<commit_before>*nat

:CATTLE_PREROUTING -
:CATTLE_POSTROUTING -

-F CATTLE_PREROUTING
-F CATTLE_POSTROUTING

<#if ipAssociations?? >
    <#list ipAssociations as assoc >
-A CATTLE_PREROUTING -m state --state NEW -d ${assoc.ipAddress.address} -j DNAT --to ${assoc.targetIpAddress.address}
-A CATTLE_POSTROUTING -m state --state NEW -s ${assoc.targetIpAddress.address} ! -d ${assoc.subnet.networkAddress}/${assoc.subnet.cidrSize} -j SNAT --to ${assoc.ipAddress.address}
    </#list>
</#if>

<#if ports?? >
    <#list ports as mapping>
        <#if (mapping.publicIpAddress.address)?? && (mapping.privateIpAddress.address)?? && (mapping.port.publicPort)?? && (mapping.port.privatePort)?? >
# TODO Support multiple host IP's so add -d ${mapping.publicIpAddress.address} but make it work for EC2 also.  EC2 is more difficult because the destination IP is not really known to Cattle
-A CATTLE_PREROUTING -p ${mapping.port.protocol} -m addrtype --dst-type LOCAL --dport ${mapping.port.publicPort} -j DNAT --to ${mapping.privateIpAddress.address}:${mapping.port.privatePort}
        </#if><commit_msg>For IPsec traffic to go to Docker IP and not the Cattle IP<commit_after>*nat

:CATTLE_PREROUTING -
:CATTLE_POSTROUTING -

-F CATTLE_PREROUTING
-F CATTLE_POSTROUTING

<#if ipAssociations?? >
    <#list ipAssociations as assoc >
-A CATTLE_PREROUTING -m state --state NEW -d ${assoc.ipAddress.address} -j DNAT --to ${assoc.targetIpAddress.address}
-A CATTLE_POSTROUTING -m state --state NEW -s ${assoc.targetIpAddress.address} ! -d ${assoc.subnet.networkAddress}/${assoc.subnet.cidrSize} -j SNAT --to ${assoc.ipAddress.address}
    </#list>
</#if>

<#if ports?? >
    <#list ports as mapping>
        <#if (mapping.publicIpAddress.address)?? && (mapping.privateIpAddress.address)?? && (mapping.port.publicPort)?? && (mapping.port.privatePort)?? >
            <#-- This is a hack because IPsec traffic must go to the Docker IP and not the Cattle IP -->
            <#if mapping.port.publicPort != 500 && mapping.port.publicPort != 4500 >
-A CATTLE_PREROUTING -p ${mapping.port.protocol} -m addrtype --dst-type LOCAL --dport ${mapping.port.publicPort} -j DNAT --to ${mapping.privateIpAddress.address}:${mapping.port.privatePort}
            </#if>
        </#if>
{'fraction_non_alphanumeric': 0.1497777777777778, 'fraction_numerical': 0.004, 'mean_word_length': 3.8098290598290596, 'pattern_counts': {'":': 0, '<': 22, '<?xml version=': 0, '>': 22, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3320708', 'n_tokens_mistral': 800, 'n_tokens_neox': 788, 'n_words': 199}