firewall: add known IP ranges in network ipset definitions
This data should only change in NetBox, so no point deploying it from firewall master. Sometimes the first approach is the best approach.
This commit is contained in:
parent
aa82e5aa18
commit
7ef4023424
|
@ -1,9 +1,18 @@
|
|||
{% for vlan in vlans %}
|
||||
{% set prefixes = query('netbox.netbox.nb_lookup', 'prefixes', api_filter='vlan_id='~vlan.id, raw_data=true) %}
|
||||
{% set prefixes4 = prefixes | selectattr('family.value', '==', 4) | map(attribute='prefix') %}
|
||||
{% set prefixes6 = prefixes | selectattr('family.value', '==', 6) | map(attribute='prefix') %}
|
||||
set {{ vlan.name }} {
|
||||
type ipv4_addr; flags interval
|
||||
{% if prefixes4 %}
|
||||
elements = { {{ prefixes4 | join(', ') }} }
|
||||
{% endif %}
|
||||
}
|
||||
set {{ vlan.name }}/6 {
|
||||
type ipv6_addr; flags interval
|
||||
{% if prefixes6 %}
|
||||
elements = { {{ prefixes6 | join(', ') }} }
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
{% endfor %}
|
||||
|
|
Loading…
Reference in a new issue