---
# Default aliases

- name: Configure default firewall aliases
  oxlorg.opnsense.alias:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    name: "{{ item.name }}"
    type: "{{ item.type }}"
    content: "{{ item.content | default([]) }}"
    description: "{{ item.description | default(omit) }}"
    enabled: "{{ item.enabled | default(true) }}"
    state: present
  loop:
    - name: rfc1918
      type: network
      content:
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16
      description: Private IPv4 networks
    - name: iot_internet_allowed
      type: host
      content: "{{ opnsense_iot_internet_allowed }}"
      description: IoT hosts allowed internet access

# LAN rules

- name: LAN - allow all
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: LAN - allow all
    sequence: 100
    action: pass
    interface: ["{{ opnsense_lan_interface }}"]
    direction: in
    source_net: "{{ opnsense_lan_interface }}"
    destination_net: any
    protocol: any

# GUEST rules

- name: GUEST - allow DNS to OPNsense
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: GUEST - allow DNS to OPNsense
    sequence: 100
    action: pass
    interface: ["{{ opnsense_guest_interface }}"]
    direction: in
    source_net: "{{ opnsense_guest_interface }}"
    destination_net: "{{ opnsense_self_address }}"
    destination_port: "53"
    protocol: TCP/UDP

- name: GUEST - block private networks
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: GUEST - block private networks
    sequence: 200
    action: block
    interface: ["{{ opnsense_guest_interface }}"]
    direction: in
    source_net: "{{ opnsense_guest_interface }}"
    destination_net: rfc1918

- name: GUEST - allow internet
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: GUEST - allow internet
    sequence: 300
    action: pass
    interface: ["{{ opnsense_guest_interface }}"]
    direction: in
    source_net: "{{ opnsense_guest_interface }}"
    destination_net: any

# IoT rules

- name: IoT - allow DNS to OPNsense
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: IoT - allow DNS to OPNsense
    sequence: 100
    action: pass
    interface: ["{{ opnsense_iot_interface }}"]
    direction: in
    source_net: "{{ opnsense_iot_interface }}"
    destination_net: "{{ opnsense_self_address }}"
    destination_port: "53"
    protocol: TCP/UDP

- name: IoT - block private networks
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: IoT - block private networks
    sequence: 200
    action: block
    interface: ["{{ opnsense_iot_interface }}"]
    direction: in
    source_net: "{{ opnsense_iot_interface }}"
    destination_net: rfc1918

- name: IoT - allow internet for selected hosts
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: IoT - allow internet for selected hosts
    sequence: 300
    action: pass
    interface: ["{{ opnsense_iot_interface }}"]
    direction: in
    source_net: iot_internet_allowed
    destination_net: any

- name: IoT - block all
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: IoT - block all
    sequence: 400
    action: block
    interface: ["{{ opnsense_iot_interface }}"]
    direction: in
    source_net: any
    destination_net: any

# DMZ rules

- name: DMZ - allow DNS to OPNsense
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: DMZ - allow DNS to OPNsense
    sequence: 100
    action: pass
    interface: ["{{ opnsense_dmz_interface }}"]
    direction: in
    source_net: "{{ opnsense_dmz_interface }}"
    destination_net: "{{ opnsense_self_address }}"
    destination_port: "53"
    protocol: TCP/UDP

- name: DMZ - block LAN access
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: DMZ - block LAN access
    sequence: 200
    action: block
    interface: ["{{ opnsense_dmz_interface }}"]
    direction: in
    source_net: "{{ opnsense_dmz_interface }}"
    destination_net: "{{ opnsense_lan_interface }}"

- name: DMZ - block GUEST access
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: DMZ - block GUEST access
    sequence: 210
    action: block
    interface: ["{{ opnsense_dmz_interface }}"]
    direction: in
    source_net: "{{ opnsense_dmz_interface }}"
    destination_net: "{{ opnsense_guest_interface }}"

- name: DMZ - block IoT access
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: DMZ - block IoT access
    sequence: 220
    action: block
    interface: ["{{ opnsense_dmz_interface }}"]
    direction: in
    source_net: "{{ opnsense_dmz_interface }}"
    destination_net: "{{ opnsense_iot_interface }}"

- name: DMZ - allow internet
  oxlorg.opnsense.rule:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: [description]
    description: DMZ - allow internet
    sequence: 300
    action: pass
    interface: ["{{ opnsense_dmz_interface }}"]
    direction: in
    source_net: "{{ opnsense_dmz_interface }}"
    destination_net: any