You've already forked ansible-linux-infra
57 lines
1.6 KiB
YAML
57 lines
1.6 KiB
YAML
---
|
|
- name: Install firewalld
|
|
ansible.builtin.package:
|
|
name: firewalld
|
|
state: present
|
|
tags: [firewall_config]
|
|
|
|
- name: Enable and start firewalld
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
enabled: true
|
|
state: started
|
|
tags: [firewall_config]
|
|
|
|
- name: Enable the restrictive default zone
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_default_zone }}"
|
|
state: enabled
|
|
permanent: true
|
|
immediate: true
|
|
tags: [firewall_config]
|
|
|
|
- name: Set the restrictive zone as system default
|
|
ansible.builtin.command: "firewall-cmd --set-default-zone={{ firewall_default_zone }}"
|
|
changed_when: true
|
|
tags: [firewall_config]
|
|
|
|
- name: Enable logging of denied packets
|
|
ansible.builtin.command: "firewall-cmd --set-log-denied={{ firewall_log_denied }}"
|
|
changed_when: true
|
|
tags: [firewall_config]
|
|
|
|
- name: Allow SSH only from the administration subnet
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_default_zone }}"
|
|
rich_rule: >-
|
|
rule family="ipv4" source address="{{ firewall_admin_subnet }}"
|
|
port protocol="tcp" port="{{ ssh_port | default(22) }}" accept
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
tags: [firewall_config]
|
|
|
|
- name: Allow defined application services/ports
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_default_zone }}"
|
|
rich_rule: >-
|
|
rule family="ipv4"
|
|
{{ 'source address="' + item.source + '"' if item.source is defined and item.source != 'any' else '' }}
|
|
service name="{{ item.service }}" accept
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
loop: "{{ firewall_allowed_services }}"
|
|
when: firewall_allowed_services | length > 0
|
|
tags: [firewall_config]
|