---

# deploy ipv4 iptable rules
- name: "firewall - ipv4 rules"
  ansible.builtin.copy:
    dest: "/etc/iptables/rules-save"
    mode: "0600"
    owner: "root"
    group: "root"
    content: |
      *nat
      :PREROUTING ACCEPT [0:0]
      :INPUT ACCEPT [0:0]
      :OUTPUT ACCEPT [0:0]
      :POSTROUTING ACCEPT [0:0]
      # NAT masquerade from LAN to WAN
      -A POSTROUTING -o {{ wan_interface }} -j MASQUERADE
      {% for forward in nat_port_forwards %}
      # {{ forward.name }}
      -A PREROUTING -i {{ wan_interface }} -p {{ forward.protocol | default('tcp') }} --dport {{ forward.port }} -j DNAT --to-destination {{ forward.dst }}:{{ forward.port }}
      {% endfor %}
      COMMIT

      *filter
      :INPUT DROP [0:0]
      :FORWARD DROP [0:0]
      :OUTPUT ACCEPT [0:0]
      # Allow established/related
      -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
      # Allow loopback
      -A INPUT -i lo -j ACCEPT
      # Allow LAN management access
      -A INPUT -i {{ lan_interface }} -j ACCEPT
      # Allow forwarding from LAN to anywhere
      -A FORWARD -i {{ lan_interface }} -o {{ wan_interface }} -j ACCEPT
      {% for forward in nat_port_forwards %}
      # {{ forward.name }}
      -A FORWARD -i {{ wan_interface }} -o {{ lan_interface }} -d {{ forward.dst }} -p {{ forward.protocol | default('tcp') }} --dport {{ forward.port }} -j ACCEPT
      {% endfor %}
      COMMIT
  notify: "restart iptables"
  when: "ipv4_enabled"


# load nf_conntrack module
- name: "firewall - load nf_conntrack module"
  community.general.modprobe:
    name: "nf_conntrack"
    state: "present"

# configure nf_conntrack hashsize
- name: "firewall - configure nf_conntrack hashsize"
  ansible.builtin.lineinfile:
    path: "/etc/modprobe.d/nf_conntrack.conf"
    line: "options nf_conntrack hashsize=16384"
    create: true
    mode: "0644"
    owner: "root"
    group: "root"

# load nf_conntrack at boot
- name: "firewall - load nf_conntrack at boot"
  ansible.builtin.lineinfile:
    path: "/etc/modules"
    line: "nf_conntrack"
    create: true
    mode: "0644"
    owner: "root"
    group: "root"

# set nf_conntrack hashsize at runtime
- name: "firewall - set nf_conntrack hashsize runtime"
  ansible.builtin.shell:
    cmd: "echo 16384 > /sys/module/nf_conntrack/parameters/hashsize"
  changed_when: false

# configure nf_conntrack sysctl settings
- name: "firewall - configure conntrack sysctl settings"
  ansible.posix.sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: "present"
    sysctl_file: "/etc/sysctl.conf"
    reload: false
  loop:
    - name: "net.netfilter.nf_conntrack_max"
      value: "16384"
    - name: "net.netfilter.nf_conntrack_tcp_timeout_established"
      value: "3600"
    - name: "net.netfilter.nf_conntrack_generic_timeout"
      value: "120"