dustin
/
configpolicy
1
1
Fork 0
Code Issues Releases Activity
configpolicy/roles
History
Dustin a1ca06a3c5 Move VPN server to dedicated VM 
The VPN capability of the UniFi Security Gateway is extremely limited.
It does not support road-warrior IPsec/IKEv2 configuration, and its
OpenVPN configuration is inflexible. As with DHCP, the best solution is
to simply move service to another machine.

To that end, I created a new VM, *vpn0.pyrocufflink.blue*, to host both
strongSwan and OpenVPN. For this to work, the necessary TCP/UDP ports
need to be forwarded, of course, and all of the remote subnets need
static routes on the gateway, specifying this machine as the next hop.
Additionally, ICMP redirects need to be disabled, to prevent confusing
the routing tables of devices on the same subnet as the VPN gateway.
 		2018-10-07 21:42:18 -05:00
..
ansible/tasks roles/ansible: Install python-netaddr 2018-04-08 12:33:54 -05:00
apache roles/apache: Do not start Apache 2018-07-29 09:25:54 -05:00
aria2 aria2: Deploy aria2 download manager 2018-08-19 14:17:48 -05:00
base roles/base: Basic config management support 2018-01-29 15:02:10 -06:00
burp-client roles/burp-client: Deploy BURP client 2018-08-08 20:11:46 -05:00
burp-server roles/burp-server: Deploy BURP server 2018-08-08 20:08:16 -05:00
certbot roles/certbot: Reload Apache before cert requests 2018-07-29 09:28:12 -05:00
cronie/tasks roles/cronie: Install cronie 2018-08-08 21:38:56 -05:00
dch-gw dch-gw: Restrict traffic from Management network 2018-07-15 12:16:43 -05:00
dch-openvpn-server Move VPN server to dedicated VM 2018-10-07 21:42:18 -05:00
dch-proxy Move VPN server to dedicated VM 2018-10-07 21:42:18 -05:00
dch-storage-net roles/dch-storage-net: Add After device dependency 2018-07-29 10:14:00 -05:00
dch-vpn-server roles/dch-vpn-server: Update remote access DNS 2018-08-08 21:37:30 -05:00
dhcpcd roles/dhcpcd: Always send FQDN 2018-07-23 17:35:10 -05:00
dhcpd roles/dhcpd: Allow disabling DDNS per-subnet 2018-05-06 13:38:15 -05:00
fileserver roles/fileserver: Deploy Samba file server 2018-08-01 22:04:07 -05:00
freeradius roles/freeradius: Enable/start service 2018-07-23 12:25:14 -05:00
gitea roles/gitea: Allow configuring clone URLs 2018-06-04 20:03:55 -05:00
haproxy roles/haproxy: Basic setup for HAproxy 2018-06-12 22:31:15 -05:00
hostname hostname: Also write /etc/hosts 2018-04-08 10:11:43 -05:00
jenkins-slave roles/jenkins-slave: Prepare host for Jenkins 2018-04-08 11:59:18 -05:00
kerberos roles/kerberos: Configure mit-krb5 2018-01-29 15:05:51 -06:00
koji-builder roles/koji-builder: Deploy the Koji builder 2018-08-12 10:14:25 -05:00
koji-client roles/koji-client: Configure the koji client 2018-08-12 10:05:56 -05:00
koji-gc roles/koji-gc: Deploy the Koji garbage collector 2018-08-12 09:58:56 -05:00
koji-hub roles/koji-hub: Deploy the Koji Hub 2018-08-12 09:33:08 -05:00
koji-web roles/koji-web: Deploy the Koji Web UI 2018-08-12 10:08:01 -05:00
kojira roles/kojira: Deploy the Koji repository agent 2018-08-12 10:04:23 -05:00
named roles/named: Provide default for named_keys 2018-08-12 18:06:14 -05:00
net-ifaces vmhost1: Update net-ifaces script 2018-07-29 10:39:12 -05:00
nftables roles/nftables: Basic nftables configuration 2018-03-27 20:44:43 -05:00
nsswitch roles/nsswitch: Configure glibc name service 2018-03-11 18:16:17 -05:00
ntpd ntp: Initial PB and role to set up ntpd 2018-04-22 11:19:22 -05:00
postfix roles/postfix: Vary shlib directory by arch 2018-08-07 19:51:09 -05:00
postgresql-server roles/postgresql-server: Deploy PostgreSQL 2018-04-14 15:23:44 -05:00
radvd roles/radvd: Support multiple prefixes per network 2018-04-06 20:16:02 -05:00
rhel-network roles/rhel-network: Add static route support 2018-03-27 20:44:43 -05:00
samba roles/samba: Support selecting interfaces 2018-06-23 14:42:45 -05:00
samba-dc roles/samba-dc: Support configuring TLS 2018-05-28 15:24:34 -05:00
squid squid: Add role and PB to deploy Squid 2018-08-12 16:00:32 -05:00
ssh-hostkeys Move VPN server to dedicated VM 2018-10-07 21:42:18 -05:00
sshd roles/sshd: Configure OpenSSH daemon 2018-06-06 21:44:28 -05:00
strongswan roles/strongswan: Base role for strongSwan setup 2018-05-20 12:56:27 -05:00
sudo roles/sudo: Configure sudo and policy 2018-03-11 18:16:17 -05:00
system-auth roles/system-auth: Configure PAM system authentication 2018-03-11 18:16:17 -05:00
trustca roles/trustca: Generic role for adding CA certs 2018-06-04 20:03:55 -05:00
vmhost roles/vmhost: Open libvirt migration firewall port 2018-07-29 10:39:36 -05:00
websites websites: Add role for darkchestofwonders.us 2018-07-29 09:34:41 -05:00
winbind roles/winbind: Actually perform domain join 2018-07-26 16:54:03 -05:00
zabbix-agent roles/zabbix: Respect host_uses_firewalld 2018-06-19 20:37:09 -05:00
zabbix-server roles/zabbix-server: Redirect HTTP -> HTTPS 2018-06-09 14:35:22 -05:00