Ansible Role: firewall

Ansible role to setup persistent ingress firewall based on iptables with fail2ban. By design it will open communication:

• on loopback interface
• on port 22 (SSH)
• for NTP
• for DNS

⚠️ IMPORTANT NOTICE

THIS PROJECT IS ABANDONED. WE DO NOT ACCEPT ANY NEW ISSUES AND/OR PULL REQUESTS.

Requirements

python-netaddr package installed on deployer host is required to run this role.

Example usage

Use it in a playbook as follows:

- hosts: all
  become: true
  roles:
    - SoInteractive.firewall

Little more advanced usage (enable traffic on port 80 only for 10.0.0.0/8 subnet and 443 for everyone)

- hosts: webserver
  become: true
  roles:
    - firewall
  vars:
    firewall_allow:
      - { source: "10.0.0.0/8", port: "80" }
      - { port: "443" }

Have a look at the defaults/main.yml for role variables that can be overridden.

TODO

Refactor to enable idempotance tests