.
This commit is contained in:
@@ -0,0 +1,59 @@
|
||||
---
|
||||
opnsense_api_key: "uTaG84sB3dhZtBgTxXV3oXh0aD5dhsR8xxfRYjP6SeAhmYM055dvo89BlfrpLTE01Rwwm7FVZLwZiTiS"
|
||||
opnsense_api_secret: "nrFEVYPBBcuan53v+BBOwUWaBGMEt03+mbU2SZq0q0K90CX2w1h18fsFBiLCNa91yEFQZUSyuWPlx4Yp"
|
||||
opnsense_ssl_verify: false
|
||||
|
||||
opnsense_openvpn_static_keys:
|
||||
- name: MCI-VPN-TLS-CRYPT
|
||||
mode: crypt
|
||||
key: |
|
||||
-----BEGIN OpenVPN Static key V1-----
|
||||
a68d0dba3e2efe7e83c3887cc7fcb759
|
||||
c86a6b4984ea7ffa230dafe1fb4e9ca7
|
||||
66f3667fe75fd8d368b9a0aae7024603
|
||||
f88cf00baf1eab326b222b4321e9cddd
|
||||
8b287265c3ee2d0053193dea1dbdda75
|
||||
e869c7d7d580c0b42421bb5a1af22f80
|
||||
4d058aebc2cf1d8c83cc88948807fbf9
|
||||
3bfc122cab4a650f258f7a57716daa95
|
||||
da3898acfd80481b9d81e9b3d07aeea0
|
||||
11b6c6508324ef89c6812028c345f274
|
||||
f6a51c669c49295e07e8385435f713c0
|
||||
5eaa46b3ccb69888a5b477df79675d66
|
||||
365c4ce5f7684984980731d5eacd0a1a
|
||||
77a9449533076c098cde36c45e54342e
|
||||
27a920724f64eddeb16dcef134adb4b9
|
||||
e0bcaa4ade9ebf2c45d679bd016f7f2e
|
||||
-----END OpenVPN Static key V1-----
|
||||
|
||||
opnsense_openvpn_clients:
|
||||
- name: MCI-VPN
|
||||
enabled: false
|
||||
remote:
|
||||
- vpn.mci.edu:1194
|
||||
- 193.171.232.106:1194
|
||||
- 193.171.232.107:1194
|
||||
- "[2001:628:2260:850::106]:1194"
|
||||
- "[2001:628:2260:850::107]:1194"
|
||||
protocol: udp
|
||||
mode: tap
|
||||
ca: MCI-VPN-CA # import CA cert in WebUI first: System → Trust → Authorities
|
||||
certificate: majanetschek # import client cert+key in WebUI first: System → Trust → Certificates
|
||||
key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]" # workaround: oxlorg.opnsense uses endswith() matching
|
||||
authentication: SHA384
|
||||
verify_remote_certificate: true
|
||||
username: "majanetschek"
|
||||
password: "1234"
|
||||
keepalive_interval: "20"
|
||||
keepalive_timeout: "60"
|
||||
renegotiate_time: "3600"
|
||||
log_level: 1
|
||||
# NOTE: The following options must be set manually in OPNsense WebUI
|
||||
# under VPN → OpenVPN → Clients → Edit → Custom options:
|
||||
# ncp-disable
|
||||
# tls-version-min 1.2
|
||||
# tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
|
||||
# cipher AES-256-GCM
|
||||
# remote-cert-ku e0
|
||||
# reneg-bytes 104857600
|
||||
# reneg-pkts 100000
|
||||
@@ -0,0 +1,119 @@
|
||||
#openvpn für majanetschek
|
||||
tls-client
|
||||
remote-cert-tls server
|
||||
allow-recursive-routing
|
||||
ifconfig-nowarn
|
||||
ncp-disable
|
||||
dev tap
|
||||
proto udp
|
||||
auth-user-pass
|
||||
client
|
||||
|
||||
cipher AES-256-GCM
|
||||
auth SHA384
|
||||
|
||||
verb 1
|
||||
|
||||
keepalive 20 60
|
||||
|
||||
reneg-bytes 104857600
|
||||
reneg-pkts 100000
|
||||
reneg-sec 3600
|
||||
|
||||
|
||||
persist-key
|
||||
|
||||
tls-version-min 1.2
|
||||
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
|
||||
|
||||
remote-cert-ku e0
|
||||
|
||||
<ca>
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIC6zCCAkygAwIBAgIULeThdNwAHGD0XQggppFxVDgd+3QwCgYIKoZIzj0EAwMw
|
||||
RjEoMCYGA1UECgwfTUNJIE1hbmFnZW1lbnQgQ2VudGVyIElubnNicnVjazEaMBgG
|
||||
A1UEAwwRTUNJIFZQTiBSb290IENBIDEwHhcNMjAwOTAyMDgyODQxWhcNMzAwODMx
|
||||
MDgyODQxWjBGMSgwJgYDVQQKDB9NQ0kgTWFuYWdlbWVudCBDZW50ZXIgSW5uc2Jy
|
||||
dWNrMRowGAYDVQQDDBFNQ0kgVlBOIFJvb3QgQ0EgMTCBmzAQBgcqhkjOPQIBBgUr
|
||||
gQQAIwOBhgAEALqR4Lihw47A96tXIO9x/emm0bVyeWg1nrzsKHrsFM/bxmNkGlp+
|
||||
x+yxkcWLkHdHFKqwxu9EZjNQZY14BYnSRjE6AdnPTemChMZuD/QVWhj1QIXtSB32
|
||||
TaE+hdGPcNuysAWSGCeMCk/ZKPa6Uyf9f+lqNReQBGpb/385Zlt+PVlElit9o4HU
|
||||
MIHRMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW
|
||||
BBRIxhLvChAQ19yDSwlXtgV5O831JTAsBgNVHREEJTAjgQt2cG5AbWNpLmVkdYYU
|
||||
aHR0cHM6Ly92cG4ubWNpLmVkdS8wXgYDVR0eAQH/BFQwUqBQMC6kLDAqMSgwJgYD
|
||||
VQQKDB9NQ0kgTWFuYWdlbWVudCBDZW50ZXIgSW5uc2JydWNrMA6CDHZwbjEubWNp
|
