38 lines
979 B
YAML
38 lines
979 B
YAML
---
|
|
# Trusted subnets - SSH and all ports allowed from these
|
|
firewall_trusted_subnets:
|
|
- subnet: 100.64.0.0/10
|
|
comment: Tailscale
|
|
- subnet: 204.110.188.0/22
|
|
comment: VNTX
|
|
|
|
# Default policy
|
|
firewall_default_incoming: deny
|
|
firewall_default_outgoing: allow
|
|
|
|
# Per-host rules for publicly exposed services
|
|
# Override in host_vars or group_vars as needed
|
|
# Example:
|
|
# firewall_allow_rules:
|
|
# - port: 80
|
|
# proto: tcp
|
|
# comment: HTTP
|
|
# - port: 443
|
|
# proto: tcp
|
|
# comment: HTTPS
|
|
firewall_allow_rules: []
|
|
|
|
# Routed/forwarding policy (allow, deny, reject)
|
|
# Set to allow on hosts that need to forward traffic (e.g. VPN gateways)
|
|
firewall_default_routed: deny
|
|
|
|
# Enable IP forwarding (sysctl net.ipv4.ip_forward)
|
|
firewall_ip_forward: false
|
|
|
|
# NAT masquerade rules for VPN/routing
|
|
# Example:
|
|
# firewall_masquerade_rules:
|
|
# - source: 10.6.0.0/24
|
|
# out_interface: eth0
|
|
# comment: wireguard-nat-rule
|
|
firewall_masquerade_rules: []
|