homelab/roles/base/tasks/firewall.yml

47 lines
941 B
YAML

- name: Install the Uncomplicated Firewall
apt:
name: ufw
state: present
- name: Install Fail2ban
apt:
name: fail2ban
state: present
- name: Deny incoming traffic by default
ufw:
default: deny
direction: incoming
- name: Allow outgoing traffic by default
ufw:
default: allow
direction: outgoing
- name: Allow OpenSSH with rate limiting
ufw:
name: ssh
rule: limit
- name: Remove Fail2ban defaults-debian.conf
file:
path: /etc/fail2ban/jail.d/defaults-debian.conf
state: absent
- name: Install OpenSSH's Fail2ban jail
template:
src: fail2ban-ssh.conf.j2
dest: /etc/fail2ban/jail.d/sshd.conf
notify: restart_fail2ban
- name: Install Fail2ban IP allow list
template:
src: fail2ban-allowlist.conf.j2
dest: /etc/fail2ban/jail.d/allowlist.conf
when: fail2ban_ignoreip is defined
notify: restart_fail2ban
- name: Enable firewall
ufw:
state: enabled