|
| 1 | +.. _modules_nat_one_to_one: |
| 2 | + |
| 3 | +.. include:: ../_include/head.rst |
| 4 | + |
| 5 | +============== |
| 6 | +NAT One-To-One |
| 7 | +============== |
| 8 | + |
| 9 | +**STATE**: unstable |
| 10 | + |
| 11 | +**TESTS**: `Playbook <https://github.com/ansibleguy/collection_opnsense/blob/latest/tests/nat_one_to_one.yml>`_ |
| 12 | + |
| 13 | +**API Docs**: `one_to_one <https://docs.opnsense.org/development/api/core/firewall.html>`_ |
| 14 | + |
| 15 | +**Service Docs**: `one_to_one <https://docs.opnsense.org/manual/nat.html#one-to-one>`_ |
| 16 | + |
| 17 | +Contribution |
| 18 | +************ |
| 19 | + |
| 20 | +Thanks to `@jiuka <https://github.com/jiuka>`_ for developing this module! |
| 21 | + |
| 22 | +---- |
| 23 | + |
| 24 | +Info |
| 25 | +**** |
| 26 | + |
| 27 | +Savepoint |
| 28 | +========= |
| 29 | + |
| 30 | +You can prevent lockout-situations using the savepoint systems: |
| 31 | + |
| 32 | +- :ref:`ansibleguy.opnsense.savepoint <modules_savepoint>` |
| 33 | + |
| 34 | + |
| 35 | +Definition |
| 36 | +********** |
| 37 | + |
| 38 | +.. csv-table:: Definition |
| 39 | + :header: "Parameter", "Type", "Required", "Default", "Aliases", "Comment" |
| 40 | + :widths: 15 10 10 10 10 45 |
| 41 | + |
| 42 | + "match_fields","list","false","['interface', 'external'']","\-","Fields that are used to match configured rules with the running config - if any of those fields are changed, the module will think it's a new rule. At least one of: 'sequence', 'action', 'interface', 'direction', 'ip_protocol', 'protocol', 'source_invert', 'source_net', 'source_port', 'destination_invert', 'destination_net', 'destination_port', 'gateway', 'description', 'uuid'" |
| 43 | + "sequence","int","false","1","seq","Sequence for rule processing, Integer between 1 and 1000000" |
| 44 | + "log","boolean","false","true","l","If rule matches should be shown in the firewall logs" |
| 45 | + "interface","string","false for deletion, else true","\-","i, int","The interface to match this rule on" |
| 46 | + "type","string","false","binnat","\-","NAT type to use. ONE of: binat or nat. See `Some terms explained <https://docs.opnsense.org/manual/nat.html#some-terms-explained>`_." |
| 47 | + "external","string","false for deletion, else true","\-","external_net, ext, e","External subnet's starting address for the 1:1 mapping or network. This is the address or network the traffic will translate to/from." |
| 48 | + "source_net","string","false for deletion, else true","\-","s, src, source","Internal subnet for the 1:1 mapping." |
| 49 | + "source_invert","boolean","false","false","si, src_inv, src_not","Inverted matching of the source." |
| 50 | + "destination_net","string","false","'any'","d, dest, destination","The 1:1 mapping will only be used for connections to or from the specified destination. Hint: this is usually 'any'." |
| 51 | + "destination_invert","boolean","false","false","di, dest_inv, dest_not","Inverted matching of the destination" |
| 52 | + "nat_reflection","string","false","''","\-","One of: '', enable, disable. See `Some terms explained <https://docs.opnsense.org/manual/nat.html#some-terms-explained>`_." |
| 53 | + "description","string","false","\-","desc","Description for the rule" |
| 54 | + "state","string","false","'present'","st","State of the rule. One of: 'present', 'absent'" |
| 55 | + "enabled","boolean","false","true","en","If the rule should be en- or disabled" |
| 56 | + "uuid","string","false","\-","\-","Optionally you can supply the uuid of an existing rule" |
| 57 | + "reload","boolean","false","true","apply", .. include:: ../_include/param_reload.rst |
| 58 | + |
| 59 | +.. include:: ../_include/param_basic.rst |
| 60 | + |
| 61 | +---- |
| 62 | + |
| 63 | +Usage |
| 64 | +***** |
| 65 | + |
| 66 | +To add One-to-One NAT rules - see: `OPNSense Documentation <https://docs.opnsense.org/manual/nat.html#one-to-one>`_ |
| 67 | + |
| 68 | +Examples |
| 69 | +******** |
| 70 | + |
| 71 | +.. code-block:: yaml |
| 72 | +
|
| 73 | + - hosts: localhost |
| 74 | + gather_facts: false |
| 75 | + module_defaults: |
| 76 | + group/ansibleguy.opnsense.all: |
| 77 | + firewall: 'opnsense.template.ansibleguy.net' |
| 78 | + api_credential_file: '/home/guy/.secret/opn.key' |
| 79 | +
|
| 80 | + ansibleguy.opnsense.list: |
| 81 | + target: 'nat_one_to_one' |
| 82 | +
|
| 83 | + tasks: |
| 84 | + # add optional parameters commented-out |
| 85 | + # required ones normally |
| 86 | + # add their default values to get a brief overview of how the module works |
| 87 | + - name: Example |
| 88 | + ansibleguy.opnsense.nat_one_to_one: |
| 89 | + #sequence: 1 |
| 90 | + interface: 'lan' |
| 91 | + #type: binnat |
| 92 | + external: '8.8.8.8' |
| 93 | + source_net: '192.168.0.1' |
| 94 | + #source_invert: false |
| 95 | + #destination_net: 'any' |
| 96 | + #destination_invert: false |
| 97 | + #nat_reflection: '' |
| 98 | + description: 'Map External IP 8.8.8.8 to Internal 192.168.0.1' |
| 99 | + # enabled: true |
| 100 | + # state: 'absent' |
| 101 | + # debug: false |
| 102 | +
|
| 103 | + - name: Listing jobs |
| 104 | + ansibleguy.opnsense.list: |
| 105 | + # target: 'nat_one_to_one' |
| 106 | + register: existing_one_to_one |
| 107 | +
|
| 108 | + - name: Printing |
| 109 | + ansible.builtin.debug: |
| 110 | + var: existing_one_to_one.data |
0 commit comments