forked from infra/ansible
16 lines
1 KiB
Text
16 lines
1 KiB
Text
# firewall rules to allow openQA openvswitch guests to communicate
|
|
# uses interface definition from host vars
|
|
custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT']
|
|
nft_custom_rules:
|
|
- 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept'
|
|
- 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept'
|
|
- 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept'
|
|
# for iptables rules...maybe other stuff in future? both staging
|
|
# and prod workers are in this group
|
|
host_group: openqa-tap-workers
|
|
nat_rules: [
|
|
# masquerade for openQA openvswitch workers to reach the outside
|
|
'-A POSTROUTING -o {{ openqa_tap_iface }} -j MASQUERADE']
|
|
nft_nat_rules: [
|
|
# masquerade for openQA openvswitch workers to reach the outside
|
|
'add rule {{ nft_table_nat }} POSTROUTING oifname "{{ openqa_tap_iface }}" counter masquerade']
|