.

2026-03-26 08:57:55 +01:00
parent 2b1ca2d5be
commit bb55664283
19 changed files with 2671 additions and 0 deletions
@@ -0,0 +1,251 @@
+---
+# Default aliases
+
+- name: Configure default firewall aliases
+  oxlorg.opnsense.alias:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    name: "{{ item.name }}"
+    type: "{{ item.type }}"
+    content: "{{ item.content | default([]) }}"
+    description: "{{ item.description | default(omit) }}"
+    enabled: "{{ item.enabled | default(true) }}"
+    state: present
+  loop:
+    - name: rfc1918
+      type: network
+      content:
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+      description: Private IPv4 networks
+    - name: iot_internet_allowed
+      type: host
+      content: "{{ opnsense_iot_internet_allowed }}"
+      description: IoT hosts allowed internet access
+
+# LAN rules
+
+- name: LAN - allow all
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: LAN - allow all
+    sequence: 100
+    action: pass
+    interface: ["{{ opnsense_lan_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_lan_interface }}"
+    destination_net: any
+    protocol: any
+
+# GUEST rules
+
+- name: GUEST - allow DNS to OPNsense
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: GUEST - allow DNS to OPNsense
+    sequence: 100
+    action: pass
+    interface: ["{{ opnsense_guest_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_guest_interface }}"
+    destination_net: "{{ opnsense_self_address }}"
+    destination_port: "53"
+    protocol: TCP/UDP
+
+- name: GUEST - block private networks
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: GUEST - block private networks
+    sequence: 200
+    action: block
+    interface: ["{{ opnsense_guest_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_guest_interface }}"
+    destination_net: rfc1918
+
+- name: GUEST - allow internet
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: GUEST - allow internet
+    sequence: 300
+    action: pass
+    interface: ["{{ opnsense_guest_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_guest_interface }}"
+    destination_net: any
+
+# IoT rules
+
+- name: IoT - allow DNS to OPNsense
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: IoT - allow DNS to OPNsense
+    sequence: 100
+    action: pass
+    interface: ["{{ opnsense_iot_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_iot_interface }}"
+    destination_net: "{{ opnsense_self_address }}"
+    destination_port: "53"
+    protocol: TCP/UDP
+
+- name: IoT - block private networks
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: IoT - block private networks
+    sequence: 200
+    action: block
+    interface: ["{{ opnsense_iot_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_iot_interface }}"
+    destination_net: rfc1918
+
+- name: IoT - allow internet for selected hosts
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: IoT - allow internet for selected hosts
+    sequence: 300
+    action: pass
+    interface: ["{{ opnsense_iot_interface }}"]
+    direction: in
+    source_net: iot_internet_allowed
+    destination_net: any
+
+- name: IoT - block all
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: IoT - block all
+    sequence: 400
+    action: block
+    interface: ["{{ opnsense_iot_interface }}"]
+    direction: in
+    source_net: any
+    destination_net: any
+
+# DMZ rules
+
+- name: DMZ - allow DNS to OPNsense
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: DMZ - allow DNS to OPNsense
+    sequence: 100
+    action: pass
+    interface: ["{{ opnsense_dmz_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_dmz_interface }}"
+    destination_net: "{{ opnsense_self_address }}"
+    destination_port: "53"
+    protocol: TCP/UDP
+
+- name: DMZ - block LAN access
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: DMZ - block LAN access
+    sequence: 200
+    action: block
+    interface: ["{{ opnsense_dmz_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_dmz_interface }}"
+    destination_net: "{{ opnsense_lan_interface }}"
+
+- name: DMZ - block GUEST access
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: DMZ - block GUEST access
+    sequence: 210
+    action: block
+    interface: ["{{ opnsense_dmz_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_dmz_interface }}"
+    destination_net: "{{ opnsense_guest_interface }}"
+
+- name: DMZ - block IoT access
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: DMZ - block IoT access
+    sequence: 220
+    action: block
+    interface: ["{{ opnsense_dmz_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_dmz_interface }}"
+    destination_net: "{{ opnsense_iot_interface }}"
+
+- name: DMZ - allow internet
+  oxlorg.opnsense.rule:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    match_fields: [description]
+    description: DMZ - allow internet
+    sequence: 300
+    action: pass
+    interface: ["{{ opnsense_dmz_interface }}"]
+    direction: in
+    source_net: "{{ opnsense_dmz_interface }}"
+    destination_net: any