---
# defaults file for ansible-iptables

##########################
# IPv4 config
##########################

# Default action for: :INPUT DROP
iptables_initial_input_action: DROP

# Default action for: :FORWARD ACCEPT
iptables_initial_forward_action: ACCEPT

# Default action for: :OUTPUT ACCEPT
iptables_initial_output_action: ACCEPT

# Allow loopback interface (localhost)
iptables_allow_loopback: true

# Allow established and related connections
iptables_allow_established_connections: true

# Allow DNS resolution
iptables_allow_dns: false

# Allow NTP traffic for time synchronization
iptables_allow_ntp: true

# Allow ICMP ping requests
iptables_allow_icmp: true

# Internal network supports list:
# - IP's
# - HOSTS (iptables_internal_ips_from_hosts should be enabled)
iptables_internal_network: []

# Internal resolve IP from given host
iptables_internal_ips_from_hosts: false

# Internal hosts interface
iptables_internal_hosts_interface: "{{ ansible_default_ipv4.interface }}"

# Internal network configuration
iptables_internal_ports:
  - '1024:65535'
  - '111' # Portmapper
  - '161:162' # Simple network management protocol (SNMP).
  - '22' # ssh

# Internal network protocols
iptables_internal_protocols:
  - 'tcp'
  - 'udp'

# External network configuration
iptables_external_ports:
  - '22' # ssh

# External network protocols
iptables_external_protocols:
  - 'tcp'

# Additional rules for iptables
iptables_additional_rules: []

# Log dropped packets
iptables_log_dropped_packets: false

# Log limit of dropped packets in minutes
iptables_log_dropped_limit: 15

# LOGGING log level of dropped packets
iptables_log_logging_level: 4

##########################
# IPv6 config
##########################

# Default action for: :INPUT DROP
iptables6_initial_input_action: DROP

# Default action for: :FORWARD ACCEPT
iptables6_initial_forward_action: ACCEPT

# Default action for: :OUTPUT ACCEPT
iptables6_initial_output_action: ACCEPT

# Allow loopback interface (localhost)
iptables6_allow_loopback: true

# Allow established and related connections
iptables6_allow_established_connections: true

# Allow DNS resolution
iptables6_allow_dns: false

# Allow NTP traffic for time synchronization
iptables6_allow_ntp: true

# Allow ICMP ping requests
iptables6_allow_icmp: true

# Internal network supports list:
# - IP's
# - HOSTS (iptables6_internal_ips_from_hosts should be enabled)
iptables6_internal_network: []

# Internal resolve IP from given host
iptables6_internal_ips_from_hosts: false

# Internal hosts interface
iptables6_internal_hosts_interface: "{{ ansible_default_ipv4.interface }}"

# Internal network configuration
iptables6_internal_ports:
  - '1024:65535'
  - '111' # Portmapper
  - '161:162' # Simple network management protocol (SNMP).
  - '22' # ssh

# Internal network protocols
iptables6_internal_protocols:
  - 'tcp'
  - 'udp'

# External network configuration
iptables6_external_ports:
  - '22' # ssh

# External network protocols
iptables6_external_protocols:
  - 'tcp'

# Additional rules for iptables
iptables6_additional_rules: []

# Log dropped packets
iptables6_log_dropped_packets: false

# Log limit of dropped packets in minutes
iptables6_log_dropped_limit: 15

# LOGGING log level of dropped packets
iptables6_log_logging_level: 4

# NAT
iptables_nat_prerouting: ACCEPT
iptables_nat_output: ACCEPT
iptables_nat_postrouting: ACCEPT

iptables4_nat_additional_rules: []

iptables6_nat_additional_rules: []

- name: Configuring iptables
  hosts: all
  sudo: yes
  roles:
    - role: ernestas-poskus.iptables
      iptables_internal_network: "{{ groups['all'] }}"
      iptables_internal_ips_from_hosts: true # when using hosts, this must be enabled
      iptables_log_dropped_packets: true
      iptables_log_dropped_limit: 1

- name: Configuring iptables
  hosts: all
  sudo: yes
  roles:
    - role: ernestas-poskus.iptables
      iptables_internal_network:
       - 192.168.0.1
       - 192.168.0.2
       - 192.168.0.3
      iptables_log_dropped_packets: true
      iptables_log_dropped_limit: 1