From de3373e97d133e0ac76fb44deb5dea27c18d8815 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Romain=20Gon=C3=A7alves?= <me@rgoncalves.se>
Date: Sat, 11 Dec 2021 18:50:33 +0000
Subject: roles: Add pf and relayd roles for domain controller

---
 roles/pf/templates/pf.conf.j2 | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 roles/pf/templates/pf.conf.j2

(limited to 'roles/pf/templates/pf.conf.j2')

diff --git a/roles/pf/templates/pf.conf.j2 b/roles/pf/templates/pf.conf.j2
new file mode 100644
index 0000000..6bc936a
--- /dev/null
+++ b/roles/pf/templates/pf.conf.j2
@@ -0,0 +1,24 @@
+# managed by Ansible
+{% import 'macros.j2' as macros with context %}
+
+# common configuration
+set block-policy drop
+set loginterface egress
+set skip on { lo wg0 }
+block all
+
+# force ssh if not present below
+pass in quick on egress proto tcp to port 22
+
+# host services
+{% for service in __services %}
+pass in quick on egress proto {{ service["protocol"] }} to port {{ service["port"] }}
+{% endfor %}
+
+# wireguard
+pass in on egress inet proto udp from any to any port 50000
+pass out quick on egress inet from (wg0:network) nat-to (egress:0)
+
+# output network
+pass out quick inet
+pass in proto { icmp, icmp6 } all
-- 
cgit v1.2.3