Harden WireGuard VPN configuration

- Add IPv6 ip6tables rules to prevent IPv6 traffic leaks (forwarding was
  enabled but only IPv4 masquerade existed)
- Tighten FORWARD chain: only allow wg0→internet and established return,
  instead of blanket ACCEPT from wg0
- Scope NAT masquerade to VPN subnet only
- Block VPN clients from server-local services (SSH/80/443) via INPUT rules
- Set UFW DEFAULT_FORWARD_POLICY=ACCEPT (required for VPN routing; base
  hardening sets default deny which blocks forwarded packets)
- Add SaveConfig = false to prevent runtime state overwriting config
- Add reload ufw handler

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/vpn/tasks/install.yml

@@ -24,6 +24,19 @@
     sysctl_set: true
     reload: true
 
+- name: Set UFW default forward policy to accept (required for VPN routing)
+  lineinfile:
+    path: /etc/default/ufw
+    regexp: '^DEFAULT_FORWARD_POLICY='
+    line: 'DEFAULT_FORWARD_POLICY="ACCEPT"'
+  notify: reload ufw
+
+- name: Allow WireGuard port through UFW
+  ufw:
+    rule: allow
+    port: "{{ wg_port }}"
+    proto: udp
+
 - name: Generate server private key
   shell: wg genkey
   register: wg_server_privkey
@@ -46,9 +59,3 @@
   shell: "echo '{{ server_privkey_content.content | b64decode | trim }}' | wg pubkey"
   register: wg_server_pubkey
   changed_when: false
-
-- name: Allow WireGuard port through UFW
-  ufw:
-    rule: allow
-    port: "{{ wg_port }}"
-    proto: udp