summaryrefslogtreecommitdiff
path: root/inventory
diff options
context:
space:
mode:
authorChristian Pointner <equinox@spreadspace.org>2019-07-10 17:21:54 +0200
committerChristian Pointner <equinox@spreadspace.org>2019-07-10 17:21:54 +0200
commit3f1364557e1753ca0e8f2efcec9087516f4e0cbe (patch)
treec4fa61852fd82d8d9ac18cb851f4292c0051efe9 /inventory
parentch-router: fix firewall script (diff)
added new jumphost
Diffstat (limited to 'inventory')
-rw-r--r--inventory/group_vars/chaos_at_home/network.yml4
-rw-r--r--inventory/host_vars/ch-jump.yml29
-rw-r--r--inventory/host_vars/ch-router.yml21
-rw-r--r--inventory/hosts.ini3
4 files changed, 53 insertions, 4 deletions
diff --git a/inventory/group_vars/chaos_at_home/network.yml b/inventory/group_vars/chaos_at_home/network.yml
index 95c240c1..7e317bbc 100644
--- a/inventory/group_vars/chaos_at_home/network.yml
+++ b/inventory/group_vars/chaos_at_home/network.yml
@@ -30,8 +30,10 @@ network_zones:
prefix: 192.168.32.0/24
gw: 192.168.32.254
dns:
- - 192.168.32.254
+# - 192.168.32.254
+ - 9.9.9.9
offsets:
+ ch-jump: 22
web: 80
mail: 143
ch-router: 254
diff --git a/inventory/host_vars/ch-jump.yml b/inventory/host_vars/ch-jump.yml
new file mode 100644
index 00000000..b46120f1
--- /dev/null
+++ b/inventory/host_vars/ch-jump.yml
@@ -0,0 +1,29 @@
+---
+vm_host: ch-gnocchi
+
+install:
+ host: "{{ vm_host }}"
+ mem: 1024
+ numcpu: 2
+ disks:
+ primary: /dev/sda
+ scsi:
+ sda:
+ vg: "{{ hostvars[vm_host].host_name }}"
+ lv: "{{ inventory_hostname }}"
+ size: 10g
+ interfaces:
+ - bridge: br-svc
+ name: primary0
+ autostart: True
+
+network:
+ nameservers: "{{ network_zones.svc.dns }}"
+ domain: "{{ host_domain }}"
+ systemd_link:
+ interfaces: "{{ install.interfaces }}"
+ primary:
+ interface: primary0
+ ip: "{{ network_zones.svc.prefix | ipaddr(network_zones.svc.offsets[inventory_hostname]) | ipaddr('address') }}"
+ mask: "{{ network_zones.svc.prefix | ipaddr('netmask') }}"
+ gateway: "{{ network_zones.svc.gw }}"
diff --git a/inventory/host_vars/ch-router.yml b/inventory/host_vars/ch-router.yml
index deaf0371..c3df8e2b 100644
--- a/inventory/host_vars/ch-router.yml
+++ b/inventory/host_vars/ch-router.yml
@@ -65,19 +65,34 @@ openwrt_mixin:
SSH_PORT=$(uci get dropbear.@dropbear[0].Port)
+
+ ## Local Traffic
+ #
iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT
iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT
+
+ ## WAN Traffic
+ #
iptables -A INPUT -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p icmp -j ACCEPT
iptables -A INPUT -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p tcp --dport "$SSH_PORT" -j ACCEPT
iptables -A INPUT -i "$MAGENTA_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- iptables -A INPUT -i "$SVC_IF" -p icmp -d "$SVC_IPADDR" -s "$SVC_IPADDR/$SVC_NETMASK" -j ACCEPT
+ iptables -t nat -A PREROUTING -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p tcp --dport 2342 -j DNAT --to "{{ network_zones.svc.prefix | ipaddr(network_zones.svc.offsets['ch-jump']) | ipaddr('address') }}"
+ iptables -A FORWARD -i "$MAGENTA_IF" -o "$SVC_IF" -d "{{ network_zones.svc.prefix | ipaddr(network_zones.svc.offsets['ch-jump']) | ipaddr('address') }}" -p tcp --dport 2342 -j ACCEPT
+
+
+ ## LAN Traffic
+ #
+ iptables -A INPUT -i "$SVC_IF" -p icmp -d "$SVC_IPADDR" -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -i "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- iptables -A FORWARD -i "$SVC_IF" -o "$MAGENTA_IF" -s "$SVC_IPADDR/$SVC_NETMASK" -j ACCEPT
+ iptables -A FORWARD -i "$SVC_IF" -o "$MAGENTA_IF" -s 192.168.0.0/16 -j ACCEPT
iptables -A FORWARD -i "$MAGENTA_IF" -o "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- iptables -t nat -A POSTROUTING -o "$MAGENTA_IF" -s "$SVC_IPADDR/$SVC_NETMASK" -j SNAT --to "$MAGENTA_IPADDR"
+ iptables -t nat -A POSTROUTING -o "$MAGENTA_IF" -s 192.168.0.0/16 -j SNAT --to "$MAGENTA_IPADDR"
+
+ ## Drop all other inbound traffic
+ #
iptables -P INPUT DROP
iptables -P FORWARD DROP
}
diff --git a/inventory/hosts.ini b/inventory/hosts.ini
index 19d76295..77a3efff 100644
--- a/inventory/hosts.ini
+++ b/inventory/hosts.ini
@@ -20,6 +20,8 @@ ch-keyserver host_name=keyserver
ch-pan host_name=pan
ch-gnocchi host_name=gnocchi
ch-router host_name=router
+ch-gwlan host_name=gwlan
+ch-jump host_name=jump ansible_port=2342 ansible_host=ch-jump
[chaos_at_home:children]
mz_chaos_at_home
@@ -159,6 +161,7 @@ ch-gnocchi
emc-stats
emc-master
ch-keyserver
+ch-jump
r3-vex2