67 lines
2.3 KiB
YAML
67 lines
2.3 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
#
|
|
# OPNsense role — manages OPNsense via oxlorg.opnsense REST API (no SSH)
|
|
# Collection: oxlorg.opnsense, tested with OPNsense 26.1.2
|
|
#
|
|
# Inventory: opnsense file, ansible_connection=local (API-based, no SSH)
|
|
# Playbook: opnsense.yml
|
|
#
|
|
# DNS: Unbound (independent resolver, selective forwards supported)
|
|
# DHCP: Kea (dnsmasq disabled)
|
|
# VPN: WireGuard + OpenVPN clients
|
|
#
|
|
# Known API limitations in OPNsense 26.1.2 — must be set manually in WebUI:
|
|
# - System general settings (hostname, timezone, DNS)
|
|
# - Interface assignment and IP configuration
|
|
# - Outbound NAT mode (set to Hybrid manually)
|
|
# - Config backup restore
|
|
# - OpenVPN custom options (ncp-disable, tls-cipher, etc.)
|
|
# - CA and client certificates (System → Trust)
|
|
#
|
|
# Firewall design:
|
|
# - LAN: full access
|
|
# - GUEST: DNS to OPNsense, internet only, isolated from other VLANs
|
|
# - IoT: DNS to OPNsense, internet only for hosts in iot_internet_allowed alias
|
|
# - DMZ: DNS to OPNsense, internet access, isolated from LAN/GUEST/IoT
|
|
#
|
|
---
|
|
- name: Configure OPNsense system settings
|
|
ansible.builtin.import_tasks: system.yml
|
|
tags: [opnsense-system]
|
|
|
|
- name: Configure OPNsense interfaces
|
|
ansible.builtin.import_tasks: interfaces.yml
|
|
tags: [opnsense-interfaces]
|
|
|
|
- name: Configure OPNsense default firewall rules
|
|
ansible.builtin.import_tasks: firewall-defaults.yml
|
|
tags: [opnsense-firewall-defaults, opnsense-firewall]
|
|
|
|
- name: Configure OPNsense firewall aliases
|
|
ansible.builtin.import_tasks: firewall-aliases.yml
|
|
tags: [opnsense-aliases, opnsense-firewall]
|
|
|
|
- name: Configure OPNsense firewall rules
|
|
ansible.builtin.import_tasks: firewall-rules.yml
|
|
tags: [opnsense-rules, opnsense-firewall]
|
|
|
|
- name: Configure OPNsense NAT
|
|
ansible.builtin.import_tasks: nat.yml
|
|
tags: [opnsense-nat, opnsense-firewall]
|
|
|
|
- name: Configure OPNsense DHCP
|
|
ansible.builtin.import_tasks: dhcp.yml
|
|
tags: [opnsense-dhcp]
|
|
|
|
- name: Configure OPNsense Unbound DNS
|
|
ansible.builtin.import_tasks: unbound.yml
|
|
tags: [opnsense-unbound, opnsense-dns]
|
|
|
|
- name: Configure OPNsense OpenVPN clients
|
|
ansible.builtin.import_tasks: openvpn-clients.yml
|
|
tags: [opnsense-openvpn]
|
|
|
|
- name: Configure OPNsense WireGuard
|
|
ansible.builtin.import_tasks: wireguard.yml
|
|
tags: [opnsense-wireguard]
|