Ansible-pfsense / pfsensible.core

This is a set of modules to allow you to configure pfSense firewalls with ansible.

Installation using ansible galaxy

Ansible Galaxy (as of version 2.9) now has an option for collections. A collection is a distribution format for delivering all type of Ansible content (not just roles as it was before). We have renamed the collection 'pfsensible.core' for galaxy distribution. To install:

ansible-galaxy collection install pfsensible.core

Optionally, you can specify the path of the collection installation with the -p option.

ansible-galaxy collection install pfsensible.core -p ./path_to_collections

Additionally, you can set the collections_paths option in your ansible.cfg file to automatically designate install locations.

# ansible.cfg
[defaults]
collections_paths=collections

Configuration

The Python interpreter is in a non-standard location on pfSense, so you will need to set in your playbook or hosts vars:

ansible_python_interpreter: /usr/local/bin/python2.7

Note: starting with pfSense 2.4.5, you have to use python 3.7

Modules

The following modules are currently available:

pfsensible.core.alias for aliases
pfsensible.core.authserver_ldap for LDAP authentication servers
pfsensible.core.ca for Certificate Authorities
pfsensible.core.gateway for routing gateways
pfsensible.core.group for groups
pfsensible.core.interface for interfaces (EXPERIMENTAL)
pfsensible.core.ipsec for ipsec tunnels and phase 1 options
pfsensible.core.ipsec_proposal for ipsec proposals
pfsensible.core.ipsec_p2 for ipsec tunnels phase 2 options
pfsensible.core.nat_outbound for outbound NAT rules
pfsensible.core.nat_port_forward for port forward NAT rules
pfsensible.core.route for routes
pfsensible.core.rule for rules
pfsensible.core.rule_separator for rule separators
pfsensible.core.setup for general setup
pfsensible.core.user for users
pfsensible.core.vlan for vlans

Bulk modules

These modules allow you to make important changes at once and, using the purge parameters, to keep the targets configuration strictly synchronized with your playbooks:

pfsensible.core.aggregate for aliases, rules, rule separators, interfaces and vlans
pfsensible.core.ipsec_aggregate for ipsec tunnels, phases 1, phases 2 and proposals

Operation

Modules in the collection work by editing /cf/conf/config.xml using xml.etree.ElementTree, then calling the appropriate php update function via the pfsense php developer shell.

Some formatting is lost, and CDATA items are converted to normal entries, but so far no problems with that have been noted.

License

GPLv3.0 or later

NeilHanlon / core