本部分生成企业级Network Security Edge Platform 自动化部署 Ansible Role覆盖企业生产网络入口层Keepalived 高可用 VIPHAProxy L4/L7 Load BalancerNginx Reverse ProxyTraefik GatewayOpenVPN VPN GatewayWireGuard VPNBastion Host 堡垒机JumpServer 运维审计FirewalliptablesnftablesWAFDDoS ProtectionNetwork MonitoringDNS ForwarderTCP/UDP ProxySSL/TLS Certificate Management适用于Ubuntu 22.04 / 24.04 Rocky Linux 9 Debian 12 Kubernetes Docker Ansible 2.15 生产企业网络环境15.29.1 网络安全整体架构Internet | ISP / BGP / CDN | -------------- | | Firewall DDoS | Keepalived VIP | ------------------ | | HAProxy01 HAProxy02 | | ------------------ | Nginx Gateway | ----------------------- | | Kubernetes Ingress VM Service | Service Mesh | Applications15.29.2 Role目录结构创建roles/network-edge-platform/ ├── defaults/ │ └── main.yml ├── tasks/ │ ├── main.yml │ ├── keepalived.yml │ ├── haproxy.yml │ ├── nginx.yml │ ├── traefik.yml │ ├── firewall.yml │ ├── iptables.yml │ ├── nftables.yml │ ├── openvpn.yml │ ├── wireguard.yml │ ├── bastion.yml │ ├── jumpserver.yml │ ├── waf.yml │ ├── ddos.yml │ ├── dns.yml │ ├── ssl.yml │ └── monitoring.yml ├── templates/ │ │ ├── keepalived.conf.j2 │ ├── haproxy.cfg.j2 │ ├── nginx.conf.j2 │ ├── traefik.yml.j2 │ ├── firewall.rules.j2 │ ├── nftables.conf.j2 │ ├── openvpn.conf.j2 │ ├── wireguard.conf.j2 │ ├── ssl-renew.sh.j2 │ └── alert.rules.j2 └── handlers/ └── main.yml15.29.3 默认变量文件roles/network-edge-platform/defaults/main.yml--- network_root: /etc/network-platform ################## # HA ################## enable_keepalived: true vip_address: 10.10.1.100 interface: eth0 ################## # HAProxy ################## haproxy_version: 3.0 haproxy_frontend_port: 443 ################## # Nginx ################## nginx_version: stable ################## # VPN ################## enable_openvpn: true enable_wireguard: true vpn_network: 10.20.0.0/24 ################## # Firewall ################## firewall_backend: nftables ################## # WAF ################## enable_waf: true waf_engine: modsecurity ################## # SSL ################## ssl_provider: letsencrypt15.29.4 Inventory文件inventory/production/hosts.yml--- network_edge: children: load_balancer: hosts: edge01: ansible_host: 10.10.1.10 edge02: ansible_host: 10.10.1.11 vpn: hosts: vpn01: ansible_host: 10.10.2.1015.29.5 Playbook文件playbooks/network-edge.yml--- - name: Deploy Network Edge Platform hosts: network_edge become: true roles: - network-edge-platform15.29.6 Role入口文件tasks/main.yml--- - import_tasks: keepalived.yml - import_tasks: haproxy.yml - import_tasks: nginx.yml - import_tasks: traefik.yml - import_tasks: firewall.yml - import_tasks: iptables.yml - import_tasks: nftables.yml - import_tasks: openvpn.yml - import_tasks: wireguard.yml - import_tasks: bastion.yml - import_tasks: jumpserver.yml - import_tasks: waf.yml - import_tasks: ddos.yml - import_tasks: dns.yml - import_tasks: ssl.yml - import_tasks: monitoring.yml15.29.7 Keepalived 高可用 VIP架构Client | 10.10.1.100 VIP | -------------- | | HAProxy01 HAProxy02 MASTER BACKUP安装- name: install keepalived package: name: keepalived state: present模板templates/keepalived.conf.j2vrrp_instance VI_1 { state MASTER interface {{interface}} virtual_router_id 51 priority 150 authentication { auth_type PASS auth_pass password } virtual_ipaddress { {{vip_address}} } }启动systemctl enable keepalived systemctl restart keepalived验证ip addr show15.29.8 HAProxy用途四层TCP七层HTTPKubernetes入口安装- name: install haproxy package: name: haproxy state: present配置模板templates/haproxy.cfg.j2global log /dev/log local0 maxconn 50000 defaults mode http timeout connect 5s timeout client 60s timeout server 60s frontend https bind *:443 ssl crt /etc/ssl/server.pem default_backend backend_web backend backend_web balance roundrobin server web01 10.10.10.10:443 check server web02 10.10.10.11:443 check检查haproxy -c -f /etc/haproxy/haproxy.cfg15.29.9 Nginx Reverse Proxy架构Client | Nginx | Backend Service安装package: name: nginx模板server { listen 443 ssl; server_name example.com; location / { proxy_pass http://backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }重载nginx -t systemctl reload nginx15.29.10 Traefik GatewayKubernetes入口。安装kubernetes.core.helm: name: traefik chart_ref: traefik/traefik namespace: traefik create_namespace: trueIngressRouteapiVersion: traefik.io/v1alpha1 kind: IngressRoute spec: routes: - match: Host(app.company.com) services: - name: app port: 8015.29.11 Firewall支持firewalldnftablesiptables默认策略Allow: 22 80 443 1194 51820 Deny: Other安装package: name: firewalld规则firewall-cmd \ --add-servicehttps \ --permanent firewall-cmd --reload15.29.12 nftables模板templates/nftables.conf.j2table inet filter { chain input { type filter hook input priority 0; policy drop; tcp dport {22,80,443} accept; icmp type echo-request accept; } }加载nft -f /etc/nftables.conf15.29.13 OpenVPN架构Remote User | OpenVPN Server | Internal Network安装package: name: - openvpn - easy-rsa配置port 1194 proto udp dev tun server 10.20.0.0 255.255.255.0 push redirect-gateway def1 push dhcp-option DNS 10.10.0.10启动systemctl enable openvpn-serverserver15.29.14 WireGuard配置templates/wireguard.conf.j2[Interface] Address 10.30.0.1/24 ListenPort 51820 PrivateKey SERVER_KEY [Peer] PublicKey CLIENT_KEY AllowedIPs 10.30.0.2/32启动wg-quick up wg0查看wg show15.29.15 Bastion Host用途SSH入口运维跳板SSH强化PermitRootLogin no PasswordAuthentication no AllowGroups ops安全策略User | Bastion | Internal Server15.29.16 JumpServer部署services: jumpserver: image: jumpserver/jms_all ports: - 80:80功能SSH审计命令记录权限控制MFA15.29.17 WAF支持ModSecurityOWASP CRS安装package: name: - libapache2-mod-security2规则SQL Injection XSS Command Injection Scanner Detection15.29.18 DDoS Protection策略Layer 3 - Rate Limit Layer 4 - SYN Flood Protection Layer 7 - Request LimitNginxlimit_req_zone $binary_remote_addr zonereq:10m rate10r/s;15.29.19 DNS Forwarder部署package: name: dnsmasq配置server8.8.8.8 cache-size1000015.29.20 SSL自动化Lets Encrypt安装certbot自动续期0 3 * * * certbot renew15.29.21 Network Monitoring采集SNMPNetFlowBlackboxPrometheusscrape_configs: - job_name: network static_configs: - targets: - router:9100GrafanaDashboardHAProxy Metrics Nginx Metrics VPN Users Bandwidth Connection Firewall Drop15.29.22 健康检查脚本scripts/check-network.sh#!/bin/bash echo HAProxy systemctl status haproxy echo Keepalived systemctl status keepalived echo Firewall nft list ruleset echo VPN wg show echo Nginx nginx -t15.29.23 自动部署执行ansible-playbook \ -i inventory/production \ playbooks/network-edge.yml验证ip addr systemctl status keepalived systemctl status haproxy curl https://vip wg show kubectl get ingressPart 15.29完成✅ Keepalived HA VIP✅ HAProxy L4/L7 Load Balancer✅ Nginx Reverse Proxy✅ Traefik Kubernetes Gateway✅ Firewall✅ iptables✅ nftables✅ OpenVPN✅ WireGuard✅ Bastion Host✅ JumpServer✅ ModSecurity WAF✅ DDoS Protection✅ DNS Forwarder✅ SSL自动化✅ Network Monitoring✅ Health Check
