diff options
Diffstat (limited to 'roles/pf')
| -rw-r--r-- | roles/pf/templates/pf.conf.j2 | 23 |
1 files changed, 9 insertions, 14 deletions
diff --git a/roles/pf/templates/pf.conf.j2 b/roles/pf/templates/pf.conf.j2 index 42b0bea..73971af 100644 --- a/roles/pf/templates/pf.conf.j2 +++ b/roles/pf/templates/pf.conf.j2 @@ -1,17 +1,15 @@ {# pf ~~ templates/pf.conf.j2 #} # pf ~~ /etc/pf.conf +# managed by Ansible -# * -# common config. by Ansible -# * - +# common configuration set block-policy drop set loginterface egress set skip on { lo tun0 } - block all +# host services {% for service in services %} pass in quick on egress proto {{ service["proto"] }} to port {{ service["port"] }} {% endfor %} @@ -28,23 +26,20 @@ pass in on egress proto { {{ service.proto }} } from any to any port {{ service. {##} {% endfor %} -# * -# sub-config. by Ansible -# * - +{# {% if hypervisor is defined and vms is defined %} # hypervisor network passthrough {% for i in range(vms | length + 5) %} set skip on tap{{ i }} {% endfor %} {% endif %} +#} -{% include "templates/" + inventory_hostname + "/etc/pf.conf.j2" ignore missing %} - -# * -# out. interface by Ansible -# * +# wireguard +pass in on egress inet proto udp from any to any port 50000 +pass out quick on egress inet from (tun0:network) nat-to (egress:0) +# output network pass out quick inet pass in proto { icmp, icmp6 } all |