252 lines
7.7 KiB
YAML
252 lines
7.7 KiB
YAML
---
|
|
# Default aliases
|
|
|
|
- name: Configure default firewall aliases
|
|
oxlorg.opnsense.alias:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
name: "{{ item.name }}"
|
|
type: "{{ item.type }}"
|
|
content: "{{ item.content | default([]) }}"
|
|
description: "{{ item.description | default(omit) }}"
|
|
enabled: "{{ item.enabled | default(true) }}"
|
|
state: present
|
|
loop:
|
|
- name: rfc1918
|
|
type: network
|
|
content:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
description: Private IPv4 networks
|
|
- name: iot_internet_allowed
|
|
type: host
|
|
content: "{{ opnsense_iot_internet_allowed }}"
|
|
description: IoT hosts allowed internet access
|
|
|
|
# LAN rules
|
|
|
|
- name: LAN - allow all
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: LAN - allow all
|
|
sequence: 100
|
|
action: pass
|
|
interface: ["{{ opnsense_lan_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_lan_interface }}"
|
|
destination_net: any
|
|
protocol: any
|
|
|
|
# GUEST rules
|
|
|
|
- name: GUEST - allow DNS to OPNsense
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: GUEST - allow DNS to OPNsense
|
|
sequence: 100
|
|
action: pass
|
|
interface: ["{{ opnsense_guest_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_guest_interface }}"
|
|
destination_net: "{{ opnsense_self_address }}"
|
|
destination_port: "53"
|
|
protocol: TCP/UDP
|
|
|
|
- name: GUEST - block private networks
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: GUEST - block private networks
|
|
sequence: 200
|
|
action: block
|
|
interface: ["{{ opnsense_guest_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_guest_interface }}"
|
|
destination_net: rfc1918
|
|
|
|
- name: GUEST - allow internet
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: GUEST - allow internet
|
|
sequence: 300
|
|
action: pass
|
|
interface: ["{{ opnsense_guest_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_guest_interface }}"
|
|
destination_net: any
|
|
|
|
# IoT rules
|
|
|
|
- name: IoT - allow DNS to OPNsense
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: IoT - allow DNS to OPNsense
|
|
sequence: 100
|
|
action: pass
|
|
interface: ["{{ opnsense_iot_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_iot_interface }}"
|
|
destination_net: "{{ opnsense_self_address }}"
|
|
destination_port: "53"
|
|
protocol: TCP/UDP
|
|
|
|
- name: IoT - block private networks
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: IoT - block private networks
|
|
sequence: 200
|
|
action: block
|
|
interface: ["{{ opnsense_iot_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_iot_interface }}"
|
|
destination_net: rfc1918
|
|
|
|
- name: IoT - allow internet for selected hosts
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: IoT - allow internet for selected hosts
|
|
sequence: 300
|
|
action: pass
|
|
interface: ["{{ opnsense_iot_interface }}"]
|
|
direction: in
|
|
source_net: iot_internet_allowed
|
|
destination_net: any
|
|
|
|
- name: IoT - block all
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: IoT - block all
|
|
sequence: 400
|
|
action: block
|
|
interface: ["{{ opnsense_iot_interface }}"]
|
|
direction: in
|
|
source_net: any
|
|
destination_net: any
|
|
|
|
# DMZ rules
|
|
|
|
- name: DMZ - allow DNS to OPNsense
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: DMZ - allow DNS to OPNsense
|
|
sequence: 100
|
|
action: pass
|
|
interface: ["{{ opnsense_dmz_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_dmz_interface }}"
|
|
destination_net: "{{ opnsense_self_address }}"
|
|
destination_port: "53"
|
|
protocol: TCP/UDP
|
|
|
|
- name: DMZ - block LAN access
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: DMZ - block LAN access
|
|
sequence: 200
|
|
action: block
|
|
interface: ["{{ opnsense_dmz_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_dmz_interface }}"
|
|
destination_net: "{{ opnsense_lan_interface }}"
|
|
|
|
- name: DMZ - block GUEST access
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: DMZ - block GUEST access
|
|
sequence: 210
|
|
action: block
|
|
interface: ["{{ opnsense_dmz_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_dmz_interface }}"
|
|
destination_net: "{{ opnsense_guest_interface }}"
|
|
|
|
- name: DMZ - block IoT access
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: DMZ - block IoT access
|
|
sequence: 220
|
|
action: block
|
|
interface: ["{{ opnsense_dmz_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_dmz_interface }}"
|
|
destination_net: "{{ opnsense_iot_interface }}"
|
|
|
|
- name: DMZ - allow internet
|
|
oxlorg.opnsense.rule:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
match_fields: [description]
|
|
description: DMZ - allow internet
|
|
sequence: 300
|
|
action: pass
|
|
interface: ["{{ opnsense_dmz_interface }}"]
|
|
direction: in
|
|
source_net: "{{ opnsense_dmz_interface }}"
|
|
destination_net: any
|