# Request for feedback: Ingress hardening and firewall automation with Ansible

**URL:** <https://forum.ansible.com/t/request-for-feedback-ingress-hardening-and-firewall-automation-with-ansible/45227>\
**Category:** Social Space\
**Created:** [January 30, 2026, 7:34pm UTC](https://forum.ansible.com/t/request-for-feedback-ingress-hardening-and-firewall-automation-with-ansible/45227 "2026-01-30T19:34:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gatonero](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gatonero/32/10248_2.png) [@gatonero](https://forum.ansible.com/u/gatonero)\
**Post date:** [January 30, 2026, 7:34pm UTC](https://forum.ansible.com/t/request-for-feedback-ingress-hardening-and-firewall-automation-with-ansible/45227/1 "2026-01-30T19:34:58Z")

</div>

Hello everyone,

I would like to share an Ansible-based setup for Ingress hardening and firewall automation in my homelab and kindly ask for constructive feedback from the community.

The main goal was to establish a **clearly scoped, reproducible, and tested reference state** for a single Internet-facing Ingress host.

## Focus areas

- Firewall hardening using **nftables** (default-deny, explicit allow rules)
- Reverse proxy ( **nginx** ) as the single external entry point
- Clear separation between Ingress security and application behavior
- Practical testing of allowed and disallowed access  
(HTTP/HTTPS, sensitive paths, HTTP methods)
- Documentation of decisions and consciously accepted trade-offs

## Repository

All automation and documentation can be found here:  
[https://github.com/gatonero/homelab-ansible](https://github.com/gatonero/homelab-ansible)

## Motivation

The intent was not “maximum hardening at all costs”, but rather:

- a stable and maintainable setup,
- explicitly reasoned security decisions,
- and a clean, reproducible Ansible implementation.

I would appreciate any feedback, suggestions, or alternative approaches, especially regarding best practices for Ingress hardening with Ansible.

Thank you for your time and insights.

---

<div class="post-metadata">

**Author:** ![BoerBart](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/boerbart/32/10083_2.png) [@BoerBart](https://forum.ansible.com/u/BoerBart)\
**Post date:** [February 18, 2026, 1:24pm UTC](https://forum.ansible.com/t/request-for-feedback-ingress-hardening-and-firewall-automation-with-ansible/45227/2 "2026-02-18T13:24:49Z")

</div>

Hi!

Just stumbled upon this post, I had quick skim through the repo as I don’t have much time. I don’t see any real issues with it from the start, apart from 1 (small) thing, FQCN is not used everywhere. It’s highly suggested to do so, [see this page](https://docs.ansible.com/projects/ansible/latest/reference_appendices/glossary.html#term-Fully-Qualified-Collection-Name-FQCN).

In short, use “ansible.builtin.file” instead of just “file”.

---

<div class="post-metadata">

**Author:** ![cdnca\_ans](https://avatars.discourse-cdn.com/v4/letter/c/45deac/32.png) [@cdnca\_ans](https://forum.ansible.com/u/cdnca_ans)\
**Post date:** [November 2, 2026, 7:07am UTC](https://forum.ansible.com/t/request-for-feedback-ingress-hardening-and-firewall-automation-with-ansible/45227/3 "2026-11-02T07:07:12Z")

</div>

Once nginx is the only host nftables accepts from the WAN, the proxy config matters more than extra allow rules.

Terminate TLS only on that ingress box. Application ports should listen on loopback or an internal NIC that the default-deny table never opens to the internet. Give the catch-all server default\_server and return 444 for unknown SNI or Host so a scan does not hit a real vhost.

Do not append client-supplied forwarding headers. Set X-Forwarded-For, X-Real-IP, and X-Forwarded-Proto yourself, and set the proto to https only on the TLS server. If you append, anyone who can open a connection can spoof the chain.

Keep port 80 for ACME http-01 and redirect every other request. Enable HSTS only after every name you serve has a valid certificate, and never on the default server.