# {{ ansible_managed }}

{% if datacenter_global_networks is defined %}
iptables -N internal-in
{% if firewall_allow_internal_dns %}
iptables -A internal-in -p tcp --dport 53 -m comment --comment "common-dns" -j ACCEPT
iptables -A internal-in -p udp --dport 53 -m comment --comment "common-dns" -j ACCEPT
{% endif %}

{% for srcip in datacenter_global_networks + datacenter_public_networks %}
iptables -A INPUT -s {{ srcip }} -j internal-in
{% endfor %}

iptables -N internal-out
iptables -A internal-out -p tcp -m multiport --dports 53,80,443,2181,3306:3310,8086,10231 -m comment --comment "common-services" -j ACCEPT
iptables -A internal-out -p udp --dport 53 -m comment --comment "common-dns" -j ACCEPT
iptables -A internal-out -p tcp --dport 10514 -m owner --uid-owner 0 -m comment --comment "syslog" -j ACCEPT
iptables -A internal-out -p icmp -j ACCEPT

{% for dstip in datacenter_global_networks + datacenter_public_networks %}
iptables -A OUTPUT -d {{ dstip }} -j internal-out
{% endfor %}

{% endif %}