28 lines
602 B
YAML
28 lines
602 B
YAML
# §34 — UFW firewall.
|
|
---
|
|
- name: Set UFW default deny inbound
|
|
community.general.ufw:
|
|
direction: incoming
|
|
policy: deny
|
|
|
|
- name: Set UFW default allow outbound
|
|
community.general.ufw:
|
|
direction: outgoing
|
|
policy: allow
|
|
|
|
- name: Allow inbound on required ports
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop: "{{ ufw_allowed_inbound_ports }}"
|
|
|
|
- name: Rate-limit SSH (auto-block brute-force from same source)
|
|
community.general.ufw:
|
|
rule: limit
|
|
port: "22"
|
|
proto: tcp
|
|
|
|
- name: Enable UFW
|
|
community.general.ufw:
|
|
state: enabled
|