan'
option src_dport '5269'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '5269'
@@ -268,7 +306,8 @@ config redirect
config rule
option name 'Allow-INPUT-XMPP-c2s+s2s'
option src 'wan'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_port '5222 5269'
@@ -279,7 +318,8 @@ config rule
config rule
option name 'Allow-INPUT-mumble'
option src 'wan'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['voice1.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_port '64738'
@@ -290,7 +330,8 @@ config redirect
option name 'Allow-INPUT-mumble'
option src 'wan'
option src_dport '64738'
option proto 'tcpudp'
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['voice1.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '64738'
@@ -301,7 +342,7 @@ config rule
option name 'Allow-OUTPUT-SMTP'
option src 'dmz'
option src_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option proto 'tcp'
list proto 'tcp'
option dest 'wan'
option dst_port '25'
option target 'ACCEPT'
@@ -310,7 +351,7 @@ config rule
config rule
option name 'Allow-INPUT-SMTP+SMTPS+SUBMISSION'
option src 'wan'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_port '25 465 587'
@@ -320,7 +361,7 @@ config rule
config rule
option name 'Allow-INPUT-IMAP+IMAPS'
option src 'wan'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_port '143 993'
@@ -331,7 +372,7 @@ config redirect
option name 'Allow-INPUT-SMTP'
option src 'wan'
option src_dport '25'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '25'
@@ -341,7 +382,7 @@ config redirect
option name 'Allow-INPUT-SMTPS'
option src 'wan'
option src_dport '465'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '465'
@@ -351,7 +392,7 @@ config redirect
option name 'Allow-INPUT-SUBMISSION'
option src 'wan'
option src_dport '587'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '587'
@@ -361,7 +402,7 @@ config redirect
option name 'Allow-INPUT-IMAP'
option src 'wan'
option src_dport '143'
option proto 'tcp'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '143'
@@ -371,7 +412,7 @@ config redirect
option name 'Allow-INPUT-IMAPS'
option src 'wan'
option src_dport '993'
option proto 'tcp'
list proto 'tcp'
option dest 'lan'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_port '993'
@@ -382,7 +423,7 @@ config rule
option name 'Allow-INPUT-Munin'
option src 'dmz'
option src_ip '{{ hostvars['munin.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option proto 'tcp'
list proto 'tcp'
option dest_port '4949'
option target 'ACCEPT'
option family 'ipv4'