Role - tripleo-firewall

Role Documentation

Welcome to the “tripleo_firewall” role documentation.

Role Defaults

This section highlights all of the defaults and variables set within the “tripleo_firewall” role.

# All variables intended for modification should be placed in this file.

# All variables within this role should have a prefix of "tripleo_firewall"

# Example rule definition
#
# '003 accept ssh from all':
#   proto: 'tcp'
#   dport: 22
# '002 remove ssh from all':
#   proto: 'tcp'
#   dport: 22
#   extras:
#     ensure: 'absent'

tripleo_firewall_rules: {}

tripleo_firewall_frontend_enabled: false

tripleo_firewall_frontend_rules: {}

tripleo_firewall_ssl_frontend_enabled: false

tripleo_firewall_ssl_frontend_rules: {}

tripleo_firewall_edge_frontend_enabled: false

tripleo_firewall_edge_frontend_rules: {}

tripleo_firewall_edge_ssl_frontend_rules: {}

tripleo_firewall_default_rules:
  000 accept related established rules:
    proto: all
    state:
    - RELATED
    - ESTABLISHED
  001 accept all icmp:
    ipversion: ipv4
    proto: icmp
  001 accept all ipv6-icmp:
    ipversion: ipv6
    proto: ipv6-icmp
    state: []
  002 accept all to lo interface:
    proto: all
    interface: lo
    state: []
  004 accept ipv6 dhcpv6:
    ipversion: ipv6
    dport: 546
    proto: udp
    state:
    - NEW
    destination: fe80::/64
  999 log all:
    proto: all
    jump: LOG
    limit: 20/min
    limit_burst: 15
    nft_level: warn
    nft_flags: all
    nft_prefix: 'DROPPING: '
    state: []

Role Variables: redhat.yml

# While options found within the vars/ path can be overridden using extra
# vars, items within this path are considered part of the role and not
# intended to be modified.

tripleo_firewall_packages:
- nftables

Role Variables: main.yml

# All variables within this role should have a prefix of "tripleo_firewall"

# Converts the expected state options to functional states when
# interacting with ports.
tripleo_firewall_port_states:
  enabled: present
  present: present
  absent: absent
  disabled: absent

Molecule Scenarios

Molecule is being used to test the “tripleo_firewall” role. The following section highlights the drivers in service and provides an example playbook showing how the role is leveraged.

Scenario: nftables

Molecule Inventory

hosts:
  all:
    hosts:
      instance:
        ansible_host: localhost

Example nftables playbook

- name: Converge
  hosts: all
  roles:
  - role: tripleo_firewall
    tripleo_firewall_engine: nftables
  tasks:
  - name: Clean everything nftables related
    import_role:
      name: tripleo_nftables
      tasks_from: cleanup.yml