||||
LmVkdTAOggx2cG4yLm1jaS5lZHUwCgYIKoZIzj0EAwMDgYwAMIGIAkIBmFMTiKaf
|
||||
gVzp8lKs9uQ/pq8ms2JUCjt2QcBuK0QyUG2fMvC1bBge+j7HYYSVsxx7fm+Lr0/y
|
||||
3ZToJaNJryMSdGUCQgFcHuzWXQM95c1ZSM/horpQvdrOxx9JQXn1BibZe3o1RWIa
|
||||
xypwPnGHV/KnikIzrHUCcFVB2/jqXPCeZNSvKCTDPQ==
|
||||
-----END CERTIFICATE-----
|
||||
</ca>
|
||||
<cert>
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICnTCCAf+gAwIBAgIUJ6zCEdrglrqL/8qnj5gaqQTF15EwCgYIKoZIzj0EAwMw
|
||||
RjEoMCYGA1UECgwfTUNJIE1hbmFnZW1lbnQgQ2VudGVyIElubnNicnVjazEaMBgG
|
||||
A1UEAwwRTUNJIFZQTiBSb290IENBIDEwHhcNMjAwOTA0MTAxNzA0WhcNMzAwOTAy
|
||||
MTAxNzA0WjBaMSgwJgYDVQQKDB9NQ0kgTWFuYWdlbWVudCBDZW50ZXIgSW5uc2Jy
|
||||
dWNrMRcwFQYDVQQLDA5NQ0kgVlBOIENsaWVudDEVMBMGA1UEAwwMbWFqYW5ldHNj
|
||||
aGVrMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9WwWxvk44Lh07ivf2kEnM7HJ2daC
|
||||
fjK/v9xBBIRA4nEJrv8nU//2Cw+EXDO6Ewrua4rOnZ2qosV0wJKhbpfnk5XYbquK
|
||||
ACePOXnZ4teFnEf1ToJhBbOzuDHKH0FDqpZlo4GZMIGWMB8GA1UdIwQYMBaAFEjG
|
||||
Eu8KEBDX3INLCVe2BXk7zfUlMCwGA1UdEgQlMCOBC3ZwbkBtY2kuZWR1hhRodHRw
|
||||
czovL3Zwbi5tY2kuZWR1LzAOBgNVHQ8BAf8EBAMCBeAwFgYDVR0lAQH/BAwwCgYI
|
||||
KwYBBQUHAwIwHQYDVR0OBBYEFBth2m1Rp0i8qlHhciG8cLSmSZqYMAoGCCqGSM49
|
||||
BAMDA4GLADCBhwJCASGvkGCOVQ1HfYMVwrBJYLqV/XTqwIW+bFPvaRFLjjSBB7V7
|
||||
Q32ziQNmRzS6Yh8KVdYEtibrHfw2zalAra6OZyi3AkEIcCj2iizYDuNFyf47B3tP
|
||||
bmWDWlXMdoVjRewDpcPDyy8BqlcHny9WOLcPwl1YqFeHzVgamglTDDMawBi5QgDU
|
||||
4g==
|
||||
-----END CERTIFICATE-----
|
||||
</cert>
|
||||
<key>
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: AES-256-CBC,A1D526070600C0577D6F6683D9E530A6
|
||||
|
||||
2DPAkQov+AMjUNw6FFC2QOSrGjJqXeZ4IC0xzkWwPbP/z8GyVBZhUJbKTxnwOVoo
|
||||
TJWJ7BRoujRFKiV+RS42zl5UKH23BwouLZOVgZU6BXLuW6kPJy+ocHE2pDM+k3rT
|
||||
quGrfZFmGMMFB+va9g2dI6ZY1FPxnCdYu6qsRmeubDbIZlAQ3+e/mB//IxxWSoCd
|
||||
ULSYsFCTcB5AQTF1sQTjIu3wzM7pAVFwqPKynTjiChc=
|
||||
-----END EC PRIVATE KEY-----
|
||||
</key>
|
||||
<tls-crypt>
|
||||
#
|
||||
# 2048 bit OpenVPN static key
|
||||
#
|
||||
-----BEGIN OpenVPN Static key V1-----
|
||||
a68d0dba3e2efe7e83c3887cc7fcb759
|
||||
c86a6b4984ea7ffa230dafe1fb4e9ca7
|
||||
66f3667fe75fd8d368b9a0aae7024603
|
||||
f88cf00baf1eab326b222b4321e9cddd
|
||||
8b287265c3ee2d0053193dea1dbdda75
|
||||
e869c7d7d580c0b42421bb5a1af22f80
|
||||
4d058aebc2cf1d8c83cc88948807fbf9
|
||||
3bfc122cab4a650f258f7a57716daa95
|
||||
da3898acfd80481b9d81e9b3d07aeea0
|
||||
11b6c6508324ef89c6812028c345f274
|
||||
f6a51c669c49295e07e8385435f713c0
|
||||
5eaa46b3ccb69888a5b477df79675d66
|
||||
365c4ce5f7684984980731d5eacd0a1a
|
||||
77a9449533076c098cde36c45e54342e
|
||||
27a920724f64eddeb16dcef134adb4b9
|
||||
e0bcaa4ade9ebf2c45d679bd016f7f2e
|
||||
-----END OpenVPN Static key V1-----
|
||||
</tls-crypt>
|
||||
|
||||
<connection>
|
||||
remote vpn.mci.edu 1194 udp
|
||||
</connection>
|
||||
<connection>
|
||||
remote 193.171.232.106 1194 udp
|
||||
</connection>
|
||||
<connection>
|
||||
remote 193.171.232.107 1194 udp
|
||||
</connection>
|
||||
<connection>
|
||||
remote 2001:628:2260:850::106 1194 udp
|
||||
</connection>
|
||||
<connection>
|
||||
remote 2001:628:2260:850::107 1194 udp
|
||||
</connection>
|
||||
@@ -0,0 +1,5 @@
|
||||
|
||||
localhost ansible_connection=local ansible_python_interpreter="{{ansible_playbook_python}}" host_ip_addr="10.61.1.20" host_base_domain="localhost"
|
||||
|
||||
[opnsense]
|
||||
opnsense.homelan ansible_host=10.61.0.240 ansible_connection=local
|
||||
+209
@@ -0,0 +1,209 @@
|
||||
---
|
||||
- hosts: opnsense
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: opnsense
|
||||
vars:
|
||||
opnsense_dhcp_interfaces:
|
||||
- lan
|
||||
- opt2
|
||||
- opt3
|
||||
|
||||
opnsense_self_address: 10.61.0.240 # OPNsense LAN IP
|
||||
opnsense_lan_interface: lan
|
||||
opnsense_dmz_interface: opt1
|
||||
opnsense_guest_interface: opt2
|
||||
opnsense_iot_interface: opt3
|
||||
|
||||
opnsense_iot_internet_allowed:
