add iptables role and define firewall rules for mirror group

group_vars/mirror.yml

@@ -1,4 +1,9 @@
 ---
+
 os_type: centos7
 dcentos7atadisk_size:
   - 1000
+
+firewall_in:
+  - {proto: tcp, port: 22, from: [172.20.20.0/22]}
+  - {proto: tcp, port: 443, from: [172.20.20.0/22]}

roles/base/tasks/RedHat.yml

@@ -32,3 +32,7 @@
     hour: 3
     minute: "{{ 59 | random(seed=inventory_hostname) }}"
     job: "yum -d 0 -e 0 -y --downloadonly update > /dev/null"
+
+- name: install os specific roles
+  include_role:
+    name: iptables

roles/iptables/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+
+firewall_in:
+  - {proto: tcp, port: 22}
+
+firewall_raw: []

roles/iptables/handlers/main.yml

@@ -0,0 +1,11 @@
+---
+
+- name: reload iptables
+  service:
+    name: iptables
+    state: reloaded
+
+- name: reload ip6tables
+  service:
+    name: ip6tables
+    state: reloaded

roles/iptables/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+
+- name: remove firewalld
+  package:
+    name: firewalld
+    state: removed
+
+- name: install iptables packages
+  package:
+    name: "{{ item }}"
+    state: installed
+  with_items:
+    - iptables
+    - iptables-services
+
+- name: create iptables config from template
+  template:
+    src: "{{ item }}.j2"
+    dest: "/etc/sysconfig/{{ item }}"
+    mode: 0600
+    owner: root
+    group: root
+  notify: "reload {{ item }}"
+  with_items:
+    - iptables
+    - ip6tables
+
+- name: enable iptables service
+  service:
+    name: "{{ item }}"
+    state: started
+    enabled: true
+  with_items:
+    - iptables
+    - ip6tables

roles/iptables/templates/ip6tables.j2

@@ -0,0 +1,22 @@
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -p ipv6-icmp -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+{% for rule in firewall_raw %}
+{{ rule }}
+{% endfor %}
+{% for rule in firewall_in %}
+  {% if rule.from is defined %}
+    {% for from in rule.from | ipv6 %}
+-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} -s {{ from }} --dport {{ rule.port }} -j ACCEPT
+    {% endfor %}
+  {% else %}
+-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} --dport {{ rule.port }} -j ACCEPT
+  {% endif %}
+{% endfor %}
+-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
+-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
+COMMIT

roles/iptables/templates/iptables.j2

@@ -0,0 +1,22 @@
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+{% for rule in firewall_raw %}
+{{ rule }}
+{% endfor %}
+{% for rule in firewall_in %}
+  {% if rule.from is defined %}
+    {% for from in rule.from | ipv4 %}
+-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} -s {{ from }} --dport {{ rule.port }} -j ACCEPT
+    {% endfor %}
+  {% else %}
+-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} --dport {{ rule.port }} -j ACCEPT
+  {% endif %}
+{% endfor %}
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+-A FORWARD -j REJECT --reject-with icmp-host-prohibited
+COMMIT