admin_rb
154 lines
5.5 KiB
YAML
154 lines
5.5 KiB
YAML
---
|
|
# Policy-preserving extraction from configure_pfsense_initial.yml. Do not change rule values without separate approval.
|
|
- name: Check current bell state
|
|
ansible.builtin.raw: sysctl -n hw.syscons.bell
|
|
register: bell_state
|
|
changed_when: false
|
|
- name: Disable startup/shutdown beep
|
|
ansible.builtin.raw: sysctl hw.syscons.bell=0
|
|
when: bell_state.stdout.strip() == "1"
|
|
changed_when: true
|
|
- name: Create alias bf_wan_extern
|
|
pfsensible.core.pfsense_alias:
|
|
name: bf_wan_extern
|
|
descr: bitformer WAN IP Adressen
|
|
address: 217.13.70.132 87.138.207.238 80.152.155.27 217.13.174.202
|
|
type: host
|
|
state: present
|
|
- name: Create alias bf_wartung
|
|
pfsensible.core.pfsense_alias:
|
|
name: bf_wartung
|
|
descr: bitformer Wartungs-IP
|
|
address: 10.240.0.1
|
|
type: host
|
|
state: present
|
|
- name: Create alias rfc_1918_5735
|
|
pfsensible.core.pfsense_alias:
|
|
name: rfc_1918_5735
|
|
descr: RFC1918, RFC5735 (private IPs)
|
|
address: 10.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16
|
|
type: network
|
|
state: present
|
|
- name: 'Add NAT outbound traffic rule (Port: 500)'
|
|
pfsensible.core.pfsense_nat_outbound:
|
|
descr: 'Outbound NAT for private IP space (Port: 500)'
|
|
interface: wan
|
|
address: null
|
|
source: rfc_1918_5735
|
|
destination: any:500
|
|
staticnatport: true
|
|
state: present
|
|
- name: Add NAT outbound traffic rule
|
|
pfsensible.core.pfsense_nat_outbound:
|
|
descr: Outbound NAT for private IP space
|
|
interface: wan
|
|
address: null
|
|
source: rfc_1918_5735
|
|
destination: any
|
|
state: present
|
|
- name: 'Add firewall rule: Allow Ping'
|
|
pfsensible.core.pfsense_rule:
|
|
name: Allow Ping
|
|
action: pass
|
|
interface: wan
|
|
ipprotocol: inet
|
|
protocol: icmp
|
|
icmptype: echoreq
|
|
source: any
|
|
destination: IP:wan
|
|
log: true
|
|
state: present
|
|
- name: 'Add firewall rule: Allow Webinterface access'
|
|
pfsensible.core.pfsense_rule:
|
|
name: bitformer Webinterface access rule
|
|
action: pass
|
|
interface: wan
|
|
ipprotocol: inet
|
|
protocol: tcp
|
|
destination_port: 443
|
|
source: bf_wan_extern
|
|
destination: IP:wan
|
|
log: true
|
|
state: present
|
|
- name: Create Anti-Lockout ports alias
|
|
pfsensible.core.pfsense_alias:
|
|
name: anti_lockout_ports
|
|
type: port
|
|
address: 22 80 443
|
|
descr: Ports for Anti-Lockout access
|
|
- name: Add custom Anti-Lockout Rule
|
|
pfsensible.core.pfsense_rule:
|
|
name: Custom Anti-Lockout Rule
|
|
action: pass
|
|
interface: wan
|
|
ipprotocol: inet
|
|
protocol: tcp
|
|
destination_port: anti_lockout_ports
|
|
source: any
|
|
destination: IP:wan
|
|
log: true
|
|
state: present
|
|
- name: Add bitconnect VPN CA 2021
|
|
pfsensible.core.pfsense_ca:
|
|
name: bitconnect VPN CA 2021
|
|
certificate: |
