vm-ansible/roles/openvpn/tasks/main.yaml
Kristóf Torma 3c883cdded
All checks were successful
continuous-integration/drone/push Build is passing
update to latest state
2023-02-19 13:42:53 +01:00

57 lines
1.5 KiB
YAML

---
- name: "Install openvpn-server via apt"
apt:
update_cache: yes
state: present
name:
- openvpn
- name : "Enable ipv4 forwarding via sysctl"
ansible.posix.sysctl:
name: net.ipv4.ip_forward
value: '1'
sysctl_set: yes
state: present
reload: yes
- name: Enable and restart openvpn daemon
service:
name: openvpn-server@stargate
state: restarted
enabled: yes
- name: Check if AllowUsers is defined
lineinfile:
state: absent
path: /etc/ufw/before.rules
regexp: "^# START OPENVPN"
check_mode: true
changed_when: false
register: checkufwrules
- name: Insert openvpn iptables rules
blockinfile:
path: /etc/ufw/before.rules
block: |
# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to everywhere
-A POSTROUTING -s 192.168.37.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.37.0/24 -o eth2 -j MASQUERADE
COMMIT
-A ufw-before-input -i tun+ -j ACCEPT
-A ufw-before-forward -i tun+ -j ACCEPT
-A ufw-before-forward -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -i tun+ -o eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -i eth2 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# END OPENVPN RULES
- name: Reload ufw
community.general.ufw:
state: reloaded
...