parametetrs: | parametetrs: | ||||
iptables: | iptables: | ||||
service: | service: | ||||
enabled: True | |||||
chain: | chain: | ||||
INPUT: | INPUT: | ||||
rules: | rules: | ||||
jump: ACCEPT | jump: ACCEPT | ||||
IPv6 is supported as well | IPv6 is supported as well | ||||
.. code-block:: yaml | .. code-block:: yaml | ||||
parameters: | parameters: | ||||
iptables: | iptables: | ||||
service: | service: | ||||
enabled: True | |||||
ipv6: True | |||||
chain: | chain: | ||||
INPUT: | INPUT: | ||||
rules: | rules: | ||||
- protocol: tcp | - protocol: tcp | ||||
family: ipv6 | |||||
family: ipv6 | |||||
destination_port: 22 | destination_port: 22 | ||||
source_network: 2001:DB8::/32 | source_network: 2001:DB8::/32 | ||||
jump: ACCEPT | jump: ACCEPT | ||||
Read more | Read more | ||||
========= | ========= | ||||
- policy: {{ chain.policy }} | - policy: {{ chain.policy }} | ||||
- table: filter | - table: filter | ||||
{%- if service.ipv6 %} | |||||
iptables_{{ chain_name }}_ipv6_policy: | iptables_{{ chain_name }}_ipv6_policy: | ||||
iptables.set_policy: | iptables.set_policy: | ||||
- family: ipv6 | - family: ipv6 | ||||
- chain: {{ chain_name }} | - chain: {{ chain_name }} | ||||
- policy: {{ chain.policy }} | - policy: {{ chain.policy }} | ||||
- table: filter | - table: filter | ||||
{%- endif %} | |||||
{%- endif %} | {%- endif %} | ||||
{%- for service_name, service in pillar.items() %} | {%- for service_name, service in pillar.items() %} |
- require_in: | - require_in: | ||||
- iptables: iptables_flush | - iptables: iptables_flush | ||||
{%- if service.ipv6 %} | |||||
iptables_{{ chain_name }}_ipv6_policy: | iptables_{{ chain_name }}_ipv6_policy: | ||||
iptables.set_policy: | iptables.set_policy: | ||||
- chain: {{ chain_name }} | - chain: {{ chain_name }} | ||||
- table: filter | - table: filter | ||||
- require_in: | - require_in: | ||||
- iptables: ip6tables_flush | - iptables: ip6tables_flush | ||||
{%- endif %} | |||||
{%- endfor %} | {%- endfor %} | ||||
iptables_flush: | iptables_flush: | ||||
iptables.flush | iptables.flush | ||||
{%- if service.ipv6 %} | |||||
ip6tables_flush: | ip6tables_flush: | ||||
iptables.flush: | iptables.flush: | ||||
- family: ipv6 | - family: ipv6 | ||||
{%- endif %} | |||||
{%- endif %} | {%- endif %} |