homelab/roles/base/tasks/firewall.yml

47 lines
941 B
YAML
Raw Permalink Normal View History

2022-05-27 20:29:27 +00:00
- name: Install the Uncomplicated Firewall
apt:
name: ufw
state: present
2022-05-28 06:31:41 +00:00
- name: Install Fail2ban
apt:
name: fail2ban
state: present
2022-05-27 20:29:27 +00:00
- name: Deny incoming traffic by default
ufw:
default: deny
direction: incoming
- name: Allow outgoing traffic by default
ufw:
default: allow
direction: outgoing
- name: Allow OpenSSH with rate limiting
ufw:
name: ssh
rule: limit
- name: Remove Fail2ban defaults-debian.conf
file:
path: /etc/fail2ban/jail.d/defaults-debian.conf
state: absent
- name: Install OpenSSH's Fail2ban jail
template:
src: fail2ban-ssh.conf.j2
dest: /etc/fail2ban/jail.d/sshd.conf
notify: restart_fail2ban
2022-06-29 03:43:58 +00:00
- name: Install Fail2ban IP allow list
template:
src: fail2ban-allowlist.conf.j2
dest: /etc/fail2ban/jail.d/allowlist.conf
when: fail2ban_ignoreip is defined
notify: restart_fail2ban
2022-05-27 20:29:27 +00:00
- name: Enable firewall
ufw:
state: enabled