From 8f474132e671d049e56068210aa19cdce77ab807 Mon Sep 17 00:00:00 2001 From: Robin Schneider Date: Mon, 18 Jan 2021 22:38:02 +0100 Subject: [PATCH 01/15] The Ansible fetch module does not have a backup parameter Ref: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/fetch_module.html --- tasks/fetch.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/tasks/fetch.yml b/tasks/fetch.yml index 9c81177..6c26b1e 100644 --- a/tasks/fetch.yml +++ b/tasks/fetch.yml @@ -4,5 +4,4 @@ src: "{{ config_path }}" dest: "{{ local_config_path }}" flat: true - backup: true ... From 78ad630e398550c087c3c8e275bdfb20ad606521 Mon Sep 17 00:00:00 2001 From: Robin Schneider Date: Mon, 18 Jan 2021 23:49:05 +0100 Subject: [PATCH 02/15] Add factory OPNsense 20.7 config --- templates/conf/config.xml.j2 | 776 +++++++++++++++++++++++++++++++++++ 1 file changed, 776 insertions(+) create mode 100644 templates/conf/config.xml.j2 diff --git a/templates/conf/config.xml.j2 b/templates/conf/config.xml.j2 new file mode 100644 index 0000000..86e1791 --- /dev/null +++ b/templates/conf/config.xml.j2 @@ -0,0 +1,776 @@ + + + + opnsense + + + Increase UFS read-ahead speeds to match the state of hard drives and NCQ. + vfs.read_max + default + + + Set the ephemeral port range to be lower. + net.inet.ip.portrange.first + default + + + Drop packets to closed TCP ports without returning a RST + net.inet.tcp.blackhole + default + + + Do not send ICMP port unreachable messages for closed UDP ports + net.inet.udp.blackhole + default + + + Randomize the ID field in IP packets + net.inet.ip.random_id + default + + + + Source routing is another way for an attacker to try to reach non-routable addresses behind your box. + It can also be used to probe for information about your internal networks. These functions come enabled + as part of the standard FreeBSD core system. + + net.inet.ip.sourceroute + default + + + + Source routing is another way for an attacker to try to reach non-routable addresses behind your box. + It can also be used to probe for information about your internal networks. These functions come enabled + as part of the standard FreeBSD core system. + + net.inet.ip.accept_sourceroute + default + + + + This option turns off the logging of redirect packets because there is no limit and this could fill + up your logs consuming your whole hard drive. + + net.inet.icmp.log_redirect + default + + + Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway) + net.inet.tcp.drop_synfin + default + + + Enable sending IPv6 redirects + net.inet6.ip6.redirect + default + + + Enable privacy settings for IPv6 (RFC 4941) + net.inet6.ip6.use_tempaddr + default + + + Prefer privacy addresses and use them over the normal addresses + net.inet6.ip6.prefer_tempaddr + default + + + Generate SYN cookies for outbound SYN-ACK packets + net.inet.tcp.syncookies + default + + + Maximum incoming/outgoing TCP datagram size (receive) + net.inet.tcp.recvspace + default + + + Maximum incoming/outgoing TCP datagram size (send) + net.inet.tcp.sendspace + default + + + Do not delay ACK to try and piggyback it onto a data packet + net.inet.tcp.delayed_ack + default + + + Maximum outgoing UDP datagram size + net.inet.udp.maxdgram + default + + + Handling of non-IP packets which are not passed to pfil (see if_bridge(4)) + net.link.bridge.pfil_onlyip + default + + + Set to 1 to additionally filter on the physical interface for locally destined packets + net.link.bridge.pfil_local_phys + default + + + Set to 0 to disable filtering on the incoming and outgoing member interfaces. + net.link.bridge.pfil_member + default + + + Set to 1 to enable filtering on the bridge interface + net.link.bridge.pfil_bridge + default + + + Allow unprivileged access to tap(4) device nodes + net.link.tap.user_open + default + + + Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid()) + kern.randompid + default + + + Maximum size of the IP input queue + net.inet.ip.intr_queue_maxlen + default + + + Disable CTRL+ALT+Delete reboot from keyboard. + hw.syscons.kbd_reboot + default + + + Enable TCP extended debugging + net.inet.tcp.log_debug + default + + + Set ICMP Limits + net.inet.icmp.icmplim + default + + + TCP Offload Engine + net.inet.tcp.tso + default + + + UDP Checksums + net.inet.udp.checksum + default + + + Maximum socket buffer size + kern.ipc.maxsockbuf + default + + + Page Table Isolation (Meltdown mitigation, requires reboot.) + vm.pmap.pti + default + + + Disable Indirect Branch Restricted Speculation (Spectre V2 mitigation) + hw.ibrs_disable + default + + + Hide processes running as other groups + security.bsd.see_other_gids + default + + + Hide processes running as other users + security.bsd.see_other_uids + default + + + Enable/disable sending of ICMP redirects in response to IP packets for which a better, + and for the sender directly reachable, route and next hop is known. + + net.inet.ip.redirect + 0 + + + + Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects + to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect + packets without returning a response. + + net.inet.icmp.drop_redirect + 1 + + + Maximum outgoing UDP datagram size + net.local.dgram.maxdgram + default + + + + normal + OPNsense + localdomain + + + admins + System Administrators + system + 1999 + 0 + page-all + + + root + System Administrator + system + admins + $2y$10$CWpKw8H/.PwF2kHcvh5bXuLC1rzq/N9FOOM7kAAnBS0.ksWOI/0bO + 0 + + 2000 + 2000 + Etc/UTC + 0.opnsense.pool.ntp.org 1.opnsense.pool.ntp.org 2.opnsense.pool.ntp.org 3.opnsense.pool.ntp.org + + https + 60061767b5b36 + + yes + 1 + + 1 + 1 + 1 + 1 + + hadp + hadp + hadp + + monthly + + 60 + aesni + 1 + 1 + + admins + + + + 0 + + + + + OPNsense-Backup + + + + + + 1 + vtnet0 + + dhcp + dhcp6 + + + 1 + + + + 0 + + + 1 + Loopback + 1 + lo0 + 127.0.0.1 + ::1 + 8 + 128 + none + 1 + + + + + 1 + + + + + public + + + + + + + pass + inet + Default allow LAN to any rule + lan + + lan + + + + + + + pass + inet6 + Default allow LAN IPv6 to any rule + lan + + lan + + + + + + + + + + + + ICMP + icmp + ICMP + + + + TCP + tcp + Generic TCP + + + + HTTP + http + Generic HTTP + + / + + 200 + + + + HTTPS + https + Generic HTTPS + + / + + 200 + + + + SMTP + send + Generic SMTP + + + 220 * + + + + + 0.opnsense.pool.ntp.org + + + system_information-container:00000000-col3:show,services_status-container:00000001-col4:show,gateways-container:00000002-col4:show,interface_list-container:00000003-col4:show + 2 + + + (system) + + /usr/local/opnsense/mvc/script/run_migrations.php made changes + + + + + + + + + + + + + + + + + + + + + + v9 + + + + 0 + + 1800 + 15 + + + + + + + + 0 + 0 + 0 + wan + 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12 + + + W0D23 + 4 + ac + + medium + + + + 0 + 0 + 0 + + + + + + + + + 0 + 120 + 120 + 127.0.0.1 + 25 + + + 0 + auto + 1 + syslog facility log_daemon + + + + 0 + root + 6yqmPxbENQMwI58QVHa + 2812 + + + 5 + 1 + + + 0 + root@localhost.local + 0 + + + 10 + + + + 1 + $HOST + system + + + + 300 +
+ + + + 61e0a048-6e67-49f6-b1e3-b9a5fb0a4b06,bffcec47-86b6-4390-9612-9a979014de13,be36c81f-737b-45ab-9b62-6cd73bf9e1ce,f64a6dca-9e5d-4daa-87e2-e11f9c7c1130 + + + + 1 + RootFs + filesystem + + + / + 300 +
+ + + + 6618d148-bea3-4807-b3a7-390a6f4b4563 + + + + 0 + carp_status_change + custom + + + /usr/local/opnsense/scripts/OPNsense/Monit/carp_status + 300 +
+ + + + c0aea468-9a0b-4fc4-b1b1-50d60a54a331 + + + + 0 + gateway_alert + custom + + + /usr/local/opnsense/scripts/OPNsense/Monit/gateway_alert + 300 +
+ + + + 92889cb7-ce7e-4e81-9a7d-7e18bc4c1a56 + + + + Ping + NetworkPing + failed ping + alert + + + + NetworkLink + NetworkInterface + failed link + alert + + + + NetworkSaturation + NetworkInterface + saturation is greater than 75% + alert + + + + MemoryUsage + SystemResource + memory usage is greater than 75% + alert + + + + CPUUsage + SystemResource + cpu usage is greater than 75% + alert + + + + LoadAvg1 + SystemResource + loadavg (1min) is greater than 2 + alert + + + + LoadAvg5 + SystemResource + loadavg (5min) is greater than 1.5 + alert + + + + LoadAvg15 + SystemResource + loadavg (15min) is greater than 1 + alert + + + + SpaceUsage + SpaceUsage + space usage is greater than 75% + alert + + + + ChangedStatus + ProgramStatus + changed status + alert + + + + NonZeroStatus + ProgramStatus + status != 0 + alert + + + + + + + + + 0 + opnsense + + + + 1 + 1 + + + + + + 0 + on + strip + 1 + 0 + + admin@localhost.local + + + + 0 + /var/squid/cache + 256 + + 100 + 16 + 256 + 0 + 0 + + + + 0 + 2048 + 1024 + 1024 + 256 + + + 0 + + 0 + username + password + + + + + + + lan + 3128 + 3129 + 0 + 0 + + + 4 + 5 + 0 + 3401 + public + + 2121 + 0 + 1 + 0 + + + + + + + + + 80:http,21:ftp,443:https,70:gopher,210:wais,1025-65535:unregistered ports,280:http-mgmt,488:gss-http,591:filemaker,777:multiling http + 443:https + + + + + + + 0 + icap://[::1]:1344/avscan + icap://[::1]:1344/avscan + 1 + 0 + 0 + X-Username + 1 + 1024 + 60 + + + + + + OPNsense proxy authentication + 2 + 5 + + + + +