|
||||
- 192.168.20.10 # smart TV
|
||||
- 192.168.20.11 # printer
|
||||
|
||||
# --- VLANs ---
|
||||
opnsense_vlans:
|
||||
- interface: vtnet0
|
||||
tag: 1
|
||||
description: LAN
|
||||
- interface: vtnet0
|
||||
tag: 10
|
||||
description: DMZ
|
||||
- interface: vtnet0
|
||||
tag: 11
|
||||
description: GUEST
|
||||
- interface: vtnet0
|
||||
tag: 20
|
||||
description: IoT
|
||||
|
||||
# --- Unbound ---
|
||||
opnsense_unbound_hosts:
|
||||
- hostname: airq-livingroom
|
||||
domain: homelan
|
||||
description: AirQ Luftsensor
|
||||
records:
|
||||
- value: 10.63.1.177
|
||||
aliases:
|
||||
- alias: api
|
||||
- domain: homelan.matzman.net
|
||||
|
||||
- hostname: ha
|
||||
domain: homelan
|
||||
description: Home Assistant
|
||||
records:
|
||||
- value: 10.61.1.75
|
||||
- type: AAAA
|
||||
value: "fd30:882:6101:1::75"
|
||||
aliases:
|
||||
- domain: homelan.matzman.net
|
||||
- alias: mqtt
|
||||
- alias: mqtt
|
||||
domain: homelan.matzman.net
|
||||
|
||||
- hostname: ha
|
||||
domain: iot.homelan
|
||||
description: Home Assistant IoT VLAN
|
||||
records:
|
||||
- value: 10.63.1.75
|
||||
- type: AAAA
|
||||
value: "fd30:882:6120:1::75"
|
||||
aliases:
|
||||
- domain: iot.homelan.matzman.net
|
||||
- alias: mqtt
|
||||
- alias: mqtt
|
||||
domain: iot.homelan.matzman.net
|
||||
|
||||
- hostname: helios4
|
||||
domain: iot.homelan
|
||||
description: Home Assistant IoT VLAN
|
||||
records:
|
||||
- value: 10.61.1.190
|
||||
- type: AAAA
|
||||
value: "fd30:882:6101:1::190"
|
||||
aliases:
|
||||
- domain: iot.homelan.matzman.net
|
||||
- alias: mqtt
|
||||
- alias: mqtt
|
||||
domain: iot.homelan.matzman.net
|
||||
|
||||
- hostname: octopi
|
||||
domain: homelan
|
||||
description: OctoPi Raspi
|
||||
records:
|
||||
- value: 10.63.1.70
|
||||
- type: AAAA
|
||||
value: "fd30:882:6120:1::70"
|
||||
aliases:
|
||||
- alias: octoprint
|
||||
|
||||
- hostname: opnsense
|
||||
domain: homelan
|
||||
description: OPNsense Router
|
||||
records:
|
||||
- value: 10.61.0.250
|
||||
- type: AAAA
|
||||
value: "fd30:0882:6101::250"
|
||||
aliases:
|
||||
- alias: pfsense
|
||||
- alias: ntp
|
||||
|
||||
- hostname: opnsense
|
||||
domain: iot.homelan
|
||||
description: OPNsense Router IoT VLAN
|
||||
records:
|
||||
- value: 10.63.0.250
|
||||
- type: AAAA
|
||||
value: "fd30:0882:6120::250"
|
||||
aliases:
|
||||
- alias: pfsense
|
||||
- alias: ntp
|
||||
|
||||
- hostname: prusa-core-one
|
||||
domain: homelan
|
||||
description: Prusa Core One 3D-Printer
|
||||
records:
|
||||
- value: 10.63.1.84
|
||||
|
||||
- hostname: vhost0
|
||||
domain: homelan
|
||||
description: vhost0 Server
|
||||
records:
|
||||
- value: 10.61.0.100
|
||||
- type: AAAA
|
||||
value: "fd30:0882:6101::100"
|
||||
aliases:
|
||||
- alias: vhost0
|
||||
domain: homelan.matzman.net
|
||||
- alias: nas3
|
||||
|
||||
- hostname: vhost1
|
||||
domain: homelan
|
||||
description: vhost1 Server
|
||||
records:
|
||||
- value: 10.61.0.110
|
||||
- type: AAAA
|
||||
value: "fd30:0882:6101::110"
|
||||
aliases:
|
||||
- alias: vhost1
|
||||
domain: homelan.matzman.net
|
||||
- alias: comic-utils
|
||||
- alias: homepage
|
||||
- alias: komf
|
||||
- alias: komga
|
||||
- alias: uptime
|
||||
- alias: traefik
|
||||
- alias: jdownloader
|
||||
- alias: transmission
|
||||
- alias: lanraragi
|
||||
- alias: influxdb
|
||||
- alias: influxdb
|
||||
domain: homelan.matzman.net
|
||||
- alias: nas0
|
||||
|
||||
- hostname: vhost1
|
||||
domain: iot.homelan
|
||||
description: vhost1 Server IoT VLAN
|
||||
records:
|
||||
- value: 10.63.0.110
|
||||
- type: AAAA
|
||||
value: "fd30:0882:6120::110"
|
||||
aliases:
|
||||
- alias: vhost1
|
||||
domain: iot.homelan.matzman.net
|
||||
- alias: influxdb
|
||||
- alias: influxdb
|
||||
domain: iot.homelan.matzman.net
|
||||
|
||||
- hostname: vserver0
|
||||
domain: wg0.homelan
|
||||
