From 79c40fec07d7ea906cf1375fa93a4b202766ba79 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Thu, 24 May 2018 23:40:30 +0200
Subject: move vm roles to subdir

---
 roles/vm/network/templates/firewall.sh_public.j2 | 49 ++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 roles/vm/network/templates/firewall.sh_public.j2

(limited to 'roles/vm/network/templates/firewall.sh_public.j2')

diff --git a/roles/vm/network/templates/firewall.sh_public.j2 b/roles/vm/network/templates/firewall.sh_public.j2
new file mode 100644
index 00000000..df5b1373
--- /dev/null
+++ b/roles/vm/network/templates/firewall.sh_public.j2
@@ -0,0 +1,49 @@
+#!/bin/sh
+
+PUBLIC_IPS="{% if item == 4 %}{{ srv_network_public_firewall_ipv4 | join(' ') }}{% else %}{{ srv_network_public_firewall_ipv6 | join(' ') }}{% endif %}"
+PUBLIC_IF="$2"
+TCP_PORTS="{{ srv_network.public.firewall.tcp_ports | default([]) | join(' ') }}"
+UDP_PORTS="{{ srv_network.public.firewall.udp_ports | default([]) | join(' ') }}"
+
+#####
+IPTABLES="/sbin/ip{% if item == 6 %}6{% endif %}tables"
+ICMP="icmp{% if item == 6 %}v6{% endif %}"
+
+case "$1" in
+  start)
+    $IPTABLES -A INPUT -i $PUBLIC_IF -p $ICMP -j ACCEPT
+    $IPTABLES -A INPUT -i $PUBLIC_IF -m state --state related,established -j ACCEPT
+    for port in $TCP_PORTS; do
+      for ip in $PUBLIC_IPS; do
+        $IPTABLES -A INPUT -i $PUBLIC_IF -d $ip -p tcp --dport $port -j ACCEPT
+      done
+    done
+    for port in $UDP_PORTS; do
+      for ip in $PUBLIC_IPS; do
+        $IPTABLES -A INPUT -i $PUBLIC_IF -d $ip -p udp --dport $port -j ACCEPT
+      done
+    done
+    $IPTABLES -A INPUT -i $PUBLIC_IF -j DROP
+  ;;
+  stop)
+    $IPTABLES -D INPUT -i $PUBLIC_IF -j DROP
+    for port in $UDP_PORTS; do
+      for ip in $PUBLIC_IPS; do
+        $IPTABLES -D INPUT -i $PUBLIC_IF -d $ip -p udp --dport $port -j ACCEPT
+      done
+    done
+    for port in $TCP_PORTS; do
+      for ip in $PUBLIC_IPS; do
+        $IPTABLES -D INPUT -i $PUBLIC_IF -d $ip -p tcp --dport $port -j ACCEPT
+      done
+    done
+    $IPTABLES -D INPUT -i $PUBLIC_IF -m state --state related,established -j ACCEPT
+    $IPTABLES -D INPUT -i $PUBLIC_IF -p $ICMP -j ACCEPT
+  ;;
+  *)
+    echo "Usage: $0 (start|stop)"
+    exit 1
+  ;;
+esac
+
+exit 0
-- 
cgit v1.2.3