48 lines
2.8 KiB
Django/Jinja
48 lines
2.8 KiB
Django/Jinja
#jinja2: trim_blocks: True, lstrip_blocks: True
|
|
{% for item in nft_managed_group | sort %}
|
|
{% set client = hostvars[item] %}
|
|
{% if 'nft_to' in client and client.nft_to is not none %}
|
|
{% set rules = client.nft_to if (client.nft_to is iterable and client.nft_to is not string) else [client.nft_to] %}
|
|
{% for rule in rules %}
|
|
{% set rule = rule if rule is mapping else {'to': rule} %}
|
|
{% set dests = rule.to if (rule.to is iterable and rule.to is not string) else [rule.to] %}
|
|
{% set protos = rule.proto if (rule.proto is iterable and rule.proto is not string) else [rule.proto | default(none)] %}
|
|
{% set ports = rule.port if (rule.port is iterable and rule.port is not string) else [rule.port | default(none)] %}
|
|
{% for dest in dests %}
|
|
{% if dest.startswith('zone:') %}
|
|
{% set oif = dest.split(':')[1] %}
|
|
{% set daddr = none %}
|
|
{% set dest_name = oif %}
|
|
{% else %}
|
|
{% set oif = hostvars[dest].zone_iface %}
|
|
{% set daddr = hostvars[dest].container_ip %}
|
|
{% set dest_name = dest %}
|
|
{% endif %}
|
|
{% for proto in protos %}
|
|
{% for port in ports %}
|
|
iifname "{{ client.zone_iface }}" ip saddr {{ client.container_ip }} oifname "{{ oif }}" {% if daddr %}ip daddr {{ daddr }} {% endif %}{% if proto and port %}{{ proto }} dport {{ port }} {% endif %}counter accept comment "{{ item }} -> {{ dest_name }}"
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% for item in nft_managed_group | sort %}
|
|
{% set client = hostvars[item] %}
|
|
{% if 'nft_from' in client and client.nft_from is not none %}
|
|
{% set rules = client.nft_from if (client.nft_from is iterable and client.nft_from is not string) else [client.nft_from] %}
|
|
{% for rule in rules %}
|
|
{% set ifaces = rule.iface if (rule.iface is iterable and rule.iface is not string) else [rule.iface] %}
|
|
{% set protos = rule.proto if (rule.proto is iterable and rule.proto is not string) else [rule.proto | default(none)] %}
|
|
{% set ports = rule.port if (rule.port is iterable and rule.port is not string) else [rule.port | default(none)] %}
|
|
{% for iface in ifaces %}
|
|
{% for proto in protos %}
|
|
{% for port in ports %}
|
|
iifname "{{ iface }}" oifname "{{ client.zone_iface }}" ip daddr {{ client.container_ip }} {% if proto and port %}{{ proto }} dport {{ port }} {% endif %}counter accept comment "{{ iface }} -> {{ item }}"
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endfor %}
|