Add playbooks/firewall.yml

playbooks/firewall.yml

@@ -0,0 +1,46 @@
+- name: configure firewall rules
+  hosts: wireguard
+  become: true
+
+  tasks:
+  - name: confirm firewall is active
+    service:
+      name: firewalld
+      state: started
+      enabled: true
+
+  - name: run script to remove all pre-configured services in public zone
+    script: ../firewall/remove_services.sh
+
+  - name: allow ssh traffic in internal zone
+    ansible.posix.firewalld:
+      zone: internal
+      service: ssh
+      permanent: true
+      state: enabled
+
+  - name: allow wireguard traffic in internal zone
+    ansible.posix.firewalld:
+      zone: internal
+      service: wireguard
+      permanent: true
+      state: enabled
+
+  - name: allow wireguard traffic in public zone
+    ansible.posix.firewalld:
+      zone: public
+      service: wireguard
+      permanent: true
+      state: enabled
+
+  - name: add source to internal zone
+    ansible.builtin.command: firewall-cmd --zone=internal --add-source=192.168.0.0/24 --permanent
+
+  - name: assign wg0 to internal zone on firewall
+    ansible.builtin.command: firewall-cmd --zone=internal --add-interface=wg0 --permanent
+
+  - name: apply source NAT to internal zone
+    ansible.builtin.command: firewall-cmd --zone=internal --add-masquerade --permanent
+
+  - name: reload firewalld
+    ansible.builtin.command: firewall-cmd --reload