fork https://github.com/mattsta/mailwebHEADmaster

2 files changed, 35 insertions, 0 deletions

diff --git a/ansible/roles/disableFirewall/files/modprobe.d/blacklist-iptables.conf b/ansible/roles/disableFirewall/files/modprobe.d/blacklist-iptables.conf
new file mode 100644
index 0000000..4655374
--- /dev/null
+++ b/ansible/roles/disableFirewall/files/modprobe.d/blacklist-iptables.conf
@@ -0,0 +1,13 @@
+# Don't load iptables on startup (or ever)!
+
+# These look weird, but the 'blacklist' command still allows
+# module insertion.
+#
+# This method defines a load-time alias so when you load the module,
+# it runs a delegated command to load the module instead, but in
+# the case of denying modules completely, just run nothing.
+install ip6table_filter /bin/true
+install iptable_filter /bin/true
+install ip6_tables /bin/true
+install ip_tables /bin/true
+install x_tables /bin/true
diff --git a/ansible/roles/disableFirewall/tasks/main.yml b/ansible/roles/disableFirewall/tasks/main.yml
new file mode 100644
index 0000000..9454702
--- /dev/null
+++ b/ansible/roles/disableFirewall/tasks/main.yml
@@ -0,0 +1,22 @@
+---
+# Our mail systems only listen to SMTP(S) and IMAP(S)
+# so we can disable all firewalls
+# This stops ufw, then uninstalls ufw and iptables (and ip6tables)
+- name: remove firewall
+  apt:
+    name: iptables
+    state: absent
+  register: firewallKaboom
+
+# removing iptables doesn't actually stop iptables processing,
+# so let's force remove all packet processing from the kernel itself here
+# TODO: this conditional could be better. would be nice if we had a fact
+#       of loaded kernel modules to query the presence/absence of
+- name: unload firewall
+  command: modprobe -r ip6table_filter iptable_filter ip6_tables ip_tables x_tables
+  when: firewallKaboom.changed
+
+- name: disable iptables from reappearing in the future
+  copy:
+    src: modprobe.d/
+    dest: /etc/modprobe.d/