<commit_before>---

- name: create http nat for infra
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: brinet
    protocol: tcp
    match: tcp
    destination_port: 80
    jump: DNAT
    to_destination: "{{ virtual_machines['ocp-infra'].address }}"
    #to_ports: 80  XXX ansible bug?
    comment: Redirect http traffic to infranode

- name: create http nat MASQUERADE for infra
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 80
    jump: MASQUERADE
    destination: "{{ virtual_machines['ocp-infra'].address }}"
    comment: Masquerade http traffic from infranode

- name: create https nat for infra
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: brinet
    protocol: tcp
    match: tcp
    destination_port: 443
    jump: DNAT
    to_destination: "{{ virtual_machines['ocp-infra'].address }}"
    #to_ports: 443 XXX ansible bug?
    comment: Redirect https traffic to infranode

- name: create https nat MASQUERADE for infra
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 443
    jump: MASQUERADE
    destination: "{{ virtual_machines['ocp-infra'].address }}"
    comment: Masquerade https traffic from infranode

- name: create https nat for master API
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: brinet
    protocol: tcp
    match: tcp
    destination_port: 8443
    jump: DNAT
    to_destination: "{{ virtual_machines['ocp-master'].address }}"
    #to_ports: 8443 XXX ansible bug?
    comment: Redirect 8443 https traffic to master API

- name: create https nat MASQUERADE for master
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 8443
    jump: MASQUERADE
    destination: "{{ virtual_machines['ocp-master'].address }}"
    comment: Masquerade https traffic from master

# - name: mark ssh connections
#   XXX Ansible does not have recent iptables module
#   command: iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
#   iptables:
#     chain: INPUT
#     protocol: tcp
#     destination_port: 22
#     in_interface: brinet
#     ctstate: NEW

- name: create SSH nat for bastion
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: brinet
    protocol: tcp
    match: tcp
    destination: 192.168.3.11
    destination_port: 2222
    jump: DNAT
    to_destination: "{{ virtual_machines['bastion'].address }}:22"
    #to_ports: 22 XXX ansible bug?
    comment: Redirect 222 ssh traffic to bastion

- name: create ssh MASQUERADE for bastion
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 22
    jump: MASQUERADE
    destination: "{{ virtual_machines['bastion'].address }}"
    comment: Masquerade ssh traffic from bastion

- name: allow FORWARD for all guest network DNAT traffic
  tags: fw-host
  iptables:
    chain: FORWARD
    action: insert
    rule_num: 2
    ctstate: NEW,RELATED,ESTABLISHED<commit_msg>allow DNAT for traffic from cluster<commit_after>---

- name: create http nat for infra
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    protocol: tcp
    match: tcp
    destination_port: 80
    jump: DNAT
    to_destination: "{{ virtual_machines['ocp-infra'].address }}"
    #to_ports: 80  XXX ansible bug?
    comment: Redirect http traffic to infranode

- name: create http nat MASQUERADE for infra
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 80
    jump: MASQUERADE
    destination: "{{ virtual_machines['ocp-infra'].address }}"
    comment: Masquerade http traffic from infranode

- name: create https nat for infra
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    protocol: tcp
    match: tcp
    destination_port: 443
    jump: DNAT
    to_destination: "{{ virtual_machines['ocp-infra'].address }}"
    #to_ports: 443 XXX ansible bug?
    comment: Redirect https traffic to infranode

- name: create https nat MASQUERADE for infra
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 443
    jump: MASQUERADE
    destination: "{{ virtual_machines['ocp-infra'].address }}"
    comment: Masquerade https traffic from infranode

- name: create https nat for master API
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    protocol: tcp
    match: tcp
    destination_port: 8443
    jump: DNAT
    to_destination: "{{ virtual_machines['ocp-master'].address }}"
    #to_ports: 8443 XXX ansible bug?
    comment: Redirect 8443 https traffic to master API

- name: create https nat MASQUERADE for master
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 8443
    jump: MASQUERADE
    destination: "{{ virtual_machines['ocp-master'].address }}"
    comment: Masquerade https traffic from master

# - name: mark ssh connections
#   XXX Ansible does not have recent iptables module
#   command: iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
#   iptables:
#     chain: INPUT
#     protocol: tcp
#     destination_port: 22
#     in_interface: brinet
#     ctstate: NEW

- name: create SSH nat for bastion
  tags: fw-host
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: brinet
    protocol: tcp
    match: tcp
    destination: 192.168.3.11
    destination_port: 2222
    jump: DNAT
    to_destination: "{{ virtual_machines['bastion'].address }}:22"
    #to_ports: 22 XXX ansible bug?
    comment: Redirect 2222 ssh traffic to bastion

- name: create ssh MASQUERADE for bastion
  tags: fw-host
  iptables:
    table: nat
    chain: POSTROUTING
    protocol: tcp
    destination_port: 22
    jump: MASQUERADE
    destination: "{{ virtual_machines['bastion'].address }}"
    comment: Masquerade ssh traffic from bastion

- name: allow FORWARD for all guest network DNAT traffic
  tags: fw-host
  iptables:
    chain: FORWARD
    action: insert
    rule_num: 2
    ctstate: NEW,RELATED,ESTABLISHED
{'fraction_non_alphanumeric': 0.08387201034259857, 'fraction_numerical': 0.019230769230769232, 'mean_word_length': 3.045098039215686, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1192676', 'n_tokens_mistral': 2221, 'n_tokens_neox': 1997, 'n_words': 644}