T9393: new rolesmain

5 files changed, 182 insertions, 0 deletions

diff --git a/examples/bridge-firewall/group_vars/bridge.yml b/examples/bridge-firewall/group_vars/bridge.yml
new file mode 100644
index 0000000..a72e386
--- /dev/null
+++ b/examples/bridge-firewall/group_vars/bridge.yml
@@ -0,0 +1,85 @@
+---
+# The page's internet uplink is eth0; this example uses eth8 because
+# containerlab reserves eth0 for management. Use eth0 on a real router.
+base_interfaces:
+  - {name: eth8, addresses: [203.0.113.1/24]}
+
+bridge_firewall_bridges:
+  - name: br0
+    description: Isolated L2 bridge
+    members:
+      - {interface: eth1, description: br0}
+      - {interface: eth2, description: br0}
+    prerouting:
+      default_action: drop
+      rules:
+        - {number: 10, description: Accept IPv6 traffic, ethernet_type: ipv6}
+    forward:
+      default_action: accept
+
+  - name: br1
+    description: L3 bridge br1
+    addresses: [10.1.1.1/24]
+    members:
+      - {interface: eth3, description: br1}
+      - {interface: eth4, description: br1}
+    prerouting:
+      default_action: accept
+      rules:
+        - number: 10
+          description: Drop DHCP discover
+          action: drop
+          protocol: udp
+          source: {port: "68"}
+          destination: {port: "67", mac_address: "ff:ff:ff:ff:ff:ff"}
+          log: true
+        - {number: 20, description: Drop IPv6 traffic, action: drop, ethernet_type: ipv6}
+    forward:
+      default_action: drop
+      rules:
+        - {number: 10, description: Accept ARP, ethernet_type: arp}
+        - {number: 20, description: Accept ipv4 from host, source: {address: 10.1.1.102}, state: [new]}
+    ip_forward:
+      rules:
+        - {number: 10, description: br1 - allow internet access, outbound_interface: eth8}
+    router_access: accept
+
+  - name: br2
+    description: L3 bridge br2
+    addresses: [10.2.2.1/24]
+    members:
+      - {interface: eth5, description: br2 - Host}
+      - {interface: eth6, description: br2 - Trusted DHCP Server}
+      - {interface: eth7, description: br2}
+    prerouting:
+      default_action: accept
+      rules:
+        - {number: 10, description: Drop IPv6 traffic, action: drop, ethernet_type: ipv6}
+    forward:
+      default_action: drop
+      rules:
+        - number: 10
+          description: Accept DHCP discover
+          protocol: udp
+          source: {port: "68"}
+          destination: {port: "67", mac_address: "ff:ff:ff:ff:ff:ff"}
+        - number: 20
+          description: Accept DHCP offers from trusted interface
+          protocol: udp
+          source: {port: "67"}
+          destination: {port: "68"}
+          inbound_interface: eth6
+        - number: 22
+          description: Drop all other DHCP offers
+          action: drop
+          protocol: udp
+          source: {port: "67"}
+          destination: {port: "68"}
+          log: true
+        - {number: 30, description: Accept ARP, ethernet_type: arp}
+        - {number: 40, description: Accept ipv4, ethernet_type: ipv4}
+    ip_forward:
+      rules:
+        - {number: 10, description: br2 - allow internet access, outbound_interface: eth8}
+        - {number: 20, description: br2 - allow access to br1, outbound_bridge: br1}
+    router_access: drop
diff --git a/examples/bridge-firewall/inventory.yml b/examples/bridge-firewall/inventory.yml
new file mode 100644
index 0000000..3d882a0
--- /dev/null
+++ b/examples/bridge-firewall/inventory.yml
@@ -0,0 +1,13 @@
+---
+# docs.vyos.io/en/1.5/configexamples/fwall-and-bridge.html
+all:
+  children:
+    bridge:
+      hosts:
+        r1:
+          ansible_host: clab-bridge-firewall-r1   # your router's address
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: admin
+    ansible_password: admin                    # use ansible-vault for real devices
diff --git a/examples/bridge-firewall/site.yml b/examples/bridge-firewall/site.yml
new file mode 100644
index 0000000..c8ac898
--- /dev/null
+++ b/examples/bridge-firewall/site.yml
@@ -0,0 +1,12 @@
+---
+- name: Bridges and firewall
+  hosts: bridge
+  gather_facts: false
+  roles:
+    - vyos.blueprints.base
+    - vyos.blueprints.bridge_firewall
+  post_tasks:
+    - name: Show rendered commands
+      ansible.builtin.debug:
+        var: vyos_blueprints_rendered
+      when: show_rendered | default(false) | bool
diff --git a/examples/bridge-firewall/topology.clab.yml b/examples/bridge-firewall/topology.clab.yml
new file mode 100644
index 0000000..14b9b55
--- /dev/null
+++ b/examples/bridge-firewall/topology.clab.yml
@@ -0,0 +1,63 @@
+name: bridge-firewall
+topology:
+  nodes:
+    r1:
+      kind: vyosnetworks_vyos
+      image: ${VYOS_IMAGE:=vyos:latest}
+    h1:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 192.168.0.1/24 dev eth1
+        - ip -6 addr add fd00:b0::1/64 dev eth1
+    h2:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 192.168.0.2/24 dev eth1
+        - ip -6 addr add fd00:b0::2/64 dev eth1
+    h3:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 10.1.1.102/24 dev eth1
+        - ip route replace default via 10.1.1.1
+    h4:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 10.1.1.103/24 dev eth1
+        - ip route replace default via 10.1.1.1
+    h5:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 10.2.2.5/24 dev eth1
+        - ip route replace default via 10.2.2.1
+    h6:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 10.2.2.6/24 dev eth1
+        - ip route replace default via 10.2.2.1
+    h7:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 10.2.2.7/24 dev eth1
+        - ip route replace default via 10.2.2.1
+    wan:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip addr add 203.0.113.100/24 dev eth1
+        - ip route replace default via 203.0.113.1
+  links:
+    - endpoints: ["r1:eth1", "h1:eth1"]
+    - endpoints: ["r1:eth2", "h2:eth1"]
+    - endpoints: ["r1:eth3", "h3:eth1"]
+    - endpoints: ["r1:eth4", "h4:eth1"]
+    - endpoints: ["r1:eth5", "h5:eth1"]
+    - endpoints: ["r1:eth6", "h6:eth1"]
+    - endpoints: ["r1:eth7", "h7:eth1"]
+    - endpoints: ["r1:eth8", "wan:eth1"]
diff --git a/examples/bridge-firewall/verify.yml b/examples/bridge-firewall/verify.yml
new file mode 100644
index 0000000..1af9772
--- /dev/null
+++ b/examples/bridge-firewall/verify.yml
@@ -0,0 +1,9 @@
+---
+- name: Check the bridges
+  hosts: bridge
+  gather_facts: false
+  tasks:
+    - name: Bridge checks
+      ansible.builtin.include_role:
+        name: vyos.blueprints.bridge_firewall
+        tasks_from: verify