58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
# extravars: target_ip, ports
|
|
#
|
|
# Превращает сервер в прозрачный прокси: tcp-порты ports уходят на те же порты target_ip.
|
|
- name: Redirect traffic to target
|
|
hosts: target
|
|
gather_facts: false
|
|
tasks:
|
|
- ansible.builtin.import_tasks: tasks/firewall.yml
|
|
vars:
|
|
firewall_tcp_ports: [ "{{ ansible_port }}" ]
|
|
firewall_forward: true
|
|
|
|
# sysctl при загрузке применяется раньше nftables: без модулей ключи conntrack и bbr не выставятся
|
|
- name: Load forwarding kernel modules on boot
|
|
ansible.builtin.copy:
|
|
dest: /etc/modules-load.d/serverus-forward.conf
|
|
mode: "0644"
|
|
content: |
|
|
nf_conntrack
|
|
tcp_bbr
|
|
|
|
- name: Load forwarding kernel modules
|
|
ansible.builtin.command: modprobe -a nf_conntrack tcp_bbr
|
|
changed_when: false
|
|
|
|
- name: Enable ip forwarding
|
|
ansible.builtin.copy:
|
|
dest: /etc/sysctl.d/90-serverus-forward.conf
|
|
mode: "0644"
|
|
content: |
|
|
net.ipv4.ip_forward = 1
|
|
net.core.default_qdisc = fq
|
|
net.ipv4.tcp_congestion_control = bbr
|
|
net.netfilter.nf_conntrack_max = 2000000
|
|
net.core.netdev_max_backlog = 250000
|
|
net.core.rmem_max = 16777216
|
|
net.core.wmem_max = 16777216
|
|
net.ipv4.tcp_rmem = 4096 87380 16777216
|
|
net.ipv4.tcp_wmem = 4096 65536 16777216
|
|
net.ipv4.tcp_mtu_probing = 1
|
|
net.ipv4.tcp_slow_start_after_idle = 0
|
|
|
|
- name: Apply sysctl
|
|
ansible.builtin.command: sysctl --system
|
|
changed_when: false
|
|
|
|
- name: Install redirect script
|
|
ansible.builtin.copy:
|
|
src: files/redirect.sh
|
|
dest: /usr/local/sbin/serverus-redirect
|
|
mode: "0755"
|
|
|
|
- name: Redirect traffic
|
|
ansible.builtin.command:
|
|
argv: [ /usr/local/sbin/serverus-redirect, "{{ target_ip }}", "{{ ports | join(',') }}" ]
|
|
environment:
|
|
SSH_PORT: "{{ ansible_port }}"
|