tower-ansible-automating-vyos.yml

- name: Configuring VyOS Host as a NAT Gateway
  hosts: vyos-servers
  gather_facts: True
  connection: local
  
  tasks:
  - name: Configure network interfaces
    vyos_config:
       timeout: 60
       lines:
         - set interfaces ethernet eth0 address '10.17.48.104/22' 
         - set interfaces ethernet eth0 description 'OUTSIDE' 
         - set interfaces ethernet eth1 address '192.168.0.1/24' 
         - set interfaces ethernet eth1 description 'INSIDE'
       save: yes

  - name: Configure Source NAT for our "Inside" network
    vyos_config:
       timeout: 60
       lines:
         - set nat source rule 100 outbound-interface 'eth0'
         - set nat source rule 100 source address '192.168.0.0/24' 
         - set nat source rule 100 translation address masquerade 
       save: yes

  - name: Configure a DHCP Server
    vyos_config:
       timeout: 60
       lines:
         - set service dhcp-server disabled 'false' 
         - set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 default-router '192.168.0.1' 
         - set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 dns-server '192.168.0.1' 
         - set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 domain-name 'internal-network' 
         - set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 lease '86400' 
         - set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 start '192.168.0.9' stop '192.168.0.254' 
       save: yes

  - name: And a DNS forwarder
    vyos_config:
       timeout: 60
       lines:
         - set service dns forwarding cache-size '0' 
         - set service dns forwarding listen-on 'eth1' 
         - set service dns forwarding name-server '8.8.8.8' 
         - set service dns forwarding name-server '8.8.4.4' 
       save: yes

  - name: Add a set of firewall policies for our "Outside" interface
    vyos_config:
       timeout: 60
       lines:
         - set firewall name OUTSIDE-IN default-action 'drop'
         - set firewall name OUTSIDE-IN rule 10 action 'accept'
         - set firewall name OUTSIDE-IN rule 10 state established 'enable'
         - set firewall name OUTSIDE-IN rule 10 state related 'enable'
         - set firewall name OUTSIDE-LOCAL default-action 'drop'
         - set firewall name OUTSIDE-LOCAL rule 10 action 'accept'
         - set firewall name OUTSIDE-LOCAL rule 10 state established 'enable'
         - set firewall name OUTSIDE-LOCAL rule 10 state related 'enable'
         - set firewall name OUTSIDE-LOCAL rule 20 action 'accept'
         - set firewall name OUTSIDE-LOCAL rule 20 icmp type-name 'echo-request'
         - set firewall name OUTSIDE-LOCAL rule 20 protocol 'icmp'
         - set firewall name OUTSIDE-LOCAL rule 20 state new 'enable'
         - set firewall name OUTSIDE-LOCAL rule 30 action 'drop'
         - set firewall name OUTSIDE-LOCAL rule 30 destination port '22'
         - set firewall name OUTSIDE-LOCAL rule 30 protocol 'tcp'
         - set firewall name OUTSIDE-LOCAL rule 30 recent count '4'
         - set firewall name OUTSIDE-LOCAL rule 30 recent time '60'
         - set firewall name OUTSIDE-LOCAL rule 30 state new 'enable'
         - set firewall name OUTSIDE-LOCAL rule 31 action 'accept'
         - set firewall name OUTSIDE-LOCAL rule 31 destination port '22'
         - set firewall name OUTSIDE-LOCAL rule 31 protocol 'tcp'
         - set firewall name OUTSIDE-LOCAL rule 31 state new 'enable'
       save: yes

  - name: Apply the firewall policies
    vyos_config:
       timeout: 60
       lines:
         - set interfaces ethernet eth0 firewall in name 'OUTSIDE-IN'
         - set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'
       save: yes
       
  - name: Show the Configuration
    vyos_command:  
       commands:
         - show configuration commands