description: vserver0 wg0 interface
|
||||
records:
|
||||
- value: 10.71.1.4
|
||||
|
||||
opnsense_dhcp_subnets:
|
||||
- subnet: "192.168.1.0/24"
|
||||
pools:
|
||||
- "192.168.1.100 - 192.168.1.200"
|
||||
gateway: [192.168.1.1]
|
||||
dns: [192.168.1.1]
|
||||
domain: homelan
|
||||
description: LAN
|
||||
|
||||
# --- WireGuard ---
|
||||
opnsense_wireguard_enabled: false
|
||||
|
||||
opnsense_wireguard_servers:
|
||||
- name: wg0
|
||||
private_key: "MGChy8PrvKTHWC7nzvLwuHQP/uxhNA5FUhLm5NTgfE8="
|
||||
port: 51820
|
||||
allowed_ips:
|
||||
- 10.0.0.1/24
|
||||
peers: []
|
||||
enabled: true
|
||||
|
||||
opnsense_wireguard_peers:
|
||||
- name: client1
|
||||
public_key: "NjmYVK0BWDhQzaODqqoWHNgdtPQyNMJwhCJyEingln8="
|
||||
allowed_ips:
|
||||
- 10.0.0.2/32
|
||||
servers: [wg0]
|
||||
keepalive: 25
|
||||
enabled: true
|
||||
@@ -0,0 +1,166 @@
|
||||
#SPDX-License-Identifier: MIT-0
|
||||
---
|
||||
# --- Connection ---
|
||||
# opnsense_firewall defaults to ansible_host from inventory
|
||||
opnsense_firewall: "{{ ansible_host }}"
|
||||
opnsense_api_key: "" # set in Ansible Vault
|
||||
opnsense_api_secret: "" # set in Ansible Vault
|
||||
opnsense_ssl_verify: true
|
||||
opnsense_api_port: 443
|
||||
|
||||
# --- System settings ---
|
||||
opnsense_hostname: opnsense
|
||||
opnsense_domain: homelan
|
||||
opnsense_timezone: Europe/Vienna
|
||||
opnsense_dns_servers:
|
||||
- 1.1.1.1
|
||||
- 8.8.8.8
|
||||
|
||||
# --- Gateways ---
|
||||
# opnsense_gateways:
|
||||
# - name: WAN_GW
|
||||
# interface: wan
|
||||
# gateway: 192.168.1.1
|
||||
# ip_protocol: inet
|
||||
# default_gw: true
|
||||
opnsense_gateways: []
|
||||
|
||||
# --- VLANs ---
|
||||
# opnsense_vlans:
|
||||
# - interface: vtnet0
|
||||
# tag: 10
|
||||
# description: LAN
|
||||
opnsense_vlans: []
|
||||
|
||||
# --- Network topology ---
|
||||
# OPNsense interface names as assigned in WebUI (Interfaces → Assignments)
|
||||
opnsense_lan_interface: lan
|
||||
opnsense_dmz_interface: opt1
|
||||
opnsense_guest_interface: opt2
|
||||
opnsense_iot_interface: opt3
|
||||
|
||||
# OPNsense's own IP address — used as DNS target in firewall rules
|
||||
# Set this to OPNsense's LAN IP (e.g. 192.168.1.1)
|
||||
opnsense_self_address: ""
|
||||
|
||||
# IoT hosts allowed internet access — list of IPs for iot_internet_allowed alias
|
||||
opnsense_iot_internet_allowed: []
|
||||
|
||||
# --- Firewall aliases ---
|
||||
# opnsense_aliases:
|
||||
# - name: rfc1918
|
||||
# type: network
|
||||
# content:
|
||||
# - 10.0.0.0/8
|
||||
# - 172.16.0.0/12
|
||||
# - 192.168.0.0/16
|
||||
# description: Private networks
|
||||
opnsense_aliases: []
|
||||
|
||||
# --- Firewall rules ---
|
||||
# opnsense_rules:
|
||||
# - description: Allow LAN to internet
|
||||
# interface: [lan]
|
||||
# direction: in
|
||||
# action: pass
|
||||
# source_net: lan
|
||||
# destination_net: any
|
||||
# protocol: any
|
||||
# enabled: true
|
||||
opnsense_rules: []
|
||||
|
||||
# --- NAT (outbound / masquerade) ---
|
||||
# opnsense_nat_source_rules:
|
||||
# - description: Masquerade LAN to WAN
|
||||
# interface: wan
|
||||
# source_net: 192.168.0.0/24
|
||||
# target: interface
|
||||
# enabled: true
|
||||
opnsense_nat_source_rules: []
|
||||
|
||||
# --- DHCP server ---
|
||||
opnsense_dhcp_enabled: false
|
||||
opnsense_dhcp_interfaces: []
|
||||
opnsense_dhcp_fw_rules: false
|
||||
|
||||
# opnsense_dhcp_subnets:
|
||||
# - subnet: 192.168.1.0/24
|
||||
# pools:
|
||||
# - 192.168.1.100 - 192.168.1.200
|
||||
# gateway: [192.168.1.1]
|
||||
# dns: [192.168.1.1]
|
||||
# domain: homelan
|
||||
# description: LAN
|
||||
opnsense_dhcp_subnets: []
|
||||
|
||||
# opnsense_dhcp_reservations:
|
||||
# - ip: 192.168.1.10
|
||||
# mac: "aa:bb:cc:dd:ee:ff"
|
||||
# hostname: myhost
|
||||
# subnet: 192.168.1.0/24
|
||||
# description: My host
|
||||
opnsense_dhcp_reservations: []
