vm-ansible/roles/openvpn/tasks/main.yaml

57 lines
1.5 KiB
YAML
Raw Normal View History

2022-04-14 16:10:43 +02:00
---
- name: "Install openvpn-server via apt"
apt:
update_cache: yes
state: present
name:
2023-02-19 13:42:53 +01:00
- openvpn
2022-04-14 16:10:43 +02:00
2022-04-14 21:41:04 +02:00
- name : "Enable ipv4 forwarding via sysctl"
ansible.posix.sysctl:
name: net.ipv4.ip_forward
value: '1'
sysctl_set: yes
state: present
reload: yes
2022-04-14 16:10:43 +02:00
- name: Enable and restart openvpn daemon
service:
2023-02-19 13:42:53 +01:00
name: openvpn-server@stargate
2022-04-14 16:10:43 +02:00
state: restarted
enabled: yes
2022-04-17 12:22:22 +02:00
- name: Check if AllowUsers is defined
lineinfile:
state: absent
path: /etc/ufw/before.rules
regexp: "^# START OPENVPN"
check_mode: true
changed_when: false
register: checkufwrules
- name: Insert openvpn iptables rules
blockinfile:
path: /etc/ufw/before.rules
block: |
# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to everywhere
-A POSTROUTING -s 192.168.37.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.37.0/24 -o eth2 -j MASQUERADE
COMMIT
2023-02-19 13:42:53 +01:00
-A ufw-before-input -i tun+ -j ACCEPT
-A ufw-before-forward -i tun+ -j ACCEPT
-A ufw-before-forward -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -i tun+ -o eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -i eth2 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
2022-04-17 12:22:22 +02:00
# END OPENVPN RULES
- name: Reload ufw
community.general.ufw:
state: reloaded
2022-04-16 19:55:29 +02:00
...