foo.sh/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

iptables: Allow hostnames in iptables rules

Browse source
This commit is contained in:
Timo Makinen 2021-09-11 17:07:35 +00:00
parent 9566266c5c
commit a97f2b5c79
2 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
roles/iptables/templates/ip6tables.j2
View file

@ -12,8 +12,13 @@
{% endif %} {% endif %}
{% for rule in firewall_in %} {% for rule in firewall_in %}
{% if rule.from is defined %} {% if rule.from is defined %}
{% for from in rule.from | ipv6 %} {% for from in rule.from %}
{% if not from | ipv4 and not from | ipv6 %}
{% set from = lookup('dig', from) %}
{% endif %}
{% if from | ipv6 %}
-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} -s {{ from }} --dport {{ rule.port }} -j ACCEPT -A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} -s {{ from }} --dport {{ rule.port }} -j ACCEPT
{% endif %}
{% endfor %} {% endfor %}
{% else %} {% else %}
-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} --dport {{ rule.port }} -j ACCEPT -A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} --dport {{ rule.port }} -j ACCEPT

7
roles/iptables/templates/iptables.j2
View file

@ -12,8 +12,13 @@
{% endif %} {% endif %}
{% for rule in firewall_in %} {% for rule in firewall_in %}
{% if rule.from is defined %} {% if rule.from is defined %}
{% for from in rule.from | ipv4 %} {% for from in rule.from %}
{% if not from | ipv4 and not from | ipv6 %}
{% set from = lookup('dig', from) %}
{% endif %}
{% if from | ipv4 %}
-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} -s {{ from }} --dport {{ rule.port }} -j ACCEPT -A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} -s {{ from }} --dport {{ rule.port }} -j ACCEPT
{% endif %}
{% endfor %} {% endfor %}
{% else %} {% else %}
-A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} --dport {{ rule.port }} -j ACCEPT -A INPUT -m state --state NEW -m {{ rule.proto }} -p {{ rule.proto }} --dport {{ rule.port }} -j ACCEPT