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIFbDCCA1SgAwIBAgIUWV573JfAztSareWb4jnkNIdlEt8wDQYJKoZIhvcNAQEL
|
|
BQAwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMTAeFw0yMTEwMDgx
|
|
NjA1MzNaFw0zMTEwMDYxNjA1MzNaMCExHzAdBgNVBAMMFmJpdGNvbm5lY3QgVlBO
|
|
IENBIDIwMjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDjjoWk81zG
|
|
vmdKCICW27cnQV6kmDwwXezC7cdmk8nVKnlcJAnVPExYV1M1wa9OYDgjb+Jc7vEV
|
|
UKKc7h/JtWt5OSg7aLq5eh6ZZminYG+lrKC7CFhyPnKuLPW4D6ye6iTVpwlhMMbv
|
|
fCiinuA2shniQtX21QYc8jxKdJnmfgv7/JJ0BxnWCyE8yn1xy6DyjPH9ystzKFGO
|
|
C3HH2wH2+sgKuiyk+8yxEF3hktMIDZ/D1gTyw8wsL4PgOs78EBSf0UKjAaBBjem8
|
|
rICxBo4yh7YvVJ+MMLc+2IMcyM3wpYPbMpA/0hXoWsAeYEOvrZR+MYQ08cQw8QEk
|
|
MHetIjbksd9D1OSdMfghr+A+dxVpQWTOnUnG48L84E/6RD0STyz/uJjNDJ5Qn4uV
|
|
8e6ELHbbPiWVQWw+kg8tVetH6+WELXf/7pUnV9uYr7DvijEROP6l1IX/r92qC270
|
|
/QFiadYX0lroqaWdwk5z7DFnVVcCHqchygS97exzDg68LkSJ5pOZ6spIr9WfaGxD
|
|
3dva4ekC/HEZUdau+NnBPnOCLD6EqOnh3RAJosgX6/eb5LHhk5agruM+1PZcWPiL
|
|
5D0HvNjKOCGXW2yVd1fAdOy0onP4OQHK3gJPNFJ9m/LXnn5+CHvYct+3qDlxZcCR
|
|
qH9QBE7kC/8pRmHZqC1g0rn8yiQ012eCpwIDAQABo4GbMIGYMB0GA1UdDgQWBBQ4
|
|
pYw9Df2Ln2pUE/xRDjhebugWpTBcBgNVHSMEVTBTgBQ4pYw9Df2Ln2pUE/xRDjhe
|
|
bugWpaElpCMwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMYIUWV57
|
|
3JfAztSareWb4jnkNIdlEt8wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJ
|
|
KoZIhvcNAQELBQADggIBAN1OOdv5rDgtBhYnmnId4iifvjzKQEQF5go4cJDueUo4
|
|
86u6xJrv83sC53FKxaAcNZUxJEcFFBHKlCUTNADsKDdQxIPA2Ow6goIx914VbFO/
|
|
OmkFWS+53o4V8zRrwTxJi3Ps0R3sgp3pok5fQNL30tMZIf1Ug05jOqSCT8GBzIS8
|
|
wwSw6aNi/Zcs9sBuaEEap47faTowk53EJykUd8htzH/3E5ioi3hE8TsZYPKb4Frk
|
|
mMqRbX6N78fZ0xOIewh58S4eeGlRCGlRs45ciVxuryTaloFfDDBFFBR3V4q4Y/y9
|
|
dvjiRmDs4fod1ZGEFUfVyDPXjzWCUUQiMHxUoh9s06i5zO3YCB/mkh+11ohyE109
|
|
ciN495vhpTONQ8GzXLc87GjVUow7btn3lfaMf1sTfLhAueHNNbDHTnhRFkUtrdCx
|
|
73+MYpiSlLpBxnyLkTM4umYXeYNN5Od0UjYZZqlLK9MNZrM5CwVxjRxJjgV6Nbap
|
|
4Apnfqi+d3Ulnc6Zk8w0tiVcRfrLR6EVA3JEHqFQLuXbU1+K8C0N9YNFHy2iGAxF
|
|
Ysx7aJVvmzyoiB06/qQrHcjeizVJaqR7w6+1cuTKo+fdvp2KtyK8+pFtQt4n+unw
|
|
3eLC1NdcEyWBtlKqG6sjSXCBCgc1z2wAOfR+sQsH64uVHqxND4rPo8X4uo28Jgv9
|
|
-----END CERTIFICATE-----
|
|
state: present
|
|
- name: Add bitconnect VPN-Client
|
|
pfsensible.core.pfsense_openvpn_client:
|
|
name: bitformer Wartungs-VPN
|
|
ca: bitconnect VPN CA 2021
|
|
cert: bf-customers-vpn01
|
|
create_gw: both
|
|
data_ciphers:
|
|
- AES-256-GCM
|
|
- AES-256-CBC
|
|
- AES-128-GCM
|
|
- CHACHA20-POLY1305
|
|
data_ciphers_fallback: AES-256-CBC
|
|
dev_mode: tun
|
|
digest: SHA384
|
|
interface: any
|
|
mode: p2p_tls
|
|
protocol: UDP4
|
|
server_addr: vpngw01.bitformer.net
|
|
server_port: 42030
|
|
state: present
|
|
- name: Print left over manual settings to configure
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- 'Manuelle Einstellungen müssen vorgenommen werden:'
|
|
- 'Firewall Max Table Entries: 500000'
|
|
- Disable startup/shutdown beep
|
|
- Password protect the console
|