Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2.0.1 tunnels #2

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

2.0.1 tunnels #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ecd6b49
Rename macros.j2 to allow that name to be used for shorewall macros.
rivimey Oct 16, 2020
f3b50c3
Initial implementation shorewall macro generation
rivimey Oct 16, 2020
0e939d4
Implementation of shorewall tunnels file
rivimey Oct 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,41 @@ dubzland_shorewall_conf:

dubzland_shorewall_params: []

dubzland_shorewall_tunnels: []
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here. Need something in the README.

# - type: openvpnserver:1194
# zone: net
# gateway: 0.0.0.0/0
# gwzone: vpn

dubzland_shorewall_macros:
# The name: key is limited to alphanumeric characters (shorewall
# syntax).
#
# - name: Bareos
# desc: Bareos File Backup/Restore service
# actions:
# - action: PARAM
# proto: tcp
# dest_ports: "9101:9103"
# source_ports: "-"
#
# SIP - VoIP Macro specifying the minimal options
- name: SIP
desc: SIP / Voice over IP
rules:
- proto: tcp
dest_ports: 5060,5065
- proto: udp
dest_ports: 5060,5065
- proto: tcp
dest_ports: 10000:10100
- proto: udp
dest_ports: 10000:10100
- proto: tcp
dest_ports: 5004:5020
- proto: udp
dest_ports: 5004:5020

dubzland_shorewall_zones:
- name: fw
type: firewall
Expand Down
19 changes: 19 additions & 0 deletions macro.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# {{ ansible_managed }}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall 5 - {{ item.desc | default(item.name) }}
#
# /etc/shorewall/macro.{{ item.name }}
#
# For information about entries in this file see https://shorewall.org/Macros.html
#
#######################################################################################################
# DO NOT REMOVE THE FOLLOWING LINE
##############################################################################################################################################################
#ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK CONNLIMIT TIME HEADERS SWITCH HELPER

{% for rule in item.rules %}
{{ _tpl.print_macro(_rule) }}
{% endfor %}

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
17 changes: 16 additions & 1 deletion tasks/configuration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,18 @@
- name: ensure shorewall is configured
- name: Write shorewall macro files
template:
src: "etc/shorewall/macro.j2"
dest: "{{ dubzland_shorewall_configuration_root }}/macro.{{ item.name }}"
owner: root
group: root
mode: 0644
with_items:
- "{{ dubzland_shorewall_macros }}"
notify:
- restart shorewall
tags:
- shorewall

