talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

NAT working but not fail-safe.

Browse Source 
When the firewall is down, packets still go out wlan0 but with untranslated source ips.
This commit is contained in:
Tom Alexander 2022-10-29 19:49:25 -04:00
parent 4e29c2e3d8
commit 2e893733a8
Signed by: talexander
GPG Key ID: D3A179C9A53C0EDE
3 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/playbook.yaml
View File

@ -10,7 +10,7 @@
# - network # - network
# - sshd # - sshd
# - base # - base
# # - firewall - firewall
# - cpu # - cpu
# - ntp # - ntp
# - build # - build

7
ansible/roles/firewall/files/odofreebsd_pf.conf
View File

@ -1,7 +1,8 @@
ext_if = "{ igb0 igb1 ix0 ix1 wlan0 }" ext_if = "{ igb0 igb1 ix0 ix1 wlan0 }"
jail_net_v4 = "10.10.11.0/24"
dhcp = "{ bootpc, bootps }" dhcp = "{ bootpc, bootps }"
# allow = "{ }" allow = "{ nat_uplink0 }"
tcp_pass_in = "{ 22 }" tcp_pass_in = "{ 22 }"
udp_pass_in = "{ 53 51820 }" udp_pass_in = "{ 53 51820 }"
@ -12,9 +13,11 @@ udp_pass_in = "{ 53 51820 }"
set skip on lo set skip on lo
# redirections # redirections
nat on $ext_if inet from $jail_net_v4 to { any, !$jail_net_v4 } tag ALLOWED -> (wlan0)
# filtering # filtering
block log all block log all
pass quick on $ext_if tagged ALLOWED
pass out on $ext_if pass out on $ext_if
# We pass on the interfaces listed in allow rather than skipping on # We pass on the interfaces listed in allow rather than skipping on
@ -22,7 +25,7 @@ pass out on $ext_if
# `service pf reload` but interfaces that we `skip` will not update (I # `service pf reload` but interfaces that we `skip` will not update (I
# forget if its from adding, removing, or both. TODO: test to figure # forget if its from adding, removing, or both. TODO: test to figure
# it out) # it out)
# pass quick on $allow pass quick on $allow
pass on $ext_if proto icmp all pass on $ext_if proto icmp all
pass on $ext_if proto icmp6 all pass on $ext_if proto icmp6 all

9
ansible/roles/jail/tasks/freebsd.yaml
View File

@ -125,3 +125,12 @@
file: file:
path: /etc/rc.conf.d/setup_netgraph path: /etc/rc.conf.d/setup_netgraph
state: absent state: absent
- name: Enable gateway
community.general.sysrc:
name: "{{ item }}"
value: "YES"
path: /etc/rc.conf.d/routing
loop:
- gateway_enable
- ipv6_gateway_enable