Timotej Lazar
036f7c8b74
Like allowed_prefixes, but for single IP addresses. Currently used just for DHCP server to allow (only) packets from relays.
22 lines
919 B
Django/Jinja
22 lines
919 B
Django/Jinja
[OPTIONS]
|
|
|
|
enable: 1
|
|
|
|
[RULES]
|
|
|
|
IN Ping(ACCEPT) -log nolog # don’t be rude
|
|
IN SSH(ACCEPT) -i mgmt # for ansible etc.
|
|
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',') }} # my cluster
|
|
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',') }} # my cluster
|
|
{% for service in cluster_services %}
|
|
{% set prefixes = service | allowed_prefixes %}
|
|
{% set ports = service.ports | compact_numlist(range_delimiter=':') %}
|
|
{% if prefixes | ipv4 %}
|
|
IN ACCEPT -source {{ prefixes | ipv4 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }}
|
|
{% endif %}
|
|
{% if prefixes | ipv6 %}
|
|
IN ACCEPT -source {{ prefixes | ipv6 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }}
|
|
{% endif %}
|
|
{% endfor %}
|
|
|