Create a firewall role that installs a pf.conf on FreeBSD.

Does not yet configure pflog nor does it do anything on Linux.
This commit is contained in:
Tom Alexander 2022-10-12 21:23:40 -04:00
parent f20dd66d88
commit 6bdbbfa2ac
Signed by: talexander
GPG Key ID: D3A179C9A53C0EDE
12 changed files with 101 additions and 0 deletions

View File

@ -3,3 +3,4 @@ zfs_snapshot_datasets:
- zroot/freebsd/computer/be/default
sshd_enabled: true
sshd_conf: "sshd_config"
pf_config: "homeserver_pf.conf"

View File

@ -8,3 +8,4 @@
- zsh
- sshd
- base
- firewall

View File

@ -0,0 +1,33 @@
ext_if = "{ igb0 igb1 ix0 ix1 wlan0 }"
dhcp = "{ bootpc, bootps }"
# allow = "{ }"
tcp_pass_in = "{ 22 }"
udp_pass_in = "{ 53 51820 }"
# Rules must be in order: options, normalization, queueing, translation, filtering
# options
set skip on lo
# redirections
# filtering
block log all
pass out on $ext_if
# We pass on the interfaces listed in allow rather than skipping on
# them because changes to pass rules will update when running a
# `service pf reload` but interfaces that we `skip` will not update (I
# forget if its from adding, removing, or both. TODO: test to figure
# it out)
# pass quick on $allow
pass on $ext_if proto icmp all
pass on $ext_if proto icmp6 all
pass in on $ext_if proto tcp to any port $tcp_pass_in
pass in on $ext_if proto udp to any port $udp_pass_in
pass quick on $ext_if proto udp from any port $dhcp to any port $dhcp

View File

@ -0,0 +1,2 @@
pf_enable="YES"
pf_rules="/etc/pf.conf"

View File

@ -0,0 +1,5 @@
- name: restart pf
when: is_pf_running.rc == 0
service:
name: pf
state: reloaded

View File

@ -0,0 +1,14 @@
- import_tasks: tasks/freebsd.yaml
when: 'os_flavor == "freebsd"'
- import_tasks: tasks/linux.yaml
when: 'os_flavor == "linux"'
- include_tasks:
file: tasks/peruser.yaml
apply:
become: yes
become_user: "{{ initialize_user }}"
loop: "{{ users | dict2items | community.general.json_query('[?value.initialize==`true`].key') }}"
loop_control:
loop_var: initialize_user

View File

@ -0,0 +1,29 @@
- name: Install service configuration
copy:
src: "files/{{ item.src }}"
dest: "{{ item.dest }}"
mode: 0644
owner: root
group: wheel
loop:
- src: rc.conf
dest: /etc/rc.conf.d/pf
- name: Install PF configuration
copy:
src: "files/{{ item.src }}"
dest: "{{ item.dest }}"
mode: 0644
owner: root
group: wheel
validate: "pfctl -vnf %s"
notify: restart pf
loop:
- src: "{{ pf_config }}"
dest: /etc/pf.conf
- name: Check if pf is running
shell: service pf status
register: is_pf_running
failed_when: is_pf_running.rc != 0
ignore_errors: true

View File

@ -0,0 +1,6 @@
# - name: Install packages
# pacman:
# name:
# - foo
# state: present
# update_cache: true

View File

@ -0,0 +1,2 @@
- import_tasks: tasks/common.yaml
when: (pf_config is defined and os_flavor == "freebsd") or (os_flavor == "linux")

View File

@ -0,0 +1,8 @@
- include_role:
name: per_user
- import_tasks: tasks/peruser_freebsd.yaml
when: 'os_flavor == "freebsd"'
- import_tasks: tasks/peruser_linux.yaml
when: 'os_flavor == "linux"'