added new jumphost

4 files changed, 53 insertions, 4 deletions

diff --git a/inventory/group_vars/chaos_at_home/network.yml b/inventory/group_vars/chaos_at_home/network.yml
index 95c240c1..7e317bbc 100644
--- a/inventory/group_vars/chaos_at_home/network.yml
+++ b/inventory/group_vars/chaos_at_home/network.yml
@@ -30,8 +30,10 @@ network_zones:
     prefix: 192.168.32.0/24
     gw: 192.168.32.254
     dns:
-      - 192.168.32.254
+#      - 192.168.32.254
+      - 9.9.9.9
     offsets:
+      ch-jump: 22
       web: 80
       mail: 143
       ch-router: 254
diff --git a/inventory/host_vars/ch-jump.yml b/inventory/host_vars/ch-jump.yml
new file mode 100644
index 00000000..b46120f1
--- /dev/null
+++ b/inventory/host_vars/ch-jump.yml
@@ -0,0 +1,29 @@
+---
+vm_host: ch-gnocchi
+
+install:
+  host: "{{ vm_host }}"
+  mem: 1024
+  numcpu: 2
+  disks:
+    primary: /dev/sda
+    scsi:
+      sda:
+        vg: "{{ hostvars[vm_host].host_name }}"
+        lv: "{{ inventory_hostname }}"
+        size: 10g
+  interfaces:
+  - bridge: br-svc
+    name: primary0
+  autostart: True
+
+network:
+  nameservers: "{{ network_zones.svc.dns }}"
+  domain: "{{ host_domain }}"
+  systemd_link:
+    interfaces: "{{ install.interfaces }}"
+  primary:
+    interface: primary0
+    ip: "{{ network_zones.svc.prefix | ipaddr(network_zones.svc.offsets[inventory_hostname]) | ipaddr('address') }}"
+    mask: "{{ network_zones.svc.prefix | ipaddr('netmask') }}"
+    gateway: "{{ network_zones.svc.gw }}"
diff --git a/inventory/host_vars/ch-router.yml b/inventory/host_vars/ch-router.yml
index deaf0371..c3df8e2b 100644
--- a/inventory/host_vars/ch-router.yml
+++ b/inventory/host_vars/ch-router.yml
@@ -65,19 +65,34 @@ openwrt_mixin:
 
         SSH_PORT=$(uci get dropbear.@dropbear[0].Port)
 
+
+        ## Local Traffic
+        #
         iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT
         iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT
 
+
+        ## WAN Traffic
+        #
         iptables -A INPUT -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p icmp -j ACCEPT
         iptables -A INPUT -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p tcp --dport "$SSH_PORT" -j ACCEPT
         iptables -A INPUT -i "$MAGENTA_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 
-        iptables -A INPUT -i "$SVC_IF" -p icmp -d "$SVC_IPADDR" -s "$SVC_IPADDR/$SVC_NETMASK" -j ACCEPT
+        iptables -t nat -A PREROUTING -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p tcp --dport 2342 -j DNAT --to "{{ network_zones.svc.prefix | ipaddr(network_zones.svc.offsets['ch-jump']) | ipaddr('address') }}"
+        iptables -A FORWARD -i "$MAGENTA_IF" -o "$SVC_IF" -d "{{ network_zones.svc.prefix | ipaddr(network_zones.svc.offsets['ch-jump']) | ipaddr('address') }}" -p tcp --dport 2342 -j ACCEPT
+
+
+        ## LAN Traffic
+        #
+        iptables -A INPUT -i "$SVC_IF" -p icmp -d "$SVC_IPADDR" -s 192.168.0.0/16 -j ACCEPT
         iptables -A INPUT -i "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-        iptables -A FORWARD -i "$SVC_IF" -o "$MAGENTA_IF" -s "$SVC_IPADDR/$SVC_NETMASK" -j ACCEPT
+        iptables -A FORWARD -i "$SVC_IF" -o "$MAGENTA_IF" -s 192.168.0.0/16 -j ACCEPT
         iptables -A FORWARD -i "$MAGENTA_IF" -o "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-        iptables -t nat -A POSTROUTING -o "$MAGENTA_IF" -s "$SVC_IPADDR/$SVC_NETMASK" -j SNAT --to "$MAGENTA_IPADDR"
+        iptables -t nat -A POSTROUTING -o "$MAGENTA_IF" -s 192.168.0.0/16 -j SNAT --to "$MAGENTA_IPADDR"
+
 
+        ## Drop all other inbound traffic
+        #
         iptables -P INPUT DROP
         iptables -P FORWARD DROP
       }
diff --git a/inventory/hosts.ini b/inventory/hosts.ini
index 19d76295..77a3efff 100644
--- a/inventory/hosts.ini
+++ b/inventory/hosts.ini
@@ -20,6 +20,8 @@ ch-keyserver host_name=keyserver
 ch-pan host_name=pan
 ch-gnocchi host_name=gnocchi
 ch-router host_name=router
+ch-gwlan host_name=gwlan
+ch-jump host_name=jump ansible_port=2342 ansible_host=ch-jump
 
 [chaos_at_home:children]
 mz_chaos_at_home
@@ -159,6 +161,7 @@ ch-gnocchi
 emc-stats
 emc-master
 ch-keyserver
+ch-jump
 r3-vex2