shorewall
Dubzland: Shorewall
Installs and configures the Shorewall firewall builder.
Requirements
Ansible version 2.0 or higher. Requires the netaddr
python package.
Role Variables
Available variables are listed below, along with their default values (see
defaults/main.yml
for more info):
dubzland_shorewall_conf
dubzland_shorewall_conf:
startup_enabled: "Yes"
verbosity: 1
log_level: '"info"'
log_martians: "Yes"
log_verbosity: 2
log_zone: Both
logfile: /var/log/shorewall
logformat: '"%s(%d) %s "'
Options to be set in /etc/shorewall/shorewall.conf
. Option names can be specified in either upper- or lower-case (they will be written in all caps to the file). See the shorewall.conf man page for more info.
dubzland_shorewall_params
dubzland_shorewall_params: []
List of key-value pairs to be written to /etc/shorewall/params
. For more information on using params, see the params man page.
dubzland_shorewall_zones
dubzland_shorewall_zones:
- name: fw
type: firewall
- name: net
type: ipv4
- name: lan
type: ipv4
Zones to be declared in /etc/shorewall/zones
. See the zones man page for more info.
dubzland_shorewall_interfaces
dubzland_shorewall_interfaces:
- name: eth0
zone: net
options:
- tcpflags
- nosmurfs
- routefilter
- "sourceroute=0"
- name: eth1
zone: lan
options:
- tcpflags
- nosmurfs
- routefilter
List of interfaces shorewall should be configured for in /etc/shorewall/interfaces
. See the interfaces man page for more info.
dubzland_shorewall_hosts
dubzland_shorewall_hosts: []
Specifies hosts routable, but not directly accessible, by the firewall machine.
dubzland_shorewall_policies
dubzland_shorewall_policies:
- source: "$FW"
dest: all
policy: ACCEPT
- source: net
dest: all
policy: REJECT
- source: all
dest: all
policy: REJECT
log_level: info
Policies used by Shorewall to determine the default action to take for a given packet based on its zone traversal. See the policy man page for more info.
dubzland_shorewall_snat
dubzland_shorewall_snat:
- action: MASQUERADE
dest: eth0
Configures SNAT/Masquerading for iptables. Necessary if you want to perform network address translation (NAT) on outbound traffic. See the snat man page for more info.
dubzland_shorewall_rules
dubzland_shorewall_rules:
- section: NEW
rulesets:
- comment: PINGS
rules:
- action: Ping(ACCEPT)
source: all
dest: all
- comment: Web traffic
rules:
- action: Web(ACCEPT)
source: $FW,lan
dest: net
The meat of this role. Configures the rules Shorewall will use to determine how to handle packets traversing its monitored interfaces. See the rules man page for more info.
Dependencies
None.
Example Playbook
Given a machine with 2 nics (eth0
on the internet, eth1
on the LAN):
- hosts: firewall
become: yes
roles:
- role: dubzland-shorewall
vars:
dubzland_shorewall_zones:
- name: fw
type: firewall
- name: net
type: ipv4
- name: lan
type: ipv4
dubzland_shorewall_interfaces:
- name: eth0
zone: net
options:
- tcpflags
- nosmurfs
- routefilter
- "sourceroute=0"
- name: eth1
zone: lan
options:
- tcpflags
- nosmurfs
- routefilter
dubzland_shorewall_policies:
- source: "$FW"
dest: all
policy: ACCEPT
- source: net
dest: all
policy: REJECT
- source: all
dest: all
policy: REJECT
log_level: info
dubzland_shorewall_snat:
- action: MASQUERADE
dest: eth0
dubzland_shorewall_rules:
- section: NEW
rulesets:
- comment: Pings
rules:
- action: Ping(ACCEPT)
source: all
dest: all
- comment: Web Surfing
rules:
- action: Web(ACCEPT)
source: lan
dest: net
- action: ACCEPT
source: lan
dest: net
proto: udp
dest_ports:
- 80
- 443
This would everyone to ping the firewall machine, and LAN clients to ping hosts on the internet. All LAN clients would also be able to browse the web.
License
MIT