|
||||
|
||||
# --- Unbound DNS resolver ---
|
||||
opnsense_unbound_enabled: true
|
||||
opnsense_unbound_port: 53
|
||||
opnsense_unbound_dnssec: true
|
||||
opnsense_unbound_register_dhcp_leases: false
|
||||
opnsense_unbound_register_dhcp_static_mappings: false
|
||||
opnsense_unbound_register_system_records: true
|
||||
|
||||
# Host overrides — aliases are sub-properties of each host entry.
|
||||
# alias.domain defaults to the parent host's domain if not set.
|
||||
# alias.target is auto-set to hostname.domain of the parent host.
|
||||
# opnsense_unbound_hosts:
|
||||
# - hostname: vhost0
|
||||
# domain: homelan
|
||||
# records:
|
||||
# - value: 10.61.0.100 # type defaults to A
|
||||
# - type: AAAA
|
||||
# value: "fd30:882:6101:1::1"
|
||||
# aliases:
|
||||
# - alias: web
|
||||
# - alias: api
|
||||
# - hostname: vhost1
|
||||
# domain: homelan
|
||||
# records:
|
||||
# - value: 10.61.0.110
|
||||
opnsense_unbound_hosts: []
|
||||
|
||||
# Selective forwards — leave empty to resolve everything from root servers
|
||||
# opnsense_unbound_forwards:
|
||||
# - domain: homelan
|
||||
# target: 10.61.0.1
|
||||
# description: Local domain
|
||||
# - domain: internal.example.com
|
||||
# target: 192.168.1.53
|
||||
# description: Internal DNS
|
||||
opnsense_unbound_forwards: []
|
||||
|
||||
# --- OpenVPN clients ---
|
||||
opnsense_openvpn_static_keys: []
|
||||
opnsense_openvpn_clients: []
|
||||
|
||||
# --- WireGuard ---
|
||||
opnsense_wireguard_enabled: true
|
||||
|
||||
# opnsense_wireguard_servers:
|
||||
# - name: wg0
|
||||
# private_key: "{{ vault_wg_private_key }}"
|
||||
# port: 51820
|
||||
# allowed_ips:
|
||||
# - 10.0.0.1/24
|
||||
# peers: []
|
||||
# enabled: true
|
||||
opnsense_wireguard_servers: []
|
||||
|
||||
# opnsense_wireguard_peers:
|
||||
# - name: client1
|
||||
# public_key: "CLIENT_PUBLIC_KEY"
|
||||
# allowed_ips:
|
||||
# - 10.0.0.2/32
|
||||
# servers: [wg0]
|
||||
# keepalive: 25
|
||||
# enabled: true
|
||||
opnsense_wireguard_peers: []
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
- name: Configure DHCP general settings
|
||||
oxlorg.opnsense.dhcp_general:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
enabled: "{{ opnsense_dhcp_enabled }}"
|
||||
interfaces: "{{ opnsense_dhcp_interfaces }}"
|
||||
fw_rules: "{{ opnsense_dhcp_fw_rules }}"
|
||||
|
||||
- name: Configure DHCP subnets
|
||||
oxlorg.opnsense.dhcp_subnet:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [subnet]
|
||||
subnet: "{{ item.subnet }}"
|
||||
auto_options: false
|
||||
pools: "{{ item.pools | default([]) }}"
|
||||
gateway: "{{ item.gateway | default([]) }}"
|
||||
dns: "{{ item.dns | default([]) }}"
|
||||
domain: "{{ item.domain | default('') }}"
|
||||
domain_search: "{{ item.domain_search | default([]) }}"
|
||||
ntp_servers: "{{ item.ntp_servers | default([]) }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_dhcp_subnets }}"
|
||||
|
||||
- name: Configure DHCP reservations
|
||||
oxlorg.opnsense.dhcp_reservation:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
ip: "{{ item.ip }}"
|
||||
mac: "{{ item.mac }}"
|
||||
subnet: "{{ item.subnet | default(omit) }}"
|
||||
hostname: "{{ item.hostname | default(omit) }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_dhcp_reservations }}"
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
- name: Configure firewall aliases
|
||||
oxlorg.opnsense.alias:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
name: "{{ item.name }}"
|
||||
type: "{{ item.type | default('host') }}"
|
||||
content: "{{ item.content | default([]) }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_aliases }}"
|
||||
@@ -0,0 +1,251 @@
|
||||
---
|
||||
# Default aliases
|
||||
|
||||
- name: Configure default firewall aliases
|
||||
oxlorg.opnsense.alias:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
name: "{{ item.name }}"
|
||||
type: "{{ item.type }}"
|
||||
content: "{{ item.content | default([]) }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: present
|
||||
loop:
|
||||
- name: rfc1918
|
||||
type: network
|
||||
content:
|
||||
- 10.0.0.0/8
|
||||
- 172.16.0.0/12
|
||||
- 192.168.0.0/16
|
||||
description: Private IPv4 networks
|
||||
- name: iot_internet_allowed
|
||||
type: host
|
||||
content: "{{ opnsense_iot_internet_allowed }}"
|
||||
description: IoT hosts allowed internet access
|
||||
|
||||
# LAN rules
|
||||
|
||||
- name: LAN - allow all
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: LAN - allow all
|
||||
sequence: 100
|
||||
action: pass
|
||||
interface: ["{{ opnsense_lan_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_lan_interface }}"
|
||||
destination_net: any
|
||||
protocol: any
|
||||
|
||||
# GUEST rules
|
||||
|
||||
- name: GUEST - allow DNS to OPNsense
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: GUEST - allow DNS to OPNsense
|
||||
sequence: 100
|
||||
action: pass
|
||||
interface: ["{{ opnsense_guest_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_guest_interface }}"
|
||||
destination_net: "{{ opnsense_self_address }}"
|
||||
destination_port: "53"
|
||||
protocol: TCP/UDP
|
||||
|
||||
- name: GUEST - block private networks
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: GUEST - block private networks
|
||||
sequence: 200
|
||||
action: block
|
||||
interface: ["{{ opnsense_guest_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_guest_interface }}"
|
||||
destination_net: rfc1918
|
||||
|
||||
- name: GUEST - allow internet
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: GUEST - allow internet
|
||||
sequence: 300
|
||||
action: pass
|
