From 763d7a938cbdea1fb3a2763882db0b6ffd9fbe9c Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sat, 20 Jun 2026 14:21:32 -0500
Subject: [PATCH] updates

---
 ansible/group_vars/resolvers/main.yml    | 35 +++++++++++++++++-
 ansible/group_vars/vntx_servers/main.yml |  6 ++++
 ansible/roles/firewall/tasks/main.yml    | 46 ++++++++++++++++++++++--
 3 files changed, 83 insertions(+), 4 deletions(-)

diff --git a/ansible/group_vars/resolvers/main.yml b/ansible/group_vars/resolvers/main.yml
index 1ca6985..0adb01b 100644
--- a/ansible/group_vars/resolvers/main.yml
+++ b/ansible/group_vars/resolvers/main.yml
@@ -7,10 +7,25 @@ resolver_allowed_netblocks:
   - 10.0.0.0/8
   - 172.1.0.0/15
   - 100.64.0.0/10
-  - 216.180.128.0/20
+  - 192.168.0.0/16
   - ::1
   - 2606:1c80::/32
 
+# Firewalld trusted subnets (consumed by firewall role).
+# Must mirror resolver_allowed_netblocks to avoid IP-level drops before
+# unbound/Caddy ever see the traffic.
+firewall_trusted_subnets:
+  - subnet: 100.64.0.0/10
+    comment: Tailscale
+  - subnet: 204.110.188.0/22
+    comment: VNTX
+  - subnet: 10.0.0.0/8
+    comment: Internal
+  - subnet: 192.168.0.0/16
+    comment: Internal
+  - subnet: 172.1.0.0/15
+    comment: VNTX
+
 # Domains returned as NXDOMAIN (blocklist). Covers the name and all subdomains.
 # Consumed by unbound.conf.j2 via local-zone ... always_nxdomain.
 resolver_blocked_domains:
@@ -30,9 +45,27 @@ firewall_allow_rules:
   - port: 80
     proto: tcp
     comment: HTTP (Let's Encrypt HTTP-01 challenge)
+    sources:
+      - 100.64.0.0/10
+      - 204.110.188.0/22
+      - 10.0.0.0/8
+      - 192.168.0.0/16
+      - 172.1.0.0/15
+    ipv6_sources:
+      - "::1"
+      - 2606:1c80::/32
   - port: 443
     proto: tcp
     comment: HTTPS (DNS-over-HTTPS)
+    sources:
+      - 100.64.0.0/10
+      - 204.110.188.0/22
+      - 10.0.0.0/8
+      - 192.168.0.0/16
+      - 172.1.0.0/15
+    ipv6_sources:
+      - "::1"
+      - 2606:1c80::/32
 
 # Use the shared resolver Caddyfile instead of the global default.
 caddy_template: Caddyfile-resolver.j2
diff --git a/ansible/group_vars/vntx_servers/main.yml b/ansible/group_vars/vntx_servers/main.yml
index 76ca1bf..5d6c2b3 100644
--- a/ansible/group_vars/vntx_servers/main.yml
+++ b/ansible/group_vars/vntx_servers/main.yml
@@ -6,3 +6,9 @@ firewall_trusted_subnets:
     comment: VNTX
   - subnet: 10.0.0.0/8
     comment: Internal
+  - subnet: 192.168.0.0/16
+    comment: Internal
+  - subnet: 172.1.0.0/15
+    comment: VNTX
+  - subnet: 216.180.128.0/20
+    comment: VNTX
diff --git a/ansible/roles/firewall/tasks/main.yml b/ansible/roles/firewall/tasks/main.yml
index ae8a37c..39bee62 100644
--- a/ansible/roles/firewall/tasks/main.yml
+++ b/ansible/roles/firewall/tasks/main.yml
@@ -48,17 +48,57 @@
     - ansible_facts['os_family'] == "RedHat"
     - firewall_ssh_allow_from | length > 0
 
-- name: Allow per-host public services in firewalld
+- name: Allow per-host public services in firewalld (unrestricted)
   ansible.posix.firewalld:
     zone: public
     port: "{{ item.port | string }}/{{ item.proto }}"
     permanent: true
     immediate: true
     state: enabled
-  loop: "{{ firewall_allow_rules }}"
+  loop: "{{ firewall_allow_rules | rejectattr('sources', 'defined') | list }}"
   when:
     - ansible_facts['os_family'] == "RedHat"
-    - firewall_allow_rules | length > 0
+    - firewall_allow_rules | rejectattr('sources', 'defined') | list | length > 0
+
+- name: Remove port-level rules for source-restricted services in firewalld
+  ansible.posix.firewalld:
+    zone: public
+    port: "{{ item.port | string }}/{{ item.proto }}"
+    permanent: true
+    immediate: true
+    state: disabled
+  loop: "{{ firewall_allow_rules | selectattr('sources', 'defined') | list }}"
+  when:
+    - ansible_facts['os_family'] == "RedHat"
+    - firewall_allow_rules | selectattr('sources', 'defined') | list | length > 0
+
+- name: Allow source-restricted services in firewalld (IPv4 rich rules)
+  ansible.posix.firewalld:
+    zone: public
+    rich_rule: 'rule family="ipv4" source address="{{ item.1 }}" port port="{{ item.0.port | string }}" protocol="{{ item.0.proto }}" accept'
+    permanent: true
+    immediate: true
+    state: enabled
+  with_subelements:
+    - "{{ firewall_allow_rules | selectattr('sources', 'defined') | list }}"
+    - sources
+  when:
+    - ansible_facts['os_family'] == "RedHat"
+    - firewall_allow_rules | selectattr('sources', 'defined') | list | length > 0
+
+- name: Allow source-restricted services in firewalld (IPv6 rich rules)
+  ansible.posix.firewalld:
+    zone: public
+    rich_rule: 'rule family="ipv6" source address="{{ item.1 }}" port port="{{ item.0.port | string }}" protocol="{{ item.0.proto }}" accept'
+    permanent: true
+    immediate: true
+    state: enabled
+  with_subelements:
+    - "{{ firewall_allow_rules | selectattr('ipv6_sources', 'defined') | list }}"
+    - ipv6_sources
+  when:
+    - ansible_facts['os_family'] == "RedHat"
+    - firewall_allow_rules | selectattr('ipv6_sources', 'defined') | list | length > 0
 
 # --- UFW (Debian/Ubuntu) - Check current state ---