add router role

roles/router/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+# specify interface name for masquerade rules
+router_egress_interface: ''
+router_ingress_interface: ''

roles/router/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- name: Save iptables rules
+  ansible.builtin.shell:
+    cmd: iptables-save > /etc/iptables/rules.v4

roles/router/tasks/main.yml

@@ -0,0 +1,41 @@
+---
+- name: Install iptables
+  ansible.builtin.package:
+    name:
+      - iptables
+      - iptables-persistent
+    state: present
+
+
+- name: Enable masquerading on egress interface
+  ansible.builtin.iptables:
+    table: nat
+    chain: POSTROUTING
+    out_interface: "{{ router_egress_interface }}"
+    jump: MASQUERADE
+  notify: Save iptables rules
+
+
+- name: Allow incoming established connections from egress interface
+  ansible.builtin.iptables:
+    chain: FORWARD
+    in_interface: "{{ router_egress_interface }}"
+    out_interface: "{{ router_ingress_interface }}"
+    ctstate: RELATED,ESTABLISHED
+    jump: ACCEPT
+  notify: Save iptables rules
+
+
+- name: Forward traffic from ingress to egress interfaces
+  ansible.builtin.iptables:
+    chain: FORWARD
+    in_interface: "{{ router_ingress_interface }}"
+    out_interface: "{{ router_egress_interface }}"
+    jump: ACCEPT
+  notify: Save iptables rules
+
+
+- name: Enable IP forwarding
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: '1'