||||
interface: ["{{ opnsense_guest_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_guest_interface }}"
|
||||
destination_net: any
|
||||
|
||||
# IoT rules
|
||||
|
||||
- name: IoT - allow DNS to OPNsense
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: IoT - allow DNS to OPNsense
|
||||
sequence: 100
|
||||
action: pass
|
||||
interface: ["{{ opnsense_iot_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_iot_interface }}"
|
||||
destination_net: "{{ opnsense_self_address }}"
|
||||
destination_port: "53"
|
||||
protocol: TCP/UDP
|
||||
|
||||
- name: IoT - block private networks
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: IoT - block private networks
|
||||
sequence: 200
|
||||
action: block
|
||||
interface: ["{{ opnsense_iot_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_iot_interface }}"
|
||||
destination_net: rfc1918
|
||||
|
||||
- name: IoT - allow internet for selected hosts
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: IoT - allow internet for selected hosts
|
||||
sequence: 300
|
||||
action: pass
|
||||
interface: ["{{ opnsense_iot_interface }}"]
|
||||
direction: in
|
||||
source_net: iot_internet_allowed
|
||||
destination_net: any
|
||||
|
||||
- name: IoT - block all
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: IoT - block all
|
||||
sequence: 400
|
||||
action: block
|
||||
interface: ["{{ opnsense_iot_interface }}"]
|
||||
direction: in
|
||||
source_net: any
|
||||
destination_net: any
|
||||
|
||||
# DMZ rules
|
||||
|
||||
- name: DMZ - allow DNS to OPNsense
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: DMZ - allow DNS to OPNsense
|
||||
sequence: 100
|
||||
action: pass
|
||||
interface: ["{{ opnsense_dmz_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_dmz_interface }}"
|
||||
destination_net: "{{ opnsense_self_address }}"
|
||||
destination_port: "53"
|
||||
protocol: TCP/UDP
|
||||
|
||||
- name: DMZ - block LAN access
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: DMZ - block LAN access
|
||||
sequence: 200
|
||||
action: block
|
||||
interface: ["{{ opnsense_dmz_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_dmz_interface }}"
|
||||
destination_net: "{{ opnsense_lan_interface }}"
|
||||
|
||||
- name: DMZ - block GUEST access
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: DMZ - block GUEST access
|
||||
sequence: 210
|
||||
action: block
|
||||
interface: ["{{ opnsense_dmz_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_dmz_interface }}"
|
||||
destination_net: "{{ opnsense_guest_interface }}"
|
||||
|
||||
- name: DMZ - block IoT access
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: DMZ - block IoT access
|
||||
sequence: 220
|
||||
action: block
|
||||
interface: ["{{ opnsense_dmz_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_dmz_interface }}"
|
||||
destination_net: "{{ opnsense_iot_interface }}"
|
||||
|
||||
- name: DMZ - allow internet
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: [description]
|
||||
description: DMZ - allow internet
|
||||
sequence: 300
|
||||
action: pass
|
||||
interface: ["{{ opnsense_dmz_interface }}"]
|
||||
direction: in
|
||||
source_net: "{{ opnsense_dmz_interface }}"
|
||||
destination_net: any
|
||||
@@ -0,0 +1,27 @@
|
||||
---
|
||||
- name: Configure firewall rules
|
||||
oxlorg.opnsense.rule:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: "{{ item.match_fields | default(['description']) }}"
|
||||
description: "{{ item.description }}"
|
||||
sequence: "{{ item.sequence | default(1) }}"
|
||||
action: "{{ item.action | default('pass') }}"
|
||||
quick: "{{ item.quick | default(true) }}"
|
||||
interface: "{{ item.interface | default(['lan']) }}"
|
||||
direction: "{{ item.direction | default('in') }}"
|
||||
ip_protocol: "{{ item.ip_protocol | default('inet') }}"
|
||||
protocol: "{{ item.protocol | default('any') }}"
|
||||
source_net: "{{ item.source_net | default('any') }}"
|
||||
source_port: "{{ item.source_port | default(omit) }}"
|
||||
source_invert: "{{ item.source_invert | default(false) }}"
|
||||
destination_net: "{{ item.destination_net | default('any') }}"
|
||||
destination_port: "{{ item.destination_port | default(omit) }}"
|
||||
destination_invert: "{{ item.destination_invert | default(false) }}"
|
||||
log: "{{ item.log | default(true) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_rules }}"
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
# NOTE: Interface assignment is not available via the OPNsense API and cannot
|
||||
# be automated with this role. After VLANs are created by this task, you must
|
||||
# manually assign them in the WebUI under Interfaces → Assignments, then
|
||||
# configure each interface (IP address, description) under Interfaces → [name].
|
||||
# This only needs to be done once during initial setup.
|
||||
|
||||
- name: Configure VLANs
|
||||
oxlorg.opnsense.interface_vlan:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
interface: "{{ item.interface }}"
|
||||
tag: "{{ item.tag }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_vlans }}"
|
||||
|
||||
- name: Configure gateways
|
||||
oxlorg.opnsense.gateway:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
name: "{{ item.name }}"
|
||||
interface: "{{ item.interface }}"
|
||||
gateway: "{{ item.gateway }}"
|
||||
ip_protocol: "{{ item.ip_protocol | default('inet') }}"
|
||||
default_gw: "{{ item.default_gw | default(false) }}"
|
||||
far_gw: "{{ item.far_gw | default(false) }}"
|
||||
monitor_disable: "{{ item.monitor_disable | default(false) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_gateways }}"
