diff options
Diffstat (limited to 'roles/firewall')
| -rw-r--r-- | roles/firewall/defaults/main.yml | 4 | ||||
| -rw-r--r-- | roles/firewall/meta/argument_specs.yml | 77 | ||||
| -rw-r--r-- | roles/firewall/meta/main.yml | 11 | ||||
| -rw-r--r-- | roles/firewall/tasks/main.yml | 22 | ||||
| -rw-r--r-- | roles/firewall/tasks/verify.yml | 23 | ||||
| -rw-r--r-- | roles/firewall/templates/groups.yml.j2 | 42 | ||||
| -rw-r--r-- | roles/firewall/templates/rules.yml.j2 | 17 | ||||
| -rw-r--r-- | roles/firewall/vars/main.yml | 3 |
8 files changed, 199 insertions, 0 deletions
diff --git a/roles/firewall/defaults/main.yml b/roles/firewall/defaults/main.yml new file mode 100644 index 0000000..d5bec3f --- /dev/null +++ b/roles/firewall/defaults/main.yml @@ -0,0 +1,4 @@ +--- +firewall_groups: {} +firewall_ipv4: {} +firewall_ipv6: {} diff --git a/roles/firewall/meta/argument_specs.yml b/roles/firewall/meta/argument_specs.yml new file mode 100644 index 0000000..d25fe5d --- /dev/null +++ b/roles/firewall/meta/argument_specs.yml @@ -0,0 +1,77 @@ +--- +argument_specs: + main: + short_description: Firewall groups and base-chain filters + description: + - Configures firewall network, address and port groups and the + C(input), C(forward) and C(output) filters for IPv4 and IPv6. + - Building block used by blueprints such as "Policy-Based Site-to-Site + VPN and Firewall Configuration"; for zone-based designs use + C(vyos.blueprints.zone_firewall). + - Rules use the rule format of vyos.vyos.vyos_firewall_rules (number, + action, description, protocol, state, source, destination, + inbound_interface, outbound_interface, log, ...), passed through unchanged. + - B(Lockout risk) - a C(drop) input filter must allow the address or + interface you manage the router from. + options: + firewall_groups: + type: dict + default: {} + description: Firewall groups. + options: + network: + type: list + elements: dict + default: [] + description: IPv4 network groups. + options: + name: {type: str, required: true, description: Group name.} + description: {type: str, description: Group description.} + networks: {type: list, elements: str, required: true, description: Member networks.} + address: + type: list + elements: dict + default: [] + description: IPv4 address groups. + options: + name: {type: str, required: true, description: Group name.} + description: {type: str, description: Group description.} + addresses: {type: list, elements: str, required: true, description: Member addresses or ranges.} + port: + type: list + elements: dict + default: [] + description: Port groups. + options: + name: {type: str, required: true, description: Group name.} + description: {type: str, description: Group description.} + ports: {type: list, elements: str, required: true, description: Member ports or ranges.} + firewall_ipv4: + type: dict + default: {} + description: IPv4 filters keyed by base chain (C(input), C(forward), C(output)). + options: &filters + input: &filter + type: dict + description: Filter for this chain. + options: + default_action: {type: str, choices: [accept, drop, reject], description: Default action.} + default_log: {type: bool, default: false, description: Log packets hitting the default action.} + rules: {type: list, elements: dict, default: [], description: Rules in vyos_firewall_rules format.} + forward: *filter + output: *filter + firewall_ipv6: + type: dict + default: {} + description: IPv6 filters keyed by base chain. + options: *filters + vyos_blueprints_render_only: + type: bool + default: false + description: Collect commands into C(vyos_blueprints_rendered) instead of configuring. + verify: + short_description: Post-deployment checks for the firewall role + description: Run with C(tasks_from=verify). Checks every configured filter is active with its rules. + options: + firewall_ipv4: {type: dict, default: {}, description: Same value as for C(main).} + firewall_ipv6: {type: dict, default: {}, description: Same value as for C(main).