roles/common: Add firewalld support

Needed in Ubuntu 15.04 where iptables-persistent is going away. I
have added translations of the current IPv4 and IPv6 iptables rules.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
This commit is contained in:
Alan Orth 2015-06-07 12:42:03 +03:00
parent cc3b6d5026
commit 1fc2453703
3 changed files with 86 additions and 0 deletions

View File

@ -12,3 +12,6 @@
- name: reload sysctl
command: sysctl -p /etc/sysctl.conf
- name: restart firewalld
service: name=firewalld state=restarted

View File

@ -1,13 +1,33 @@
---
- name: Install iptables-persistent
when: ansible_distribution_version == '14.04'
apt: pkg=iptables-persistent update_cache=yes
- name: Copy /etc/iptables/rules.v4
when: ansible_distribution_version == '14.04'
template: src=iptables.j2 dest=/etc/iptables/rules.v4 owner=root mode=0600
notify:
- restart iptables-persistent
- name: Copy /etc/iptables/rules.v6
when: ansible_distribution_version == '14.04'
template: src=ip6tables.j2 dest=/etc/iptables/rules.v6 owner=root group=root mode=0600
notify:
- restart iptables-persistent
- name: Install firewalld and deps
when: ansible_distribution_version == '15.04'
apt: pkg={{ item }} state=latest
with_items:
- firewalld
- tidy
- name: Copy firewalld public zone file
when: ansible_distribution_version == '15.04'
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
- name: Format public.xml firewalld zone file
when: ansible_distribution_version == '15.04'
shell: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
notify:
- restart firewalld

View File

@ -0,0 +1,63 @@
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<interface name="{{ ansible_default_ipv4.alias }}"/>
{# ssh rules #}
<rule family="ipv4">
<source address="0.0.0.0/0"/>
<port protocol="tcp" port="22"/>
<accept/>
</rule>
{# ipv6 ssh rules #}
<rule family="ipv6">
<source address="::/0"/>
<port protocol="tcp" port="22"/>
<accept/>
</rule>
{# web rules #}
<rule family="ipv4">
<source address="0.0.0.0/0"/>
<port protocol="tcp" port="80"/>
<accept/>
</rule>
{# ipv6 web rules #}
<rule family="ipv6">
<source address="::/0"/>
<port protocol="tcp" port="80"/>
<accept/>
</rule>
{# munin rules #}
{% if munin_master_host is defined %}
<rule family="ipv4">
<source address="{{ ghetto_ipsets[munin_master_host].src }}"/>
<port protocol="tcp" port="{{ munin_node_port }}"/>
<accept/>
</rule>
{% endif %}
{# extra rules #}
{% if extra_iptables_rules is defined %}
{% for rule in extra_iptables_rules %}
<rule family="ipv4">
<source address="{{ ghetto_ipsets[rule.acl].src }}"/>
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
<accept/>
</rule>
{# ipv6 extra rules #}
{% if ghetto_ipsets[rule.acl].ipv6src is defined %}
<rule family="ipv6">
<source address="{{ ghetto_ipsets[rule.acl].ipv6src }}"/>
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
<accept/>
</rule>
{% endif %}
{% endfor %}
{% endif %}
</zone>