Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Clean up ipv4 specific stuff and make custom require different rules from ipv4

Browse source
This commit is contained in:
Kevin Fenzi 2015-02-06 21:29:14 +00:00
parent 80caa9c7bf
commit d4248510ab
2 changed files with 5 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

1
inventory/group_vars/all
View file

@ -17,6 +17,7 @@ libdir: /usr/lib64
udp_ports: [] udp_ports: []
tcp_ports: [] tcp_ports: []
custom_rules: [] custom_rules: []
custom6_rules: []
# defaults for virt installs # defaults for virt installs
ks_url: http://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-7 ks_url: http://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-7

13
roles/base/templates/iptables/ip6tables
View file

@ -20,13 +20,8 @@
# allow ssh - always # allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them # if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %} {% if tcp6_ports is defined %}
{% for port in tcp_ports %} {% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %} {% endfor %}
@ -39,9 +34,9 @@
{% endfor %} {% endfor %}
{% endif %} {% endif %}
# if there are custom rules - put them in as-is # if there are custom6 rules - put them in as-is
{% if custom_rules is defined %} {% if custom6_rules is defined %}
{% for rule in custom_rules %} {% for rule in custom6_rules %}
{{ rule }} {{ rule }}
{% endfor %} {% endfor %}
{% endif %} {% endif %}