504 lines
11 KiB
YAML
504 lines
11 KiB
YAML
#########################
|
|
#
|
|
# inetRouter
|
|
#
|
|
#########################
|
|
|
|
- hosts: inetRouter
|
|
become: true
|
|
tasks:
|
|
|
|
- name: update
|
|
apt:
|
|
update_cache: yes
|
|
|
|
- name: install iptables-persistent
|
|
apt:
|
|
name: iptables-persistent
|
|
state: present
|
|
|
|
- name: enable forwarding
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: '1'
|
|
sysctl_set: yes
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: add route all office netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.1/30'
|
|
block: |2
|
|
routes:
|
|
- to: 192.168.0.0/16
|
|
via: 192.168.255.2
|
|
state: present
|
|
marker: "# {mark} ROUTE ALL OFFICE BLOCK"
|
|
notify: apply netplan
|
|
|
|
- name: remove all rules NAT
|
|
iptables:
|
|
table: nat
|
|
flush: true
|
|
|
|
- name: add nat rule
|
|
iptables:
|
|
table: nat
|
|
chain: POSTROUTING
|
|
out_interface: enp0s3
|
|
destination: '! 192.168.0.0/16'
|
|
jump: MASQUERADE
|
|
state: present
|
|
|
|
- name: accept established, related
|
|
iptables:
|
|
chain: INPUT
|
|
ctstate: ESTABLISHED,RELATED
|
|
jump: ACCEPT
|
|
|
|
- name: accept in loopbakc
|
|
iptables:
|
|
chain: INPUT
|
|
in_interface: lo
|
|
jump: ACCEPT
|
|
|
|
- name: accept icmp
|
|
iptables:
|
|
chain: INPUT
|
|
protocol: icmp
|
|
jump: ACCEPT
|
|
|
|
- name: accept ssh vagrant
|
|
iptables:
|
|
chain: INPUT
|
|
in_interface: enp0s3
|
|
protocol: tcp
|
|
destination_port: 22
|
|
jump: ACCEPT
|
|
|
|
- name: port knocking from centralRouter
|
|
shell: |
|
|
iptables -A INPUT -s 192.168.255.2 -p tcp --dport 2222 -m recent --name CONNECT_1 --set -j DROP
|
|
iptables -A INPUT -s 192.168.255.2 -p tcp --dport 222 -m recent --rcheck --seconds 30 --name CONNECT_1 -m recent --set --name CONNECT_2 -j DROP
|
|
iptables -A INPUT -s 192.168.255.2 -p tcp --dport 22 -m recent --rcheck --seconds 30 --name CONNECT_2 -j ACCEPT
|
|
|
|
- name: enable policy drop INPUT
|
|
iptables:
|
|
chain: INPUT
|
|
policy: DROP
|
|
|
|
- name: save iptables rules
|
|
shell:
|
|
cmd: iptables-save > /etc/iptables/rules.v4
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
|
|
#########################
|
|
#
|
|
# inetRouter2
|
|
#
|
|
#########################
|
|
|
|
- hosts: inetRouter2
|
|
become: true
|
|
tasks:
|
|
|
|
- name: update
|
|
apt:
|
|
update_cache: yes
|
|
|
|
- name: install iptables-persistent
|
|
apt:
|
|
name: iptables-persistent
|
|
state: present
|
|
|
|
|
|
- name: enable forwarding
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: '1'
|
|
sysctl_set: yes
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: add route all office netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.13/30'
|
|
block: |2
|
|
routes:
|
|
- to: 192.168.0.0/16
|
|
via: 192.168.255.14
|
|
state: present
|
|
marker: "# {mark} ROUTE ALL OFFICE BLOCK"
|
|
notify: apply netplan
|
|
|
|
- name: remove all rules NAT
|
|
iptables:
|
|
table: nat
|
|
flush: true
|
|
|
|
- name: add out all nat rule
|
|
iptables:
|
|
table: nat
|
|
chain: POSTROUTING
|
|
out_interface: enp0s3
|
|
destination: '! 192.168.0.0/16'
|
|
jump: MASQUERADE
|
|
state: present
|
|
|
|
- name: add DNAT http to centralServer
|
|
iptables:
|
|
table: nat
|
|
chain: PREROUTING
|
|
in_interface: enp0s3
|
|
protocol: tcp
|
|
destination_port: 80
|
|
jump: DNAT
