Rename configure_firewall role
This commit is contained in:
parent
5542a21301
commit
d0746b2f1b
6 changed files with 13 additions and 13 deletions
|
|
@ -1,3 +0,0 @@
|
||||||
---
|
|
||||||
sce_nft_table_name: sce_table
|
|
||||||
sce_nft_table_filename: sce-port-mapping
|
|
||||||
3
roles/firewall_nft/defaults/main.yml
Normal file
3
roles/firewall_nft/defaults/main.yml
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
---
|
||||||
|
firewall_nft_table_name: sce_table
|
||||||
|
firewall_nft_table_filename: sce-port-mapping
|
||||||
|
|
@ -5,5 +5,5 @@
|
||||||
|
|
||||||
- name: Reload port mapping service
|
- name: Reload port mapping service
|
||||||
ansible.builtin.systemd_service:
|
ansible.builtin.systemd_service:
|
||||||
name: "{{ sce_nft_table_filename }}.service"
|
name: "{{ firewall_nft_table_filename }}.service"
|
||||||
state: reloaded
|
state: reloaded
|
||||||
|
|
@ -7,7 +7,7 @@
|
||||||
- name: Install SCE port mapping rules
|
- name: Install SCE port mapping rules
|
||||||
ansible.builtin.template:
|
ansible.builtin.template:
|
||||||
src: nft.conf.j2
|
src: nft.conf.j2
|
||||||
dest: /etc/{{ sce_nft_table_filename }}.conf
|
dest: /etc/{{ firewall_nft_table_filename }}.conf
|
||||||
mode: "0755"
|
mode: "0755"
|
||||||
validate: /usr/sbin/nft -cf %s
|
validate: /usr/sbin/nft -cf %s
|
||||||
notify: Reload port mapping service
|
notify: Reload port mapping service
|
||||||
|
|
@ -15,7 +15,7 @@
|
||||||
- name: Install SCE port mapping systemd service
|
- name: Install SCE port mapping systemd service
|
||||||
ansible.builtin.template:
|
ansible.builtin.template:
|
||||||
src: nft.service.j2
|
src: nft.service.j2
|
||||||
dest: /etc/systemd/system/{{ sce_nft_table_filename }}.service
|
dest: /etc/systemd/system/{{ firewall_nft_table_filename }}.service
|
||||||
mode: "0644"
|
mode: "0644"
|
||||||
notify: Reload systemd daemon
|
notify: Reload systemd daemon
|
||||||
|
|
||||||
|
|
@ -25,6 +25,6 @@
|
||||||
|
|
||||||
- name: Ensure nft SCE port mapping service is started and enabled
|
- name: Ensure nft SCE port mapping service is started and enabled
|
||||||
ansible.builtin.systemd_service:
|
ansible.builtin.systemd_service:
|
||||||
name: "{{ sce_nft_table_filename }}.service"
|
name: "{{ firewall_nft_table_filename }}.service"
|
||||||
state: started
|
state: started
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
@ -10,10 +10,10 @@
|
||||||
|
|
||||||
# Flush and recreate the entire table
|
# Flush and recreate the entire table
|
||||||
# https://unix.stackexchange.com/questions/537030/nftables-flush-delete-when-changing-or-creating-new-table
|
# https://unix.stackexchange.com/questions/537030/nftables-flush-delete-when-changing-or-creating-new-table
|
||||||
table inet {{ sce_nft_table_name }}
|
table inet {{ firewall_nft_table_name }}
|
||||||
flush table inet {{ sce_nft_table_name }}
|
flush table inet {{ firewall_nft_table_name }}
|
||||||
|
|
||||||
table inet {{ sce_nft_table_name }} {
|
table inet {{ firewall_nft_table_name }} {
|
||||||
chain sce_port_mapping {
|
chain sce_port_mapping {
|
||||||
type nat hook prerouting priority filter + 1;
|
type nat hook prerouting priority filter + 1;
|
||||||
policy accept;
|
policy accept;
|
||||||
|
|
@ -14,9 +14,9 @@ RemainAfterExit=yes
|
||||||
StandardInput=null
|
StandardInput=null
|
||||||
ProtectSystem=full
|
ProtectSystem=full
|
||||||
ProtectHome=true
|
ProtectHome=true
|
||||||
ExecStart=/usr/sbin/nft -f /etc/{{ sce_nft_table_filename }}.conf
|
ExecStart=/usr/sbin/nft -f /etc/{{ firewall_nft_table_filename }}.conf
|
||||||
ExecReload=/usr/sbin/nft -f /etc/{{ sce_nft_table_filename }}.conf
|
ExecReload=/usr/sbin/nft -f /etc/{{ firewall_nft_table_filename }}.conf
|
||||||
ExecStop=/usr/sbin/nft delete table inet {{ sce_nft_table_name }}
|
ExecStop=/usr/sbin/nft delete table inet {{ firewall_nft_table_name }}
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy=sysinit.target
|
WantedBy=sysinit.target
|
||||||
Loading…
Reference in a new issue