|
||||
@@ -0,0 +1,66 @@
|
||||
#SPDX-License-Identifier: MIT-0
|
||||
#
|
||||
# OPNsense role — manages OPNsense via oxlorg.opnsense REST API (no SSH)
|
||||
# Collection: oxlorg.opnsense, tested with OPNsense 26.1.2
|
||||
#
|
||||
# Inventory: opnsense file, ansible_connection=local (API-based, no SSH)
|
||||
# Playbook: opnsense.yml
|
||||
#
|
||||
# DNS: Unbound (independent resolver, selective forwards supported)
|
||||
# DHCP: Kea (dnsmasq disabled)
|
||||
# VPN: WireGuard + OpenVPN clients
|
||||
#
|
||||
# Known API limitations in OPNsense 26.1.2 — must be set manually in WebUI:
|
||||
# - System general settings (hostname, timezone, DNS)
|
||||
# - Interface assignment and IP configuration
|
||||
# - Outbound NAT mode (set to Hybrid manually)
|
||||
# - Config backup restore
|
||||
# - OpenVPN custom options (ncp-disable, tls-cipher, etc.)
|
||||
# - CA and client certificates (System → Trust)
|
||||
#
|
||||
# Firewall design:
|
||||
# - LAN: full access
|
||||
# - GUEST: DNS to OPNsense, internet only, isolated from other VLANs
|
||||
# - IoT: DNS to OPNsense, internet only for hosts in iot_internet_allowed alias
|
||||
# - DMZ: DNS to OPNsense, internet access, isolated from LAN/GUEST/IoT
|
||||
#
|
||||
---
|
||||
- name: Configure OPNsense system settings
|
||||
ansible.builtin.import_tasks: system.yml
|
||||
tags: [opnsense-system]
|
||||
|
||||
- name: Configure OPNsense interfaces
|
||||
ansible.builtin.import_tasks: interfaces.yml
|
||||
tags: [opnsense-interfaces]
|
||||
|
||||
- name: Configure OPNsense default firewall rules
|
||||
ansible.builtin.import_tasks: firewall-defaults.yml
|
||||
tags: [opnsense-firewall-defaults, opnsense-firewall]
|
||||
|
||||
- name: Configure OPNsense firewall aliases
|
||||
ansible.builtin.import_tasks: firewall-aliases.yml
|
||||
tags: [opnsense-aliases, opnsense-firewall]
|
||||
|
||||
- name: Configure OPNsense firewall rules
|
||||
ansible.builtin.import_tasks: firewall-rules.yml
|
||||
tags: [opnsense-rules, opnsense-firewall]
|
||||
|
||||
- name: Configure OPNsense NAT
|
||||
ansible.builtin.import_tasks: nat.yml
|
||||
tags: [opnsense-nat, opnsense-firewall]
|
||||
|
||||
- name: Configure OPNsense DHCP
|
||||
ansible.builtin.import_tasks: dhcp.yml
|
||||
tags: [opnsense-dhcp]
|
||||
|
||||
- name: Configure OPNsense Unbound DNS
|
||||
ansible.builtin.import_tasks: unbound.yml
|
||||
tags: [opnsense-unbound, opnsense-dns]
|
||||
|
||||
- name: Configure OPNsense OpenVPN clients
|
||||
ansible.builtin.import_tasks: openvpn-clients.yml
|
||||
tags: [opnsense-openvpn]
|
||||
|
||||
- name: Configure OPNsense WireGuard
|
||||
ansible.builtin.import_tasks: wireguard.yml
|
||||
tags: [opnsense-wireguard]
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
# NOTE: Outbound NAT mode (automatic/hybrid/manual) is not available via the
|
||||
# API. Set it manually once in the WebUI under Firewall → NAT → Outbound → Mode.
|
||||
# Recommended: Hybrid — allows automatic rules plus the custom rules below.
|
||||
|
||||
- name: Configure outbound NAT rules
|
||||
oxlorg.opnsense.nat_source:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: "{{ item.match_fields | default(['description']) }}"
|
||||
description: "{{ item.description }}"
|
||||
sequence: "{{ item.sequence | default(1) }}"
|
||||
interface: "{{ item.interface }}"
|
||||
target: "{{ item.target }}"
|
||||
target_port: "{{ item.target_port | default(omit) }}"
|
||||
no_nat: "{{ item.no_nat | default(false) }}"
|
||||
ip_protocol: "{{ item.ip_protocol | default('inet') }}"
|
||||
protocol: "{{ item.protocol | default('any') }}"
|
||||
source_net: "{{ item.source_net | default('any') }}"
|
||||
source_port: "{{ item.source_port | default(omit) }}"
|
||||
destination_net: "{{ item.destination_net | default('any') }}"
|
||||
destination_port: "{{ item.destination_port | default(omit) }}"
|
||||
log: "{{ item.log | default(false) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_nat_source_rules }}"
|
||||
@@ -0,0 +1,64 @@
|
||||
---
|
||||
# OpenVPN client instances and TLS static keys.
|
||||
#
|
||||
# Prerequisites — must be done manually in OPNsense WebUI before running:
|
||||
# - Import CA certificates: System → Trust → Authorities
|
||||
# - Import client certificates: System → Trust → Certificates
|
||||
# (includes the private key — decrypt it first if encrypted)
|
||||
#
|
||||
# After running — set manually in WebUI per client under
|
||||
# VPN → OpenVPN → Clients → Edit → Custom options:
|
||||
# ncp-disable
|
||||
# tls-version-min 1.2
|
||||
# tls-cipher <cipher>
|
||||
# cipher <cipher>
|
||||
# reneg-bytes <n>
|
||||
# reneg-pkts <n>
|
||||
#
|
||||
# Known limitation: oxlorg.opnsense resolves the tls-crypt key by matching
|
||||
# the END of the API value string, which has the format:
|
||||
# "<name> [<mode> (<description>)]"
|
||||
# Since the name is at the beginning, matching by name alone does not work.
|
||||
# Workaround: pass the full value string as the key parameter, e.g.:
|
||||
# key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]"
|
||||
|
||||
- name: Configure OpenVPN static (tls-crypt) keys
|
||||
oxlorg.opnsense.openvpn_static_key:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
name: "{{ item.name }}"
|
||||
mode: "{{ item.mode | default('crypt') }}"
|
||||
key: "{{ item.key }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_openvpn_static_keys }}"
|
||||
no_log: true
|
||||
|
||||
- name: Configure OpenVPN clients
|
||||
oxlorg.opnsense.openvpn_client:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
name: "{{ item.name }}"
|
||||
remote: "{{ item.remote }}"
|
||||
protocol: "{{ item.protocol | default('udp') }}"
|
||||
mode: "{{ item.mode | default('tun') }}"
|
||||
ca: "{{ item.ca | default(omit) }}"
|
||||
certificate: "{{ item.certificate | default(omit) }}"
|
||||
key: "{{ item.key | default(omit) }}"
|
||||
authentication: "{{ item.authentication | default(omit) }}"
|
||||
verify_remote_certificate: "{{ item.verify_remote_certificate | default(false) }}"
|
||||
username: "{{ item.username | default(omit) }}"
|
||||
password: "{{ item.password | default(omit) }}"
|
||||
keepalive_interval: "{{ item.keepalive_interval | default(omit) }}"
|
||||
keepalive_timeout: "{{ item.keepalive_timeout | default(omit) }}"
|
||||
renegotiate_time: "{{ item.renegotiate_time | default(omit) }}"
|
||||
log_level: "{{ item.log_level | default(3) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_openvpn_clients }}"
|
||||
no_log: true
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# NOTE: OPNsense does not expose general system settings (hostname, domain,
