talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix ansible playbook on FreeBSD.

Browse Source
This commit is contained in:
Tom Alexander
2024-01-21 15:58:18 -05:00
parent 6b3bdab18b
commit 724a8ca394
6 changed files with 62 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
ansible/roles/firewall/files/odofreebsd_pf.conf
View File

@@ -5,7 +5,7 @@ not_jail_nat_v4 = "{ any, !10.215.1.0/24 }"
dns_redirect = "{ 10.193.223.1 10.213.177.1 10.215.1.1 }"
dhcp = "{ bootpc, bootps }"
allow = "{ wgf wgh drmario colo }"
#allow = "{ wgf wgh drmario colo }"
tcp_pass_in = "{ 22 }"
udp_pass_in = "{ 53 51820 }"
@@ -16,8 +16,8 @@ udp_pass_in = "{ 53 51820 }"
set skip on lo
# redirections
nat pass on $ext_if inet from $jail_nat_v4 to $not_jail_nat_v4 -> (wlan0)
rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.1.1 port 53 -> 1.1.1.1 port 53
#nat pass on $ext_if inet from $jail_nat_v4 to $not_jail_nat_v4 -> (wlan0)
#rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.1.1 port 53 -> 1.1.1.1 port 53
# Redirect jaeger ports to virtual machine.
# nat pass on lo inet from 127.0.0.0/24 to 127.0.0.0/24 port {6831 6832 16686 14268} -> (jail_nat)
@@ -27,19 +27,19 @@ rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.1.1 port 53 -> 1.1.1
block log all
pass out on $ext_if
pass in on jail_nat
#pass in on jail_nat
# Allow traffic from my machine to the jails/virtual machines
pass out on jail_nat from $jail_nat_v4
#pass out on jail_nat from $jail_nat_v4
# We pass on the interfaces listed in allow rather than skipping on
# them because changes to pass rules will update when running a
# `service pf reload` but interfaces that we `skip` will not update (I
# forget if its from adding, removing, or both. TODO: test to figure
# it out). Also skipped interfaces are not subject to nat/rdr rules.
pass quick on $allow
#pass quick on $allow
pass on $ext_if proto icmp all
pass on $ext_if proto icmp6 all
pass in on $ext_if proto tcp to any port $tcp_pass_in
pass in on $ext_if proto udp to any port $udp_pass_in
#pass in on $ext_if proto tcp to any port $tcp_pass_in
#pass in on $ext_if proto udp to any port $udp_pass_in