initial upload

roles/firewall/templates/rules-v4.d/18_internal.sh.j2

@@ -0,0 +1,24 @@
+# {{ ansible_managed }}
+
+{% if datacenter_global_networks is defined %}
+iptables -N internal-in
+{% if firewall_allow_internal_dns %}
+iptables -A internal-in -p tcp --dport 53 -m comment --comment "common-dns" -j ACCEPT
+iptables -A internal-in -p udp --dport 53 -m comment --comment "common-dns" -j ACCEPT
+{% endif %}
+
+{% for srcip in datacenter_global_networks + datacenter_public_networks %}
+iptables -A INPUT -s {{ srcip }} -j internal-in
+{% endfor %}
+
+iptables -N internal-out
+iptables -A internal-out -p tcp -m multiport --dports 53,80,443,2181,3306:3310,8086,10231 -m comment --comment "common-services" -j ACCEPT
+iptables -A internal-out -p udp --dport 53 -m comment --comment "common-dns" -j ACCEPT
+iptables -A internal-out -p tcp --dport 10514 -m owner --uid-owner 0 -m comment --comment "syslog" -j ACCEPT
+iptables -A internal-out -p icmp -j ACCEPT
+
+{% for dstip in datacenter_global_networks + datacenter_public_networks %}
+iptables -A OUTPUT -d {{ dstip }} -j internal-out
+{% endfor %}
+
+{% endif %}