updates

ansible/group_vars/resolvers/main.yml

@@ -7,10 +7,25 @@ resolver_allowed_netblocks:
   - 10.0.0.0/8
   - 172.1.0.0/15
   - 100.64.0.0/10
-  - 216.180.128.0/20
+  - 192.168.0.0/16
   - ::1
   - 2606:1c80::/32
 
+# Firewalld trusted subnets (consumed by firewall role).
+# Must mirror resolver_allowed_netblocks to avoid IP-level drops before
+# unbound/Caddy ever see the traffic.
+firewall_trusted_subnets:
+  - subnet: 100.64.0.0/10
+    comment: Tailscale
+  - subnet: 204.110.188.0/22
+    comment: VNTX
+  - subnet: 10.0.0.0/8
+    comment: Internal
+  - subnet: 192.168.0.0/16
+    comment: Internal
+  - subnet: 172.1.0.0/15
+    comment: VNTX
+
 # Domains returned as NXDOMAIN (blocklist). Covers the name and all subdomains.
 # Consumed by unbound.conf.j2 via local-zone ... always_nxdomain.
 resolver_blocked_domains:
@@ -30,9 +45,27 @@ firewall_allow_rules:
   - port: 80
     proto: tcp
     comment: HTTP (Let's Encrypt HTTP-01 challenge)
+    sources:
+      - 100.64.0.0/10
+      - 204.110.188.0/22
+      - 10.0.0.0/8
+      - 192.168.0.0/16
+      - 172.1.0.0/15
+    ipv6_sources:
+      - "::1"
+      - 2606:1c80::/32
   - port: 443
     proto: tcp
     comment: HTTPS (DNS-over-HTTPS)
+    sources:
+      - 100.64.0.0/10
+      - 204.110.188.0/22
+      - 10.0.0.0/8
+      - 192.168.0.0/16
+      - 172.1.0.0/15
+    ipv6_sources:
+      - "::1"
+      - 2606:1c80::/32
 
 # Use the shared resolver Caddyfile instead of the global default.
 caddy_template: Caddyfile-resolver.j2

ansible/group_vars/vntx_servers/main.yml

@@ -6,3 +6,9 @@ firewall_trusted_subnets:
     comment: VNTX
   - subnet: 10.0.0.0/8
     comment: Internal
+  - subnet: 192.168.0.0/16
+    comment: Internal
+  - subnet: 172.1.0.0/15
+    comment: VNTX
+  - subnet: 216.180.128.0/20
+    comment: VNTX

ansible/roles/firewall/tasks/main.yml

@@ -48,17 +48,57 @@
     - ansible_facts['os_family'] == "RedHat"
     - firewall_ssh_allow_from | length > 0
 
-- name: Allow per-host public services in firewalld
+- name: Allow per-host public services in firewalld (unrestricted)
   ansible.posix.firewalld:
     zone: public
     port: "{{ item.port | string }}/{{ item.proto }}"
     permanent: true
     immediate: true
     state: enabled
-  loop: "{{ firewall_allow_rules }}"
+  loop: "{{ firewall_allow_rules | rejectattr('sources', 'defined') | list }}"
   when:
     - ansible_facts['os_family'] == "RedHat"
-    - firewall_allow_rules | length > 0
+    - firewall_allow_rules | rejectattr('sources', 'defined') | list | length > 0
+
+- name: Remove port-level rules for source-restricted services in firewalld
+  ansible.posix.firewalld:
+    zone: public
+    port: "{{ item.port | string }}/{{ item.proto }}"
+    permanent: true
+    immediate: true
+    state: disabled
+  loop: "{{ firewall_allow_rules | selectattr('sources', 'defined') | list }}"
+  when:
+    - ansible_facts['os_family'] == "RedHat"
+    - firewall_allow_rules | selectattr('sources', 'defined') | list | length > 0
+
+- name: Allow source-restricted services in firewalld (IPv4 rich rules)
+  ansible.posix.firewalld:
+    zone: public
+    rich_rule: 'rule family="ipv4" source address="{{ item.1 }}" port port="{{ item.0.port | string }}" protocol="{{ item.0.proto }}" accept'
+    permanent: true
+    immediate: true
+    state: enabled
+  with_subelements:
+    - "{{ firewall_allow_rules | selectattr('sources', 'defined') | list }}"
+    - sources
+  when:
+    - ansible_facts['os_family'] == "RedHat"
+    - firewall_allow_rules | selectattr('sources', 'defined') | list | length > 0
+
+- name: Allow source-restricted services in firewalld (IPv6 rich rules)
+  ansible.posix.firewalld:
+    zone: public
+    rich_rule: 'rule family="ipv6" source address="{{ item.1 }}" port port="{{ item.0.port | string }}" protocol="{{ item.0.proto }}" accept'
+    permanent: true
+    immediate: true
+    state: enabled
+  with_subelements:
+    - "{{ firewall_allow_rules | selectattr('ipv6_sources', 'defined') | list }}"
+    - ipv6_sources
+  when:
+    - ansible_facts['os_family'] == "RedHat"
+    - firewall_allow_rules | selectattr('ipv6_sources', 'defined') | list | length > 0
 
 # --- UFW (Debian/Ubuntu) - Check current state ---