25 lines
1010 B
Django/Jinja
25 lines
1010 B
Django/Jinja
# {{ ansible_managed }}
|
|
|
|
{% if datacenter_global_networks is defined %}
|
|
iptables -N internal-in
|
|
{% if firewall_allow_internal_dns %}
|
|
iptables -A internal-in -p tcp --dport 53 -m comment --comment "common-dns" -j ACCEPT
|
|
iptables -A internal-in -p udp --dport 53 -m comment --comment "common-dns" -j ACCEPT
|
|
{% endif %}
|
|
|
|
{% for srcip in datacenter_global_networks + datacenter_public_networks %}
|
|
iptables -A INPUT -s {{ srcip }} -j internal-in
|
|
{% endfor %}
|
|
|
|
iptables -N internal-out
|
|
iptables -A internal-out -p tcp -m multiport --dports 53,80,443,2181,3306:3310,8086,10231 -m comment --comment "common-services" -j ACCEPT
|
|
iptables -A internal-out -p udp --dport 53 -m comment --comment "common-dns" -j ACCEPT
|
|
iptables -A internal-out -p tcp --dport 10514 -m owner --uid-owner 0 -m comment --comment "syslog" -j ACCEPT
|
|
iptables -A internal-out -p icmp -j ACCEPT
|
|
|
|
{% for dstip in datacenter_global_networks + datacenter_public_networks %}
|
|
iptables -A OUTPUT -d {{ dstip }} -j internal-out
|
|
{% endfor %}
|
|
|
|
{% endif %}
|