aboutsummaryrefslogtreecommitdiff
path: root/ansible
diff options
context:
space:
mode:
authorTrygve Laugstøl <trygvis@inamo.no>2018-12-27 23:36:24 +0100
committerTrygve Laugstøl <trygvis@inamo.no>2018-12-27 23:36:24 +0100
commitfbcf643e474edce8e42b12ea383ec8ebeb4c9ff5 (patch)
treea26f131821832d53b02343ca3094fdbac9e37954 /ansible
parent41fe17ca222da77fb860374adc915a4ca3b2c573 (diff)
downloadinfra-fbcf643e474edce8e42b12ea383ec8ebeb4c9ff5.tar.gz
infra-fbcf643e474edce8e42b12ea383ec8ebeb4c9ff5.tar.bz2
infra-fbcf643e474edce8e42b12ea383ec8ebeb4c9ff5.tar.xz
infra-fbcf643e474edce8e42b12ea383ec8ebeb4c9ff5.zip
ufw
Diffstat (limited to 'ansible')
-rw-r--r--ansible/host_vars/knot/ufw.yml2
-rw-r--r--ansible/knot.yml3
-rw-r--r--ansible/roles/ufw/tasks/main.yml34
3 files changed, 37 insertions, 2 deletions
diff --git a/ansible/host_vars/knot/ufw.yml b/ansible/host_vars/knot/ufw.yml
new file mode 100644
index 0000000..4ece7f5
--- /dev/null
+++ b/ansible/host_vars/knot/ufw.yml
@@ -0,0 +1,2 @@
+ufw__nat_address: 10.0.3.0
+ufw__nat_prefix: 24
diff --git a/ansible/knot.yml b/ansible/knot.yml
index 0eb21d3..fe729f8 100644
--- a/ansible/knot.yml
+++ b/ansible/knot.yml
@@ -1,10 +1,9 @@
---
- hosts:
- knot
- vars_files:
- - secrets.yml
roles:
- mw-frontend
+ - ufw
tasks:
- name: mosquitto-server
import_role: name=mosquitto-server
diff --git a/ansible/roles/ufw/tasks/main.yml b/ansible/roles/ufw/tasks/main.yml
new file mode 100644
index 0000000..e66ef58
--- /dev/null
+++ b/ansible/roles/ufw/tasks/main.yml
@@ -0,0 +1,34 @@
+- tags:
+ - ufw
+ become: yes
+ block:
+ - when: ufw__nat_address is defined
+ blockinfile:
+ path: /etc/ufw/before.rules
+ insertbefore: "^# Don't delete these required lines"
+ content: |
+ # NAT table rules
+ *nat
+ :POSTROUTING ACCEPT [0:0]
+
+ # Forward traffic through eth0 - Change to match you out-interface
+ -A POSTROUTING -s {{ ufw__nat_address }}/{{ ufw__nat_prefix }} -o eth0 -j MASQUERADE
+
+ # don't delete the 'COMMIT' line or these nat table rules won't
+ # be processed
+ COMMIT
+
+# - ufw:
+# state: enabled
+
+# - ufw:
+# default: allow
+# direction: out
+
+# - ufw:
+# policy: deny
+# direction: out
+
+# - ufw:
+# policy: allow
+# direction: routed