Replace ferm with ufw

roles/common/files/etc_ferm_ferm.conf

@@ -1,36 +0,0 @@
-# Firewall configuration for a web and SMTP server.
-# See http://ferm.foo-projects.org/
-
-table filter {
-    chain INPUT {
-        policy DROP;
-
-        # connection tracking
-        mod state state INVALID DROP;
-        mod state state (ESTABLISHED RELATED) ACCEPT;
-
-        # allow local connections
-        interface lo ACCEPT;
-
-        # respond to ping
-        proto icmp icmp-type echo-request ACCEPT;
-
-        # expose our services to the world:
-        # dns, web, ssh, imap + ssl, smtp + ssl, znc
-        proto tcp dport (25 53 http https ssh 993 465 6697) ACCEPT;
-
-        # openvpn
-        proto udp dport 1194 ACCEPT;
-
-        # mosh port range
-        proto udp dport 60000:61000 ACCEPT;
-
-        # the rest is dropped by the above policy
-    }
-
-    # outgoing connections are not limited
-    chain OUTPUT policy ACCEPT;
-
-    # this is not a router
-    chain FORWARD policy DROP;
-}

roles/common/handlers/ferm.yml

@@ -1,4 +0,0 @@
----
-
-- name: reload ferm rules
-  command: /etc/init.d/ferm reload

roles/common/handlers/main.yml

@@ -12,5 +12,3 @@
 
 - name: restart ssh
   service: name=ssh state=restarted
-
-- include: ferm.yml

roles/common/tasks/ferm.yml

@@ -1,13 +0,0 @@
----
-# Installs and configures ferm, which in turn uses iptables for firewall management
-
-- name: Install ferm
-  apt: pkg=ferm state=present
-
-- name: Create ferm configuration directory
-  file: path=/etc/ferm state=directory
-
-- name: Copy ferm firewall rules into place
-  copy: src=etc_ferm_ferm.conf dest=/etc/ferm/ferm.conf
-  notify:
-    - reload ferm rules

roles/common/tasks/main.yml

@@ -47,5 +47,5 @@
 - include: encfs.yml tags=encfs
 - include: users.yml tags=users
 - include: ssl.yml tags=ssl
-- include: ferm.yml tags=ferm
+- include: ufw.yml tags=ufw
 - include: security.yml tags=security

roles/common/tasks/ufw.yml

@@ -0,0 +1,31 @@
+---
+# Installs and configures ufw, which in turn uses iptables for firewall management
+
+# ufw includes sensible icmp defaults
+- name: Install ufw
+  apt: pkg=ufw state=present
+
+- name: Set firewall rules
+  command: ufw allow {{ item }}
+  register: ufw_result
+  changed_when: "ufw_result.stdout.startswith('Rule')"
+  with_items:
+    - smtp/tcp
+    - domain/tcp
+    - http/tcp
+    - https/tcp
+    - ssh/tcp
+    - ssmtp/tcp
+    - imaps/tcp
+    - 6697/tcp  # znc
+    - openvpn/udp
+    - 60000:61000/udp  # mosh udp packets
+
+- name: Check status of ufw
+  command: ufw status
+  register: ufw_status
+  changed_when: False  # never report as "changed"
+
+- name: Enable ufw
+  command: ufw --force enable
+  when: "ufw_status.stdout.startswith('Status: inactive')"