|
| 1 | +- hosts: all:!router |
| 2 | + become: true |
| 3 | + |
| 4 | + vars: |
| 5 | + host_ips: { |
| 6 | + 'client': '192.168.101.2/24', 'infra': '192.168.102.2/24', 'cin': '192.168.103.2/24' |
| 7 | + } |
| 8 | + default_gateways: { |
| 9 | + 'client': '192.168.101.1', 'infra': '192.168.102.1', 'cin': '192.168.103.1' |
| 10 | + } |
| 11 | + |
| 12 | + tasks: |
| 13 | + - name: Configure internal network IP |
| 14 | + command: "ip a add {{ host_ips[inventory_hostname] }} dev eth1" |
| 15 | + ignore_errors: "true" |
| 16 | + - name: Remove default gateway |
| 17 | + command: "ip route del default" |
| 18 | + ignore_errors: "true" |
| 19 | + - name: Add default gateway to router |
| 20 | + command: "ip route add default via {{ default_gateways[inventory_hostname] }}" |
| 21 | + ignore_errors: "true" |
| 22 | + |
1 | 23 | - hosts: all
|
2 | 24 | become: true
|
3 | 25 |
|
|
9 | 31 | - tcpdump
|
10 | 32 | - bind-utils
|
11 | 33 | - vim
|
| 34 | + - tmux |
| 35 | + |
| 36 | +- hosts: infra |
| 37 | + become: true |
| 38 | + tasks: |
| 39 | + - yum: |
| 40 | + name: "bind" |
| 41 | + |
| 42 | +- hosts: all |
| 43 | + become: true |
| 44 | + tasks: |
| 45 | + - name: Remove nameservers in /etc/resolv.conf |
| 46 | + lineinfile: |
| 47 | + path: /etc/resolv.conf |
| 48 | + regexp: "^nameserver" |
| 49 | + state: absent |
12 | 50 |
|
13 | 51 | - hosts: router
|
14 | 52 | become: true
|
|
34 | 72 | zone: internal
|
35 | 73 | state: enabled
|
36 | 74 | loop:
|
37 |
| - - "enp0s8" |
38 |
| - - "enp0s9" |
39 |
| - - "enp0s10" |
| 75 | + - "eth1" |
| 76 | + - "eth2" |
| 77 | + - "eth3" |
40 | 78 | - name: NAT Masquerade default zone (usually public)
|
41 | 79 | firewalld:
|
42 | 80 | masquerade: yes
|
43 | 81 | state: enabled
|
44 | 82 | permanent: yes
|
45 | 83 | - name: Allow outgoing connections
|
46 |
| - command: "firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -s 192.168.0.0/16 -o enp0s3 -j ACCEPT" |
| 84 | + command: "firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -s 192.168.0.0/16 -o eth0 -j ACCEPT" |
47 | 85 | - name: Accept incoming established/active connections
|
48 |
| - command: "firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i enp0s3 -d 192.168.0.0/16 -m state --state RELATED,ESTABLISHED -j ACCEPT" |
| 86 | + command: "firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -d 192.168.0.0/16 -m state --state RELATED,ESTABLISHED -j ACCEPT" |
49 | 87 |
|
50 | 88 | - name: Reload firewall
|
51 | 89 | command: "firewall-cmd --reload"
|
52 | 90 |
|
53 |
| -- hosts: all:!router |
54 |
| - become: true |
55 | 91 |
|
56 |
| - vars: |
57 |
| - default_gateways: { |
58 |
| - 'client': '192.168.101.1', 'infra': '192.168.102.1', 'cin': '192.168.103.1' |
59 |
| - } |
60 | 92 |
|
61 |
| - tasks: |
62 |
| - - name: Remove default gateway |
63 |
| - command: "ip route del default" |
64 |
| - ignore_errors: "true" |
65 |
| - - name: Add default gateway to router |
66 |
| - command: "ip route add default via {{ default_gateways[inventory_hostname] }}" |
67 | 93 |
|
0 commit comments