--- openwrt_arch: x86 openwrt_target: 64 openwrt_profile: generic openwrt_output_image_suffixes: - "{{ openwrt_profile }}-ext4-combined.img.gz" openwrt_packages_remove: - ppp - ppp-mod-pppoe - firewall openwrt_packages_add: - kmod-ipt-nat - kmod-ipt-conntrack - haveged - htop - ip - less - nano - tcpdump-mini - iperf - iperf3 - mtr - iptraf-ng openwrt_mixin: /etc/dropbear/authorized_keys: content: "{{ ssh_keys_root | join('\n') }}\n" /etc/htoprc: file: "{{ global_files_dir }}/common/htoprc" /etc/rc.d/S22network-fw: link: "../init.d/network-fw" /etc/rc.d/K92network-fw: link: "../init.d/network-fw" /etc/init.d/network-fw: mode: "0755" content: | #!/bin/sh /etc/rc.common START=22 STOP=91 start() { WAN_IF=$(uci get network.wan.device) LAN_IF="br-lan" LAN_IP=$(uci get network.lan.ipaddr) LAN_MASK=$(uci get network.lan.netmask) iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT ### external incoming iptables -A INPUT -i "$WAN_IF" -p icmp -j ACCEPT iptables -A INPUT -i "$WAN_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "$WAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT ### internal iptables -A INPUT -i "$LAN_IF" -p udp --dport 67 --sport 68 -j ACCEPT iptables -A INPUT -i "$LAN_IF" -p udp --dport 53 -d "$LAN_IP" -s "$LAN_IP/$LAN_MASK" -j ACCEPT iptables -A INPUT -i "$LAN_IF" -p tcp --dport 53 -d "$LAN_IP" -s "$LAN_IP/$LAN_MASK" -j ACCEPT iptables -A INPUT -i "$LAN_IF" -p icmp -d "$LAN_IP" -s "$LAN_IP/$LAN_MASK" -j ACCEPT iptables -A INPUT -i "$LAN_IF" -p tcp --dport {{ ansible_port }} -d "$LAN_IP" -s "$LAN_IP/$LAN_MASK" -j ACCEPT iptables -A INPUT -i "$LAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i "$LAN_IF" -o "$WAN_IF" -s "$LAN_IP/$LAN_MASK" -j ACCEPT iptables -A FORWARD -i "$WAN_IF" -o "$LAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -t nat -A POSTROUTING -o "$WAN_IF" -s "$LAN_IP/$LAN_MASK" -j MASQUERADE ### default policies iptables -P INPUT DROP iptables -P FORWARD DROP } stop() { iptables -P INPUT ACCEPT iptables -F INPUT iptables -P FORWARD ACCEPT iptables -F FORWARD iptables -t nat -F POSTROUTING } openwrt_uci: system: - name: system options: hostname: '{{ host_name }}' timezone: 'CET-1CEST,M3.5.0,M10.5.0/3' ttylogin: '0' log_size: '64' urandom_seed: '0' - name: timeserver 'ntp' options: enabled: '1' enable_server: '0' server: - '0.lede.pool.ntp.org' - '1.lede.pool.ntp.org' - '2.lede.pool.ntp.org' - '3.lede.pool.ntp.org' dropbear: - name: dropbear options: PasswordAuth: 'off' RootPasswordAuth: 'off' Port: '{{ ansible_port }}' dhcp: - name: dnsmasq options: domainneeded: '1' boguspriv: '0' filterwin2k: '0' localise_queries: '1' rebind_protection: '0' rebind_localhost: '1' local: '/lan/' domain: 'lan' expandhosts: '1' nonegcache: '0' authoritative: '1' readethers: '1' leasefile: '/tmp/dhcp.leases' resolvfile: '/tmp/resolv.conf.auto' localservice: '1' - name: odhcpd 'odhcpd' options: maindhcp: '0' leasefile: '/tmp/hosts/odhcpd' leasetrigger: '/usr/sbin/odhcpd-update' - name: dhcp 'wan' options: interface: 'wan' ignore: '1' - name: dhcp 'lan' options: interface: 'lan' start: "{{ network_zones.tug_lan.dhcp.start }}" limit: "{{ network_zones.tug_lan.dhcp.limit }}" leasetime: "{{ network_zones.tug_lan.dhcp.leasetime | default('12h') }}" dhcpv6: 'disabled' ra: 'disabled' network: - name: globals 'globals' options: ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" - name: interface 'loopback' options: device: lo proto: static ipaddr: 127.0.0.1 netmask: 255.0.0.0 - name: interface 'lan' options: type: bridge device: "eth0 eth1 eth2 eth3 eth4" proto: static ipaddr: "{{ network_zones.tug_lan.prefix | ipaddr(network_zones.tug_lan.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_zones.tug_lan.prefix | ipaddr('netmask') }}" - name: interface 'wan' options: device: eth5 proto: dhcp macaddr: 00:11:22:33:44:55