- name: Write shorewall configuration files.
template:
src: "etc/shorewall/{{ item }}.j2"
dest: "{{ dubzland_shorewall_configuration_root }}/{{ item }}"
Expand All @@ -13,6 +27,7 @@
- rules
- shorewall.conf
- snat
- tunnels
- zones
notify:
- restart shorewall
Expand Down
2 changes: 1 addition & 1 deletion templates/etc/shorewall/hosts.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# {{ ansible_managed }}
{% import 'macros.j2' as _tpl with context %}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall -- /etc/shorewall/hosts
#
Expand Down
2 changes: 1 addition & 1 deletion templates/etc/shorewall/interfaces.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# {{ ansible_managed }}
{% import 'macros.j2' as _tpl with context %}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall -- /etc/shorewall/interfaces
#
Expand Down
60 changes: 60 additions & 0 deletions templates/etc/shorewall/macros.j2 → templates/etc/shorewall/j2macros.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,19 @@
{% set _ = _fields.append({ "format": "\t%s", "value": _policy.connlimit | default(None) }) %}
{{ print_fields(_fields) }}
{%- endmacro %}
{##############################################################################
#
# MACRO :: print_tunnel()
#
#############################################################################}
{% macro print_tunnel(_tunnel) -%}
{% set _fields = [] %}
{% set _ = _fields.append({ "format": "%-5s", "value": _policy.type | default(None) }) %}
{% set _ = _fields.append({ "format": "\t\t%-5s", "value": _policy.zone | default(None) }) %}
{% set _ = _fields.append({ "format": "\t\t%-6s", "value": _policy.gateway | default(None) }) %}
{% set _ = _fields.append({ "format": "\t%-8s", "value": _policy.gwzone | default(None) }) %}
{{ print_fields(_fields) }}
{%- endmacro %}
{##############################################################################
#
# MACRO :: print_rule()
Expand Down Expand Up @@ -84,6 +97,53 @@
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.helper | default(None) }) %}
{{ print_fields(_fields) }}
{%- endmacro %}
{##############################################################################
#
# MACRO :: print_macro()
#
#############################################################################}
{% macro print_macro(_rule) -%}
{% if _rule.comment is defined and _rule.comment %}
# {{ _rule.comment }}
{% endif %}
{% set _fields = [] %}
{% if _rule.action is not defined or _rule.action == "-" %}
{% set _ = _fields.append({ "format": "%-12s", "value": "PARAM" }) %}
{% else %}
{% set _ = _fields.append({ "format": "%-12s", "value": _rule.action }) %}
{% endif %}
{% set _ = _fields.append({ "format": "\t%-12s", "value": _rule.source | default(None) }) %}
{% set _ = _fields.append({ "format": "\t%-12s", "value": _rule.dest | default(None) }) %}
{% set _ = _fields.append({ "format": "\t%-5s", "value": _rule.proto | default(None) }) %}
{% if _rule.dest_ports is defined and _rule.dest_ports %}
{% set _ = _fields.append({ "format": "\t%-5s", "value": _rule.dest_ports | join(",") }) %}
{% else %}
{% set _ = _fields.append({ "format": "\t%-5s", "value": None }) %}
{% endif %}
{% if _rule.source_ports is defined and _rule.source_ports %}
{% set _ = _fields.append({ "format": "\t%-5s", "value": _rule.source_ports | join(",") }) %}
{% else %}
{% set _ = _fields.append({ "format": "\t%-5s", "value": None }) %}
{% endif %}
{% set _ = _fields.append({ "format": "\t%-12s", "value": _rule.origdest | default(None) }) %}
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.rate | default(None) }) %}
{% if _rule.users is defined and _rule.users %}
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.users | join(",") }) %}
{% else %}
{% set _ = _fields.append({ "format": "\t%s", "value": None }) %}
{% endif %}
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.mark | default(None) }) %}
{% set _ = _fields.append({ "format": "\t%-9s", "value": _rule.connlimit | default(None) }) %}
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.time | default(None) }) %}
{% if _rule.headers is defined and _rule.headers %}
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.headers | join(",") }) %}
{% else %}
{% set _ = _fields.append({ "format": "\t%s", "value": None }) %}
{% endif %}
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.switch | default(None) }) %}
{% set _ = _fields.append({ "format": "\t%s", "value": _rule.helper | default(None) }) %}
{{ print_fields(_fields) }}
{%- endmacro %}
{##############################################################################
#
# MACRO :: print_ruleset()
Expand Down
19 changes: 19 additions & 0 deletions templates/etc/shorewall/macro.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# {{ ansible_managed }}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall 5 - {{ item.desc | default(item.name) }}
#
# /etc/shorewall/macro.{{ item.name }}
#
# For information about entries in this file see https://shorewall.org/Macros.html
#
#######################################################################################################
# DO NOT REMOVE THE FOLLOWING LINE
##############################################################################################################################################################
#ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK CONNLIMIT TIME HEADERS SWITCH HELPER

{% for _rule in item.rules %}
{{ _tpl.print_macro(_rule) }}
{% endfor %}

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
2 changes: 1 addition & 1 deletion templates/etc/shorewall/policy.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# {{ ansible_managed }}
{% import 'macros.j2' as _tpl with context %}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall -- /etc/shorewall/policy
#
Expand Down
2 changes: 1 addition & 1 deletion templates/etc/shorewall/rules.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# {{ ansible_managed }}
{% import 'macros.j2' as _tpl with context %}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall -- /etc/shorewall/rules
#
Expand Down
2 changes: 1 addition & 1 deletion templates/etc/shorewall/snat.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# {{ ansible_managed }}
{% import 'macros.j2' as _tpl with context %}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall -- /etc/shorewall/snat
#
Expand Down
15 changes: 15 additions & 0 deletions templates/etc/shorewall/tunnels.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# {{ ansible_managed }}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall -- /etc/shorewall/snat
#
# For information about entries in this file, type "man shorewall-snat"
#
# See http://shorewall.net/manpages/shorewall-snat.html for more information
#
###########################################################################################################################################
#TYPE ZONE GATEWAY GATEWAY
# ZONE
{% for _rule in dubzland_shorewall_tunnels -%}
{{ _tpl.print_tunnel(_rule) }}
{%- endfor %}
2 changes: 1 addition & 1 deletion templates/etc/shorewall/zones.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# {{ ansible_managed }}
{% import 'macros.j2' as _tpl with context %}
{% import 'j2macros.j2' as _tpl with context %}
#
# Shorewall -- /etc/shorewall/zones
#
Expand Down