n0mad1k
20bcecbcec
- Add IPv6 ip6tables rules to prevent IPv6 traffic leaks (forwarding was enabled but only IPv4 masquerade existed) - Tighten FORWARD chain: only allow wg0→internet and established return, instead of blanket ACCEPT from wg0 - Scope NAT masquerade to VPN subnet only - Block VPN clients from server-local services (SSH/80/443) via INPUT rules - Set UFW DEFAULT_FORWARD_POLICY=ACCEPT (required for VPN routing; base hardening sets default deny which blocks forwarded packets) - Add SaveConfig = false to prevent runtime state overwriting config - Add reload ufw handler Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
26 lines
716 B
YAML
26 lines
716 B
YAML
---
|
|
# WireGuard VPN server deployment
|
|
|
|
- name: Deploy WireGuard VPN Server
|
|
hosts: all
|
|
become: true
|
|
vars:
|
|
wg_port: "{{ vpn_port | default(51820) }}"
|
|
wg_clients: "{{ vpn_client_count | default(3) }}"
|
|
wg_dns: "{{ vpn_dns | default('1.1.1.1') }}"
|
|
wg_subnet: "{{ vpn_subnet | default('10.66.66.0/24') }}"
|
|
wg_allowed_ips: "{{ vpn_allowed_ips | default('0.0.0.0/0, ::/0') }}"
|
|
target_host: "{{ target_host | default('localhost') }}"
|
|
|
|
tasks:
|
|
- name: Include WireGuard installation tasks
|
|
include_tasks: tasks/install.yml
|
|
|
|
- name: Include WireGuard configuration tasks
|
|
include_tasks: tasks/configure.yml
|
|
|
|
handlers:
|
|
- name: reload ufw
|
|
ufw:
|
|
state: reloaded
|