From 8b29860208438a77af8a974a72e688599ca484c1 Mon Sep 17 00:00:00 2001
From: binary <me@rgoncalves.se>
Date: Mon, 2 Nov 2020 13:27:47 +0100
Subject: Add pf playbook and role

---
 roles/pf/templates/pf.conf.j2 | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 roles/pf/templates/pf.conf.j2

(limited to 'roles/pf/templates')

diff --git a/roles/pf/templates/pf.conf.j2 b/roles/pf/templates/pf.conf.j2
new file mode 100644
index 0000000..64001cf
--- /dev/null
+++ b/roles/pf/templates/pf.conf.j2
@@ -0,0 +1,35 @@
+
+{# pf ~~ templates/pf.conf.j2 #}
+
+# pf ~~ /etc/pf.conf
+
+# ========================= #
+# common config. by Ansible
+# ========================= #
+
+set block-policy drop
+set loginterface egress
+set skip on { lo tun0 }
+
+block all
+
+{% for key, value in services.tcp.items() %}
+pass in quick on egress proto tcp to port {{ value }}
+{% endfor %}
+{% for key, value in services.udp.items() %}
+pass in quick on egress proto udp to port {{ value }}
+{% endfor %}
+
+# ====================== #
+# sub-config. by Ansible
+# ====================== #
+
+{% include "templates/" + inventory_hostname + "/etc/pf.conf.j2" %}
+
+# ========================= #
+# out. interface by Ansible 
+# ========================= #
+
+pass out quick inet
+pass in proto { icmp, icmp6 } all
+
-- 
cgit v1.2.3