You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
50 lines
1.3 KiB
50 lines
1.3 KiB
--- |
|
- name: install iptables and iptables-persistent |
|
tags: routing |
|
become: yes |
|
apt: |
|
name: [iptables, iptables-persistent] |
|
state: present |
|
|
|
- name: add ssh DNAT rule for containers |
|
tags: routing |
|
iptables: |
|
table: nat |
|
chain: PREROUTING |
|
in_interface: "{{ host_iface }}" |
|
protocol: tcp |
|
match: tcp |
|
source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0/0') }}" |
|
jump: DNAT |
|
destination_port: "{{ hostvars[item]['ansible_port'] }}" |
|
to_destination: "{{ hostvars[item]['internal_ip'] }}" |
|
become: yes |
|
with_items: "{{ groups['containers'] }}" |
|
|
|
- debug: |
|
var: groups['containers'] |
|
tags: routing |
|
|
|
- name: add http and https rules for haproxy container |
|
when: "'haproxy' in groups['containers']" |
|
tags: routing |
|
iptables: |
|
table: nat |
|
chain: PREROUTING |
|
in_interface: "{{ host_iface }}" |
|
protocol: tcp |
|
match: tcp |
|
source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0/0') }}" |
|
jump: DNAT |
|
destination_port: "{{ item }}" |
|
to_destination: "{{ hostvars['haproxy']['internal_ip'] }}" |
|
become: yes |
|
loop: [ 80, 443 ] |
|
|
|
- name: save DNAT rules on lxd host |
|
tags: routing |
|
become: yes |
|
community.general.iptables_state: |
|
table: nat |
|
state: saved |
|
path: /etc/iptables/rules.v4
|
|
|