Initial commit

ansible/roles/openwrt-firewall/tasks/main.yml

@@ -0,0 +1,98 @@
+---
+- name: Set firewall zone name
+  set_fact:
+    fw_zone: "{{ gateway_config.lab_name }}"
+    br_if: "br_{{ gateway_config.lab_name }}"
+
+- name: Remove existing firewall zone
+  shell: |
+    # Find and remove existing zone
+    zone_idx=$(uci show firewall | grep "=zone" | grep "name='{{ fw_zone }}'" | cut -d. -f2 | cut -d= -f1)
+    if [ -n "$zone_idx" ]; then
+      uci delete firewall.$zone_idx
+    fi
+    
+    # Remove associated forwarding rules
+    for fwd in $(uci show firewall | grep "={{ fw_zone }}" | cut -d. -f2 | cut -d= -f1); do
+      uci delete firewall.$fwd 2>/dev/null || true
+    done
+    
+    uci commit firewall
+  changed_when: true
+
+- name: Create isolated firewall zone for lab network
+  shell: |
+    # Create new zone
+    uci add firewall zone
+    uci set firewall.@zone[-1].name='{{ fw_zone }}'
+    uci set firewall.@zone[-1].input='REJECT'
+    uci set firewall.@zone[-1].output='ACCEPT'
+    uci set firewall.@zone[-1].forward='REJECT'
+    uci set firewall.@zone[-1].network='{{ br_if }}'
+    uci commit firewall
+  changed_when: true
+
+- name: Allow DNS and DHCP from lab to gateway
+  shell: |
+    # Allow DNS
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow-{{ fw_zone }}-DNS'
+    uci set firewall.@rule[-1].src='{{ fw_zone }}'
+    uci set firewall.@rule[-1].proto='tcp udp'
+    uci set firewall.@rule[-1].dest_port='53'
+    uci set firewall.@rule[-1].target='ACCEPT'
+    
+    # Allow DHCP
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow-{{ fw_zone }}-DHCP'
+    uci set firewall.@rule[-1].src='{{ fw_zone }}'
+    uci set firewall.@rule[-1].proto='udp'
+    uci set firewall.@rule[-1].src_port='67:68'
+    uci set firewall.@rule[-1].dest_port='67:68'
+    uci set firewall.@rule[-1].target='ACCEPT'
+    
+    uci commit firewall
+  changed_when: true
+
+- name: Allow intra-lab forwarding
+  shell: |
+    uci add firewall forwarding
+    uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
+    uci set firewall.@forwarding[-1].dest='{{ fw_zone }}'
+    uci commit firewall
+  changed_when: true
+
+- name: Block lab to WAN/LAN
+  shell: |
+    # Explicit reject to WAN
+    uci add firewall forwarding
+    uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
+    uci set firewall.@forwarding[-1].dest='wan'
+    uci set firewall.@forwarding[-1].enabled='0'
+    
+    # Explicit reject to LAN
+    uci add firewall forwarding
+    uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
+    uci set firewall.@forwarding[-1].dest='lan'
+    uci set firewall.@forwarding[-1].enabled='0'
+    
+    uci commit firewall
+  changed_when: true
+
+- name: Reload firewall
+  shell: /etc/init.d/firewall reload
+  changed_when: true
+
+- name: Verify firewall configuration
+  shell: |
+    echo "=== Firewall Zones ==="
+    uci show firewall | grep "={{ fw_zone }}"
+    echo ""
+    echo "=== Firewall Rules ==="
+    iptables -L -n -v | grep -A 5 "{{ fw_zone }}" || echo "No iptables rules yet"
+  register: firewall_status
+  changed_when: false
+
+- name: Display firewall status
+  debug:
+    var: firewall_status.stdout_lines