pf changes

6 files changed, 10 insertions, 48 deletions

diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
index 87dff41..b971372 100644
--- a/tasks/jail_ingress.yml
+++ b/tasks/jail_ingress.yml
@@ -14,6 +14,9 @@
     group: wheel
     mode: "0644"
 
+- name: Reload pf.conf
+  shell: jexec ingress pfctl -f /etc/pf.conf
+
 - name: Enable gateway mode
   shell: jexec ingress sysrc gateway_enable=YES && jexec ingress sysctl net.inet.ip.forwarding=1
 
diff --git a/tasks/network.yml b/tasks/network.yml
index 3b95380..5f60d05 100644
--- a/tasks/network.yml
+++ b/tasks/network.yml
@@ -42,28 +42,8 @@
     name: syslogd
     state: started
   register: started_syslogd
-
 #- name: Restart syslogd
 #  service:
 #    name: syslogd
 #    state: restarted
 #  when: not started_syslogd.changed and rc_conf.changed
-
-- name: Configure pf
-  template:
-    src: etc_pf.conf.j2
-    dest: /etc/pf.conf
-    owner: root
-    group: wheel
-    mode: "0644"
-    backup: yes
-  register: pf_conf
-
-- name: Start pf
-  service:
-    name: pf
-    state: started
-
-- name: Reload pf rules
-  shell: pfctl -f /etc/pf.conf
-  when: pf_conf.changed
diff --git a/templates/etc_jail.conf.d_[jailname].conf.j2 b/templates/etc_jail.conf.d_[jailname].conf.j2
index a12226d..3e11e4f 100644
--- a/templates/etc_jail.conf.d_[jailname].conf.j2
+++ b/templates/etc_jail.conf.d_[jailname].conf.j2
@@ -22,12 +22,14 @@
   exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b up";
   exec.poststart   += "ifconfig epl{{ jail.num }}a up";
   exec.poststart   += "jexec ${name} ifconfig epl{{ jail.num }}b 192.168.2.{{ jail.num }}/16";
+  exec.poststart   += "jexec ${name} route delete default || echo 'No default route to delete'";
+  {% if jail.name != "ingress" %}
   {% for ing in jails -%}
   {% if ing.name == "ingress" -%}
   exec.poststart   += "jexec ${name} route add default 192.168.2.{{ ing.num }} || echo 'Failed to add default route'";
   {% endif %}
   {% endfor %}
-  {% if jail.name == "ingress" -%}
+  {% else %}
   exec.poststart   += "ifconfig epw{{ jail.num }}b vnet ${name}";
   exec.poststart   += "jexec ${name} ifconfig epw{{ jail.num }}b up";
   exec.poststart   += "ifconfig epw{{ jail.num }}a up";
diff --git a/templates/etc_periodic.conf.j2 b/templates/etc_periodic.conf.j2
index 0e70471..176b55d 100644
--- a/templates/etc_periodic.conf.j2
+++ b/templates/etc_periodic.conf.j2
@@ -1,2 +1,4 @@
 daily_status_smart_enable="YES"
+daily_status_security_inline="YES"
+daily_status_zfs_enable="YES"
 weekly_certbot_enable="YES"
diff --git a/templates/etc_pf.conf.j2 b/templates/etc_pf.conf.j2
deleted file mode 100644
index 87ae43a..0000000
--- a/templates/etc_pf.conf.j2
+++ /dev/null
@@ -1,27 +0,0 @@
-lan_if = "lan0"
-wan_if = "brwan0"
-
-# Default policy
-set skip on lo
-# Allow all traffic on $wan_if. Proper firewall rules are implemented in the ingress jail.
-set skip on $wan_if
-set block-policy return
-scrub in
-
-# Default block all
-block in all
-
-# Allow all outbound traffic
-pass out all keep state
-
-# Allow inbound HTTP/HTTPS on lan0
-pass in on $lan_if proto tcp from any to ($lan_if) port { 80, 443 } keep state
-
-# Allow SSH only on lan0
-pass in on $lan_if proto tcp from any to ($lan_if) port 22 keep state
-
-# Allow all ICMPv6 (required for IPv6 to function correctly)
-pass inet6 proto ipv6-icmp from any to any keep state
-
-# Allow all ICMPv4
-pass inet proto icmp from any to any keep state
diff --git a/templates/ingress/etc_pf.conf.j2 b/templates/ingress/etc_pf.conf.j2
index 3cdad6e..feb35d5 100644
--- a/templates/ingress/etc_pf.conf.j2
+++ b/templates/ingress/etc_pf.conf.j2
@@ -16,5 +16,7 @@ nat on $wan from $lan_net to any -> ($wan)
 # NAT will be applied automatically when source is in $lan_net and going out $wan
 pass out on $wan all keep state
 pass out on $lan all keep state
+
+pass in on $wan inet proto {tcp, udp} from any to any port {80, 443} keep state
 {% endif %}
 {% endfor %}