|
||||
# timezone, DNS) via the API. These must be configured manually via the WebUI
|
||||
# under System → Settings → General.
|
||||
|
||||
- name: Disable dnsmasq (using Unbound for DNS and Kea for DHCP)
|
||||
oxlorg.opnsense.dnsmasq_general:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
enabled: false
|
||||
@@ -0,0 +1,67 @@
|
||||
---
|
||||
- name: Configure Unbound general settings
|
||||
oxlorg.opnsense.unbound_general:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
enabled: "{{ opnsense_unbound_enabled }}"
|
||||
port: "{{ opnsense_unbound_port }}"
|
||||
dnssec: "{{ opnsense_unbound_dnssec }}"
|
||||
register_dhcp_leases: "{{ opnsense_unbound_register_dhcp_leases }}"
|
||||
register_dhcp_static_mappings: "{{ opnsense_unbound_register_dhcp_static_mappings }}"
|
||||
register_system_records: "{{ opnsense_unbound_register_system_records }}"
|
||||
|
||||
- name: Configure Unbound host overrides
|
||||
oxlorg.opnsense.unbound_host:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: "{{ item[1].match_fields | default(['hostname', 'domain', 'record_type']) }}"
|
||||
hostname: "{{ item[0].hostname }}"
|
||||
domain: "{{ item[0].domain }}"
|
||||
record_type: "{{ item[1].type | default('A') }}"
|
||||
value: "{{ item[1].value }}"
|
||||
description: "{{ item[0].description | default(omit) }}"
|
||||
enabled: "{{ item[0].enabled | default(true) }}"
|
||||
state: "{{ item[1].state | default('present') }}"
|
||||
loop: "{{ opnsense_unbound_hosts | subelements('records') }}"
|
||||
|
||||
- name: Configure Unbound host override aliases
|
||||
oxlorg.opnsense.unbound_host_alias:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
match_fields: "{{ item[1].match_fields | default(['alias', 'domain']) }}"
|
||||
alias: "{{ item[1].alias | default(item[0].hostname) }}"
|
||||
domain: "{{ item[1].domain | default(item[0].domain) }}"
|
||||
target: "{{ item[0].hostname }}.{{ item[0].domain }}"
|
||||
description: "{{ item[1].description | default(omit) }}"
|
||||
state: "{{ item[1].state | default('present') }}"
|
||||
loop: "{{ opnsense_unbound_hosts | subelements('aliases', skip_missing=True) }}"
|
||||
tags: debug01
|
||||
|
||||
- debug:
|
||||
msg: "{{ opnsense_unbound_hosts | subelements('aliases', skip_missing=True) }}"
|
||||
tags: debug02
|
||||
|
||||
- name: Configure Unbound selective forwards
|
||||
oxlorg.opnsense.unbound_forward:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
domain: "{{ item.domain }}"
|
||||
target: "{{ item.target }}"
|
||||
port: "{{ item.port | default(53) }}"
|
||||
forward_tcp: "{{ item.forward_tcp | default(false) }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_unbound_forwards }}"
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
- name: Enable WireGuard
|
||||
oxlorg.opnsense.wireguard_general:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
enabled: "{{ opnsense_wireguard_enabled }}"
|
||||
|
||||
- name: Configure WireGuard servers
|
||||
oxlorg.opnsense.wireguard_server:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
name: "{{ item.name }}"
|
||||
private_key: "{{ item.private_key }}"
|
||||
port: "{{ item.port | default(51820) }}"
|
||||
allowed_ips: "{{ item.allowed_ips }}"
|
||||
mtu: "{{ item.mtu | default(1420) }}"
|
||||
dns_servers: "{{ item.dns_servers | default([]) }}"
|
||||
disable_routes: "{{ item.disable_routes | default(false) }}"
|
||||
peers: "{{ item.peers | default([]) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_wireguard_servers }}"
|
||||
|
||||
- name: Configure WireGuard peers
|
||||
oxlorg.opnsense.wireguard_peer:
|
||||
firewall: "{{ opnsense_firewall }}"
|
||||
api_key: "{{ opnsense_api_key }}"
|
||||
api_secret: "{{ opnsense_api_secret }}"
|
||||
ssl_verify: "{{ opnsense_ssl_verify }}"
|
||||
api_port: "{{ opnsense_api_port }}"
|
||||
name: "{{ item.name }}"
|
||||
public_key: "{{ item.public_key }}"
|
||||
psk: "{{ item.psk | default(omit) }}"
|
||||
allowed_ips: "{{ item.allowed_ips }}"
|
||||
server: "{{ item.server | default(omit) }}"
|
||||
port: "{{ item.port | default(omit) }}"
|
||||
keepalive: "{{ item.keepalive | default(omit) }}"
|
||||
servers: "{{ item.servers | default([]) }}"
|
||||
enabled: "{{ item.enabled | default(true) }}"
|
||||
state: "{{ item.state | default('present') }}"
|
||||
loop: "{{ opnsense_wireguard_peers }}"
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
---
|
||||
|
||||
- hosts: opnsense.homelan
|
||||
connection: local # execute modules on controller
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Example
|
||||
oxlorg.opnsense.alias:
|
||||
firewall: "{{ ansible_host }}" # or use a per-host variable to store the FQDN..
|
||||
api_key: "{{ firewall.key }}"
|
||||
api_secret: "{{ firewall.secret }}"
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
|
||||
localhost ansible_connection=local ansible_python_interpreter="{{ansible_playbook_python}}" host_ip_addr="10.61.1.20" host_base_domain="localhost"
|
||||
|
||||
[vhosts]
|
||||
vserver1.matzman.net ansible_connection=ssh ansible_user=root host_ip_addr="185.242.113.24" host_base_domain="vserver1.matzman.net"
|
||||
Reference in New Issue
Block a user