initial upload

roles/firewall/templates/rules-v6.d/18_internal.sh.j2

@@ -0,0 +1,21 @@
+# {{ ansible_managed }}
+
+{% if datacenter_global_networks is defined %}
+ip6tables -N internal-in
+ip6tables -A INPUT -s fe80::/10 -j internal-in
+ip6tables -A INPUT -s fc00::/7 -j internal-in
+{% for net in datacenter_public_ipv6_networks|default([]) %}
+ip6tables -A INPUT -s {{ net }} -j internal-in
+{% endfor %}
+
+ip6tables -N internal-out
+ip6tables -A internal-out -p tcp -m multiport --dports 53,80,443,3306:3310 -m comment --comment "common-services" -j ACCEPT
+ip6tables -A internal-out -p udp -m multiport --dports 53,123 -m comment --comment "common-services" -j ACCEPT
+ip6tables -A internal-out -p icmpv6 -j ACCEPT
+
+ip6tables -A OUTPUT -d fe80::/10 -j internal-out
+ip6tables -A OUTPUT -d fc00::/7 -j internal-out
+{% for net in datacenter_public_ipv6_networks|default([]) %}
+ip6tables -A OUTPUT -d {{ net }} -j internal-out
+{% endfor %}
+{% endif %}