n0mad1k
20bcecbcec
- Add IPv6 ip6tables rules to prevent IPv6 traffic leaks (forwarding was enabled but only IPv4 masquerade existed) - Tighten FORWARD chain: only allow wg0→internet and established return, instead of blanket ACCEPT from wg0 - Scope NAT masquerade to VPN subnet only - Block VPN clients from server-local services (SSH/80/443) via INPUT rules - Set UFW DEFAULT_FORWARD_POLICY=ACCEPT (required for VPN routing; base hardening sets default deny which blocks forwarded packets) - Add SaveConfig = false to prevent runtime state overwriting config - Add reload ufw handler Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
62 lines
1.4 KiB
YAML
62 lines
1.4 KiB
YAML
---
|
|
# WireGuard installation and server key generation
|
|
|
|
- name: Install WireGuard
|
|
apt:
|
|
name:
|
|
- wireguard
|
|
- wireguard-tools
|
|
- qrencode
|
|
state: present
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Enable IP forwarding (IPv4)
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: "1"
|
|
sysctl_set: true
|
|
reload: true
|
|
|
|
- name: Enable IP forwarding (IPv6)
|
|
sysctl:
|
|
name: net.ipv6.conf.all.forwarding
|
|
value: "1"
|
|
sysctl_set: true
|
|
reload: true
|
|
|
|
- name: Set UFW default forward policy to accept (required for VPN routing)
|
|
lineinfile:
|
|
path: /etc/default/ufw
|
|
regexp: '^DEFAULT_FORWARD_POLICY='
|
|
line: 'DEFAULT_FORWARD_POLICY="ACCEPT"'
|
|
notify: reload ufw
|
|
|
|
- name: Allow WireGuard port through UFW
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ wg_port }}"
|
|
proto: udp
|
|
|
|
- name: Generate server private key
|
|
shell: wg genkey
|
|
register: wg_server_privkey
|
|
args:
|
|
creates: /etc/wireguard/server_private.key
|
|
|
|
- name: Save server private key
|
|
copy:
|
|
content: "{{ wg_server_privkey.stdout }}"
|
|
dest: /etc/wireguard/server_private.key
|
|
mode: "0600"
|
|
when: wg_server_privkey.changed
|
|
|
|
- name: Read server private key
|
|
slurp:
|
|
src: /etc/wireguard/server_private.key
|
|
register: server_privkey_content
|
|
|
|
- name: Generate server public key
|
|
shell: "echo '{{ server_privkey_content.content | b64decode | trim }}' | wg pubkey"
|
|
register: wg_server_pubkey
|
|
changed_when: false
|