46 lines
1.3 KiB
YAML
46 lines
1.3 KiB
YAML
- name: configure firewall rules
|
|
hosts: wireguard
|
|
become: true
|
|
|
|
tasks:
|
|
- name: confirm firewall is active
|
|
service:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: run script to remove all pre-configured services in public zone
|
|
script: ../firewall/remove_services.sh
|
|
|
|
- name: allow ssh traffic in internal zone
|
|
ansible.posix.firewalld:
|
|
zone: internal
|
|
service: ssh
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow wireguard traffic in internal zone
|
|
ansible.posix.firewalld:
|
|
zone: internal
|
|
service: wireguard
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow wireguard traffic in public zone
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
service: wireguard
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: add source to internal zone
|
|
ansible.builtin.command: firewall-cmd --zone=internal --add-source=192.168.0.0/24 --permanent
|
|
|
|
- name: assign wg0 to internal zone on firewall
|
|
ansible.builtin.command: firewall-cmd --zone=internal --add-interface=wg0 --permanent
|
|
|
|
- name: apply source NAT to internal zone
|
|
ansible.builtin.command: firewall-cmd --zone=internal --add-masquerade --permanent
|
|
|
|
- name: reload firewalld
|
|
ansible.builtin.command: firewall-cmd --reload |