99 lines
3.0 KiB
YAML
99 lines
3.0 KiB
YAML
---
|
|
- name: Set firewall zone name
|
|
set_fact:
|
|
fw_zone: "{{ gateway_config.lab_name }}"
|
|
br_if: "br_{{ gateway_config.lab_name }}"
|
|
|
|
- name: Remove existing firewall zone
|
|
shell: |
|
|
# Find and remove existing zone
|
|
zone_idx=$(uci show firewall | grep "=zone" | grep "name='{{ fw_zone }}'" | cut -d. -f2 | cut -d= -f1)
|
|
if [ -n "$zone_idx" ]; then
|
|
uci delete firewall.$zone_idx
|
|
fi
|
|
|
|
# Remove associated forwarding rules
|
|
for fwd in $(uci show firewall | grep "={{ fw_zone }}" | cut -d. -f2 | cut -d= -f1); do
|
|
uci delete firewall.$fwd 2>/dev/null || true
|
|
done
|
|
|
|
uci commit firewall
|
|
changed_when: true
|
|
|
|
- name: Create isolated firewall zone for lab network
|
|
shell: |
|
|
# Create new zone
|
|
uci add firewall zone
|
|
uci set firewall.@zone[-1].name='{{ fw_zone }}'
|
|
uci set firewall.@zone[-1].input='REJECT'
|
|
uci set firewall.@zone[-1].output='ACCEPT'
|
|
uci set firewall.@zone[-1].forward='REJECT'
|
|
uci set firewall.@zone[-1].network='{{ br_if }}'
|
|
uci commit firewall
|
|
changed_when: true
|
|
|
|
- name: Allow DNS and DHCP from lab to gateway
|
|
shell: |
|
|
# Allow DNS
|
|
uci add firewall rule
|
|
uci set firewall.@rule[-1].name='Allow-{{ fw_zone }}-DNS'
|
|
uci set firewall.@rule[-1].src='{{ fw_zone }}'
|
|
uci set firewall.@rule[-1].proto='tcp udp'
|
|
uci set firewall.@rule[-1].dest_port='53'
|
|
uci set firewall.@rule[-1].target='ACCEPT'
|
|
|
|
# Allow DHCP
|
|
uci add firewall rule
|
|
uci set firewall.@rule[-1].name='Allow-{{ fw_zone }}-DHCP'
|
|
uci set firewall.@rule[-1].src='{{ fw_zone }}'
|
|
uci set firewall.@rule[-1].proto='udp'
|
|
uci set firewall.@rule[-1].src_port='67:68'
|
|
uci set firewall.@rule[-1].dest_port='67:68'
|
|
uci set firewall.@rule[-1].target='ACCEPT'
|
|
|
|
uci commit firewall
|
|
changed_when: true
|
|
|
|
- name: Allow intra-lab forwarding
|
|
shell: |
|
|
uci add firewall forwarding
|
|
uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
|
|
uci set firewall.@forwarding[-1].dest='{{ fw_zone }}'
|
|
uci commit firewall
|
|
changed_when: true
|
|
|
|
- name: Block lab to WAN/LAN
|
|
shell: |
|
|
# Explicit reject to WAN
|
|
uci add firewall forwarding
|
|
uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
|
|
uci set firewall.@forwarding[-1].dest='wan'
|
|
uci set firewall.@forwarding[-1].enabled='0'
|
|
|
|
# Explicit reject to LAN
|
|
uci add firewall forwarding
|
|
uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
|
|
uci set firewall.@forwarding[-1].dest='lan'
|
|
uci set firewall.@forwarding[-1].enabled='0'
|
|
|
|
uci commit firewall
|
|
changed_when: true
|
|
|
|
- name: Reload firewall
|
|
shell: /etc/init.d/firewall reload
|
|
changed_when: true
|
|
|
|
- name: Verify firewall configuration
|
|
shell: |
|
|
echo "=== Firewall Zones ==="
|
|
uci show firewall | grep "={{ fw_zone }}"
|
|
echo ""
|
|
echo "=== Firewall Rules ==="
|
|
iptables -L -n -v | grep -A 5 "{{ fw_zone }}" || echo "No iptables rules yet"
|
|
register: firewall_status
|
|
changed_when: false
|
|
|
|
- name: Display firewall status
|
|
debug:
|
|
var: firewall_status.stdout_lines
|