} diff --git a/roles/firewall/meta/main.yml b/roles/firewall/meta/main.yml new file mode 100644 index 0000000..8c38572 --- /dev/null +++ b/roles/firewall/meta/main.yml @@ -0,0 +1,11 @@ +--- +galaxy_info: + author: VyOS maintainers and contributors + description: Stateful firewall - groups and IPv4/IPv6 input, forward and output filters + license: GPL-3.0-or-later + min_ansible_version: "2.16" + platforms: + - name: GenericLinux + versions: [all] + galaxy_tags: [vyos, networking, firewall] +dependencies: [] diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml new file mode 100644 index 0000000..fe99b15 --- /dev/null +++ b/roles/firewall/tasks/main.yml @@ -0,0 +1,22 @@ +--- +- name: Create firewall groups + vyos.vyos.vyos_firewall_global: + config: "{{ lookup('ansible.builtin.template', 'groups.yml.j2') | from_yaml }}" + state: "{{ _firewall_state }}" + register: _firewall_r_groups + when: firewall_groups | dict2items | map(attribute='value') | select | list | length > 0 + +- name: Configure the input, forward and output filters + vyos.vyos.vyos_firewall_rules: + config: "{{ lookup('ansible.builtin.template', 'rules.yml.j2') | from_yaml }}" + state: "{{ _firewall_state }}" + register: _firewall_r_rules + when: (firewall_ipv4 | length > 0) or (firewall_ipv6 | length > 0) + +- name: Collect rendered commands # noqa: var-naming[no-role-prefix] - shared across roles by design + ansible.builtin.set_fact: + vyos_blueprints_rendered: >- + {{ vyos_blueprints_rendered | default([]) + + ([_firewall_r_groups, _firewall_r_rules] + | selectattr('rendered', 'defined') | map(attribute='rendered') | flatten) }} + when: vyos_blueprints_render_only | default(false) | bool diff --git a/roles/firewall/tasks/verify.yml b/roles/firewall/tasks/verify.yml new file mode 100644 index 0000000..c2e3281 --- /dev/null +++ b/roles/firewall/tasks/verify.yml @@ -0,0 +1,23 @@ +--- +- name: Read the firewall + vyos.vyos.vyos_command: + commands: + - show firewall + register: _firewall_v + +- name: Every configured filter is active with its rules + ansible.builtin.assert: + that: >- + _firewall_v.stdout[0] is search((item.afi | upper | replace('V', 'v')) ~ ' Firewall "' ~ item.chain ~ ' filter"') + fail_msg: "{{ item.afi }} {{ item.chain }} filter is not active" + quiet: true + loop: >- + {%- set out = [] -%} + {%- for afi, filters in [('ipv4', firewall_ipv4), ('ipv6', firewall_ipv6)] -%} + {%- for chain in ['input', 'forward', 'output'] if filters[chain] is defined and filters[chain] -%} + {%- set _ = out.append({'afi': afi, 'chain': chain}) -%} + {%- endfor -%} + {%- endfor -%} + {{ out }} + loop_control: + label: "{{ item.afi }} {{ item.chain }}" diff --git a/roles/firewall/templates/groups.yml.j2 b/roles/firewall/templates/groups.yml.j2 new file mode 100644 index 0000000..5641e2a --- /dev/null +++ b/roles/firewall/templates/groups.yml.j2 @@ -0,0 +1,42 @@ +group: +{% if firewall_groups.network | default([]) %} + network_group: +{% for g in firewall_groups.network %} + - name: {{ g.name | to_json }} + afi: ipv4 +{% if g.description is defined %} + description: {{ g.description | to_json }} +{% endif %} + members: +{% for n in g.networks %} + - address: {{ n | to_json }} +{% endfor %} +{% endfor %} +{% endif %} +{% if firewall_groups.address | default([]) %} + address_group: +{% for g in firewall_groups.address %} + - name: {{ g.name | to_json }} + afi: ipv4 +{% if g.description is defined %} + description: {{ g.description | to_json }} +{% endif %} + members: +{% for a in g.addresses %} + - address: {{ a | to_json }} +{% endfor %} +{% endfor %} +{% endif %} +{% if firewall_groups.port | default([]) %} + port_group: +{% for g in firewall_groups.port %} + - name: {{ g.name | to_json }} +{% if g.description is defined %} + description: {{ g.description | to_json }} +{% endif %} + members: +{% for p in g.ports %} + - port: {{ p | string | to_json }} +{% endfor %} +{% endfor %} +{% endif %} diff --git a/roles/firewall/templates/rules.yml.j2 b/roles/firewall/templates/rules.yml.j2 new file mode 100644 index 0000000..f746c84 --- /dev/null +++ b/roles/firewall/templates/rules.yml.j2 @@ -0,0 +1,17 @@ +{% for afi, filters in [('ipv4', firewall_ipv4), ('ipv6', firewall_ipv6)] if filters %} +- afi: {{ afi }} + rule_sets: +{% for chain in _firewall_filters if filters[chain] is defined and filters[chain] %} +{% set f = filters[chain] %} + - filter: {{ chain }} +{% if f.default_action is defined %} + default_action: {{ f.default_action }} +{% endif %} +{% if f.default_log | default(false) | bool %} + enable_default_log: true +{% endif %} +{% if f.rules | default([]) %} + rules: {{ f.rules | to_json }} +{% endif %} +{% endfor %} +{% endfor %} diff --git a/roles/firewall/vars/main.yml b/roles/firewall/vars/main.yml new file mode 100644 index 0000000..eebd515 --- /dev/null +++ b/roles/firewall/vars/main.yml @@ -0,0 +1,3 @@ +--- +_firewall_state: "{{ 'rendered' if (vyos_blueprints_render_only | default(false) | bool) else 'merged' }}" +_firewall_filters: [input, forward, output] |