|
|
to_destination: 192.168.0.2:80
|
|
|
|
- name: get int name to link centralRouter
|
|
shell: ip -o addr show to 192.168.255.13 | awk '{print $2}'
|
|
register: int_name_link_centralRouter
|
|
|
|
- name: save iptables rules
|
|
shell:
|
|
cmd: iptables-save > /etc/iptables/rules.v4
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
|
|
#########################
|
|
#
|
|
# centralRouter
|
|
#
|
|
#########################
|
|
|
|
- hosts: centralRouter
|
|
become: true
|
|
tasks:
|
|
|
|
- name: update
|
|
apt:
|
|
update_cache: yes
|
|
|
|
- name: install iptables-persistent
|
|
apt:
|
|
name: iptables-persistent
|
|
state: present
|
|
|
|
|
|
- name: enable forwarding
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: '1'
|
|
sysctl_set: yes
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: add default gateway netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.2/30'
|
|
block: |2
|
|
routes:
|
|
- to: default
|
|
via: 192.168.255.1
|
|
state: present
|
|
marker: "# {mark} DEFAULT GATEWAY BLOCK"
|
|
notify: apply netplan
|
|
|
|
- name: add rule route to inetRouter2 netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.14/30'
|
|
block: |2
|
|
routes:
|
|
- to: 0.0.0.0/0
|
|
via: 192.168.255.13
|
|
table: 2
|
|
routing-policy:
|
|
- from: 0.0.0.0/0
|
|
mark: 2
|
|
table: 2
|
|
state: present
|
|
marker: "# {mark} ROUTE RULE inetRouter2"
|
|
notify: apply netplan
|
|
|
|
|
|
- name: add routes office 1 netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.5/30'
|
|
block: |2
|
|
routes:
|
|
- to: 192.168.2.0/24
|
|
via: 192.168.255.6
|
|
state: present
|
|
marker: "# {mark} ROUTE OFFICE 1 BLOCK"
|
|
notify: apply netplan
|
|
|
|
|
|
- name: add routes office 2 netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.9/30'
|
|
block: |2
|
|
routes:
|
|
- to: 192.168.1.0/24
|
|
via: 192.168.255.10
|
|
state: present
|
|
marker: "# {mark} ROUTE OFFICE 2 BLOCK"
|
|
notify: apply netplan
|
|
|
|
|
|
- name: get int name to link inetRouter2
|
|
shell: ip -o addr show to 192.168.255.14 | awk '{print $2}'
|
|
register: int_name_link_inetRouter2
|
|
|
|
- name: mark in inetRouter2, and restore mark
|
|
shell: |
|
|
iptables -t mangle -I PREROUTING -i {{ int_name_link_inetRouter2.stdout }} -j CONNMARK --set-mark 2
|
|
iptables -t mangle -I PREROUTING -s 192.168.0.2 -j CONNMARK --restore-mark
|
|
|
|
- name: save iptables rules
|
|
shell:
|
|
cmd: iptables-save > /etc/iptables/rules.v4
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
#########################
|
|
#
|
|
# centralServer
|
|
#
|
|
#########################
|
|
|
|
- hosts: centralServer
|
|
become: true
|
|
tasks:
|
|
|
|
- name: update
|
|
apt:
|
|
update_cache: yes
|
|
|
|
- name: install iptables-persistent
|
|
apt:
|
|
name: iptables-persistent
|
|
state: present
|
|
|
|
- name: install nginx
|
|
apt:
|
|
name: nginx
|
|
state: present
|
|
|
|
- name: add default gateway netplan and rule routes
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.0.2/28'
|
|
block: |2
|
|
routes:
|
|
- to: default
|
|
via: 192.168.0.1
|
|
|
|
- to: 0.0.0.0/0
|
|
via: 192.168.0.1
|
|
table: 2
|
|
|
|
routing-policy:
|
|
- from: 0.0.0.0/0
|
|
mark: 2
|
|
table: 2
|
|
state: present
|
|
marker: "# {mark} DEFAULT GATEWAY BLOCK"
|
|
notify: apply netplan
|
|
|
|
- name: get int name to link centralRouter
