rc/servers
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects 1 Releases Wiki Activity

proxmox: support public services for firewall

Browse source 
If no allowed IPs are set for a service, allow connections from anywhere.
This commit is contained in:
Timotej Lazar 2024-09-04 16:44:46 +02:00
parent 6b1d871392
commit 1c1dd52325
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
roles/proxmox/templates/cluster.fw.j2
View file

@ -11,11 +11,15 @@ IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('famil
{% for service in cluster_services %} {% for service in cluster_services %}
{% set prefixes = service | allowed_prefixes %} {% set prefixes = service | allowed_prefixes %}
{% set ports = service.ports | compact_numlist(range_delimiter=':') %} {% set ports = service.ports | compact_numlist(range_delimiter=':') %}
{% if prefixes %}
{% if prefixes | ipv4 %} {% if prefixes | ipv4 %}
IN ACCEPT -source {{ prefixes | ipv4 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }} IN ACCEPT -source {{ prefixes | ipv4 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }}
{% endif %} {% endif %}
{% if prefixes | ipv6 %} {% if prefixes | ipv6 %}
IN ACCEPT -source {{ prefixes | ipv6 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }} IN ACCEPT -source {{ prefixes | ipv6 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }}
{% endif %} {% endif %}
{% else %}
IN ACCEPT -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }}
{% endif %}
{% endfor %} {% endfor %}