Fixes tests

.travis.yml

@@ -1,15 +1,13 @@
 ---
 
 language: python
-python: "2.7"
 
 env:
-  - MOLECULE_DISTRO=ubuntu1404
   - MOLECULE_DISTRO=ubuntu1604
   - MOLECULE_DISTRO=ubuntu1804
   - MOLECULE_DISTRO=debian8 MOLECULE_INIT_CMD=/lib/systemd/systemd
   - MOLECULE_DISTRO=debian9 MOLECULE_INIT_CMD=/lib/systemd/systemd
-  - MOLECULE_DISTRO=centos7 MOLECULE_INIT_CMD=/lib/systemd/systemd
+  - MOLECULE_DISTRO=debian10 MOLECULE_INIT_CMD=/lib/systemd/systemd
 install:
   - pip install docker molecule
 

defaults/main.yml

@@ -77,6 +77,9 @@ openvpn_management_pass: ~
 # Set to true to make the vpn server NAT incoming traffic
 openvpn_route_traffic: false
 
+# Whether to create an iptables rule to allow connections to the openvpn server.
+openvpn_open_firewall: true
+
 # The interface that traffic will come in from. This is used when creating
 # firewall rules to allow the vpn server to successfully forward traffic (see
 # `openvpn_route_traffic`). The interface you specify here will limit these

meta/beats/elasticsearch-ingest-pipelines.yml

@@ -7,6 +7,7 @@ pipeline:
         field: message
         ignore_failure: true
         patterns:
+          # yamllint disable-line rule:line-length
           - "%{TIMESTAMP:openvpn.date} %{DATA} \\[%{DATA:openvpn.common_name}\\] Peer Connection Initiated with \\[AF_INET\\]%{IP:openvpn.host}:%{POSINT:openvpn.port}"
         pattern_definitions:
           TIMESTAMP: "%{DAY} %{MONTH}  ?%{MONTHDAY} %{TIME} %{YEAR}"

meta/beats/heartbeat-monitors.yml

@@ -1,4 +1,5 @@
 # vi: ft=yaml.ansible.jinja2
+# yamllint disable rule:braces
 ---
 
 - name: OpenVPN host up

molecule/default/molecule.yml

@@ -14,12 +14,21 @@ platforms:
     command: ${MOLECULE_INIT_CMD-""}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    sysctls:
+      net.ipv4.ip_forward: 1
     privileged: true
     pre_build_image: true
 provisioner:
   name: ansible
   lint:
     name: ansible-lint
+    options:
+      exclude:
+        - meta/beats
+  options:
+    vvv: true
+  env:
+    IN_MOLECULE: 'true'
 scenario:
   name: default
 verifier:

molecule/default/playbook.yml

@@ -13,14 +13,21 @@
 
     # OpenVPN
     openvpn_keydir: "{{ easyrsa_pki_dir }}"
-    openvpn_clients: "{{ easyrsa_clients }}"
-    openvpn_download_clients: true
+    openvpn_clients: "{{ easyrsa_clients | map(attribute='name') | list }}"
     openvpn_download_dir: /tmp/
     openvpn_ccd_configs:
       - name: client1
         content: '# pass'
       - name: client2
         content: '# pass'
+
+    # Enabled them
+    openvpn_download_clients: false
+    openvpn_open_firewall: false
+    openvpn_route_traffic: false
+    openvpn_unified_client_profiles: false
+    openvpn_management_enable: false
+    openvpn_client_to_client_via_ip: false
   roles:
     - role: nkakouros.easyrsa
     - role: Stouts.openvpn

tasks/core/clients.yml

@@ -71,3 +71,4 @@
     jump: "{{ openvpn_client_to_client_via_ip | ternary('ALLOW', 'DROP') }}"
     comment: drop-client-to-client
   notify: openvpn save iptables
+  when: openvpn_client_to_client_via_ip | bool

tasks/openvpn.yml

@@ -21,7 +21,14 @@
 
 - include_tasks: system/forwarding.yml
 
-- include_tasks: system/firewall.yml
+- include_tasks: system/firewall-deps.yml
+  when:
+    openvpn_open_firewall | bool
+    or openvpn_route_traffic | bool
+    or openvpn_client_to_client_via_ip | bool
+
+- include_tasks: system/open-firewall.yml
+  when: openvpn_open_firewall | bool
 
 - include_tasks: system/routing.yml
   when: openvpn_route_traffic | bool

tasks/system/firewall.yml → tasks/system/firewall-deps.yml

@@ -8,7 +8,11 @@
     packages:
       - iptables
       - iptables-persistent
-      - module-init-tools
+
+- name: Install more firewall deps
+  apt:
+    name: module-init-tools
+  when: ansible_distribution_release == 'jessie'
 
 - name: Read existing iptable rules
   shell: iptables -L
@@ -25,15 +29,3 @@
     - skip_ansible_lint
   register: iptables_nat_rules
   changed_when: false
-
-- name: Allow connections to the OpenVPN server
-  iptables:
-    chain: INPUT
-    in_interface: "{{ openvpn_out_interface | default(omit, true) }}"
-    ctstate: NEW
-    protocol: udp
-    destination_port: "{{ openvpn_port }}"
-    jump: ACCEPT
-    comment: incoming_openvpn
-  notify: openvpn save iptables
-  when: iptables_rules.stdout.find("incoming_openvpn") == -1

tasks/system/firewall-open.yml

@@ -0,0 +1,13 @@
+---
+
+- name: Allow connections to the OpenVPN server
+  iptables:
+    chain: INPUT
+    in_interface: "{{ openvpn_out_interface | default(omit, true) }}"
+    ctstate: NEW
+    protocol: "{{ openvpn_proto }}"
+    destination_port: "{{ openvpn_port }}"
+    jump: ACCEPT
+    comment: incoming_openvpn
+  notify: openvpn save iptables
+  when: iptables_rules.stdout.find("incoming_openvpn") == -1

tasks/system/forwarding.yml

@@ -7,3 +7,4 @@
     sysctl_set: true
     state: present
     reload: true
+  when: not lookup('env', 'IN_MOLECULE') | d(true, true) | bool