|
|
shell: ip -o addr show to 192.168.0.2 | awk '{print $2}'
|
|
register: int_name_link_centralRouter
|
|
|
|
- name: mark in centralRouter, and restore mark
|
|
shell: |
|
|
iptables -t mangle -I INPUT -i {{ int_name_link_centralRouter.stdout }} -j CONNMARK --set-mark 2
|
|
iptables -t mangle -I OUTPUT -j CONNMARK --restore-mark
|
|
|
|
- name: save iptables rules
|
|
shell:
|
|
cmd: iptables-save > /etc/iptables/rules.v4
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
|
|
#########################
|
|
#
|
|
# office1Router
|
|
#
|
|
#########################
|
|
|
|
- hosts: office1Router
|
|
become: true
|
|
tasks:
|
|
|
|
- name: enable forwarding
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: '1'
|
|
sysctl_set: yes
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: add default gateway netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.6/30'
|
|
block: |2
|
|
routes:
|
|
- to: default
|
|
via: 192.168.255.5
|
|
state: present
|
|
marker: "# {mark} DEFAULT GATEWAY BLOCK"
|
|
notify: apply netplan
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
#########################
|
|
#
|
|
# office1Server
|
|
#
|
|
#########################
|
|
|
|
- hosts: office1Server
|
|
become: true
|
|
tasks:
|
|
|
|
- name: add default gateway netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.2.2/26'
|
|
block: |2
|
|
routes:
|
|
- to: default
|
|
via: 192.168.2.1
|
|
state: present
|
|
marker: "# {mark} DEFAULT GATEWAY BLOCK"
|
|
notify: apply netplan
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
#########################
|
|
#
|
|
# office2Router
|
|
#
|
|
#########################
|
|
|
|
- hosts: office2Router
|
|
become: true
|
|
tasks:
|
|
|
|
- name: enable forwarding
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: '1'
|
|
sysctl_set: yes
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: add default gateway netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.255.10/30'
|
|
block: |2
|
|
routes:
|
|
- to: default
|
|
via: 192.168.255.9
|
|
state: present
|
|
marker: "# {mark} DEFAULT GATEWAY BLOCK"
|
|
notify: apply netplan
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
|
|
#########################
|
|
#
|
|
# office2Server
|
|
#
|
|
#########################
|
|
|
|
- hosts: office2Server
|
|
become: true
|
|
tasks:
|
|
|
|
- name: add default gateway netplan
|
|
blockinfile:
|
|
path: /etc/netplan/50-vagrant.yaml
|
|
insertafter: ' - 192.168.1.2/25'
|
|
block: |2
|
|
routes:
|
|
- to: default
|
|
via: 192.168.1.1
|
|
state: present
|
|
marker: "# {mark} DEFAULT GATEWAY BLOCK"
|
|
notify: apply netplan
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
|
|
#########################
|
|
#
|
|
# All host
|
|
#
|
|
#########################
|
|
- hosts: all
|
|
become: true
|
|
tasks:
|
|
|
|
- name: change enp0s3 conf, disable default route
|
|
copy:
|
|
dest: /etc/netplan/50-cloud-init.yaml
|
|
content: |
|
|
network:
|
|
ethernets:
|
|
enp0s3:
|
|
dhcp4: true
|
|
dhcp4-overrides:
|
|
use-routes: false
|
|
version: 2
|
|
force: yes
|
|
when:
|
|
- ansible_hostname != 'inetRouter'
|
|
- ansible_hostname != 'inetRouter2'
|
|
notify: apply netplan
|
|
|
|
handlers:
|
|
- name: apply netplan
|
|
command:
|
|
cmd: netplan apply
|
|
when:
|
|
- ansible_hostname != 'inetRouter'
|
|
- ansible_hostname != 'inetRouter2'
|
|
|