Changeset 3694 in MondoRescue for branches/3.3/ansible/roles/shorewall

Timestamp:

Oct 12, 2017, 12:57:53 AM (8 years ago)

Author:

Bruno Cornec

Message:

Adds docker fw configuration for MR machine

Location:

branches/3.3/ansible/roles/shorewall

Files:

• defaults/main.yml (modified) (5 diffs)
• tasks/main.yml (modified) (1 diff)
• templates/masq.j2 (added)

branches/3.3/ansible/roles/shorewall/defaults/main.yml

@@ -7 +7 @@
 - zone: "net"
   type: "ipv4"
+- zone: "dock"
+  type: "ipv4"
 
 shorewall_interfaces: 
@@ -13 +15 @@
   broadcast: "detect"
   options: "dhcp,tcpflags,nosmurfs,logmartians"
+- interface: "docker0"
+  zone: "dock"
+  broadcast: "detect"
+  #options: "dhcp,tcpflags,nosmurfs,logmartians"
 
 shorewall_policies:
@@ -26 +32 @@
   policy: "REJECT"
   log_level: "info"
+shorewall_masq:
+- interface: "enp2s0f0"
+  source: "172.17.0.0/16"
 
 shorewall_rules:
@@ -56 +65 @@
   - { action: ACCEPT, source: fw, destination: "net:{{ dns1 }}", protocol: tcp, destination_port: 53 }
   - { action: ACCEPT, source: fw, destination: "net:{{ dns2 }}", protocol: tcp, destination_port: 53 }
+  - { action: ACCEPT, source: dock, destination: "net:{{ dns1 }}", protocol: udp, destination_port: 53 }
+  - { action: ACCEPT, source: dock, destination: "net:{{ dns2 }}", protocol: udp, destination_port: 53 }
+  - { action: ACCEPT, source: dock, destination: "net:{{ dns1 }}", protocol: tcp, destination_port: 53 }
+  - { action: ACCEPT, source: dock, destination: "net:{{ dns2 }}", protocol: tcp, destination_port: 53 }
   # Outgoing HTTP/S
   - { action: ACCEPT, source: fw, destination: net, protocol: tcp, destination_port: 80 }
   - { action: ACCEPT, source: fw, destination: net, protocol: tcp, destination_port: 443}
+  - { action: ACCEPT, source: dock, destination: net, protocol: tcp, destination_port: 80 }
+  - { action: ACCEPT, source: dock, destination: net, protocol: tcp, destination_port: 443}
   # Outgoing SPAM
   - { action: ACCEPT, source: fw, destination: net, protocol: tcp, destination_port: 9999 }
@@ -67 +82 @@
   # Outgoing PING
   - { action: ACCEPT, source: fw, destination: net, protocol: icmp, destination_port: 8 }
+  - { action: ACCEPT, source: dock, destination: net, protocol: icmp, destination_port: 8 }

branches/3.3/ansible/roles/shorewall/tasks/main.yml

@@ -13 +13 @@
   template: src=policy.j2 dest=/etc/shorewall/policy owner=root group=root mode=0600 backup=yes
 
+- name: Generate masq
+  template: src=masq.j2 dest=/etc/shorewall/masq owner=root group=root mode=0600 backup=yes
+  
 - name: Generate rules
   template: src=rules.j2 dest=/etc/shorewall/rules owner=root group=root mode=0600 backup=yes