BlackDragon/ansible
1
0
Fork 0
forked from bitlair/ansible
Code Pull requests Activity

Make trusted_ports list

Browse source
This commit is contained in:
Mark Janssen 2024-07-25 10:53:44 +02:00
parent 631e09ff74
commit 35a63d7aaa
Signed by: foobar
GPG key ID: D8674D8FC4F69BD2
4 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
group_vars/all.yaml
View file

@ -21,6 +21,8 @@ trusted_ranges:
- { v: ipv6, cidr: "2001:678:814:68::/64", comment: "bitlair wifi" } - { v: ipv6, cidr: "2001:678:814:68::/64", comment: "bitlair wifi" }
- { v: ipv6, cidr: "2a05:2d01:0:4042::/64", comment: "bitlair servers" } - { v: ipv6, cidr: "2a05:2d01:0:4042::/64", comment: "bitlair servers" }
- { v: ipv6, cidr: "2a0e:5700:4:2::/64", comment: "foobar ipv6" } - { v: ipv6, cidr: "2a0e:5700:4:2::/64", comment: "foobar ipv6" }
trusted_ports:
- ssh
root_access: root_access:
- ak - ak

4
group_vars/fotos.yaml
View file

@ -6,6 +6,10 @@ root_access:
- polyfloyd - polyfloyd
- wilco - wilco
trusted_ports:
- ssh
- microsoft-ds
group_nft_input: group_nft_input:
- "# Allow traffic from wiki" - "# Allow traffic from wiki"
- "ip saddr 204.2.64.19 tcp dport { 4567 } accept" - "ip saddr 204.2.64.19 tcp dport { 4567 } accept"

6
group_vars/mqtt.yaml
View file

@ -3,6 +3,6 @@
nft_group_rules: nft_group_rules:
- { version: "ip6", from: [ '2001:470:7f95::/48' ], port: "1883" } - { version: "ip6", from: [ '2001:470:7f95::/48' ], port: "1883" }
group_nft_input: trusted_ports:
- ip saddr @trusted4 tcp dport { 1883 } accept - ssh
- ip6 saddr @trusted6 tcp dport { 1883 } accept - 1883

4
roles/nft/templates/nftables.conf.j2
View file

@ -73,8 +73,8 @@ set trusted6 {
} accept } accept
# Open ssh only for trusted machines # Open ssh only for trusted machines
ip saddr @trusted4 tcp dport { ssh } accept ip saddr @trusted4 tcp dport { {{ trusted_ports|join(', ') }} } accept
ip6 saddr @trusted6 tcp dport { ssh } accept ip6 saddr @trusted6 tcp dport { {{ trusted_ports|join(', ') }} } accept
# Rules based on group-vars # Rules based on group-vars
{% for custom in nft_group_rules %} {% for custom in nft_group_rules %}