From f6e22aca8e3559e244c855244f723434556b9aa7 Mon Sep 17 00:00:00 2001
From: binary <me@rgoncalves.se>
Date: Thu, 19 Nov 2020 14:15:32 +0100
Subject: Compact the final configuration

---
 roles/pf/templates/pf.conf.j2 | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

(limited to 'roles')

diff --git a/roles/pf/templates/pf.conf.j2 b/roles/pf/templates/pf.conf.j2
index 42b0bea..73971af 100644
--- a/roles/pf/templates/pf.conf.j2
+++ b/roles/pf/templates/pf.conf.j2
@@ -1,17 +1,15 @@
 
 {# pf ~~ templates/pf.conf.j2 #}
 # pf ~~ /etc/pf.conf
+# managed by Ansible
 
-# *
-# common config. by Ansible
-# *
-
+# common configuration
 set block-policy drop
 set loginterface egress
 set skip on { lo tun0 }
-
 block all
 
+# host services
 {% for service in services %}
 pass in quick on egress proto {{ service["proto"] }} to port {{ service["port"] }}
 {% endfor %}
@@ -28,23 +26,20 @@ pass in on egress proto { {{ service.proto }} } from any to any port {{ service.
 {##}
 {% endfor %}
 
-# *
-# sub-config. by Ansible
-# *
-
+{#
 {% if hypervisor is defined and vms is defined %}
 # hypervisor network passthrough
 {% for i in range(vms | length + 5) %}
 set skip on tap{{ i }}
 {% endfor %}
 {% endif %}
+#}
 
-{% include "templates/" + inventory_hostname + "/etc/pf.conf.j2" ignore missing %}
-
-# *
-# out. interface by Ansible 
-# *
+# wireguard
+pass in on egress inet proto udp from any to any port 50000
+pass out quick on egress inet from (tun0:network) nat-to (egress:0)
 
+# output network
 pass out quick inet
 pass in proto { icmp, icmp6 } all
 
-- 
cgit v1.2.3