# Managed by Ansible — do not edit manually

*filter

:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER-USER - [0:0]


# --- INPUT ---

# Allow loopback
-A INPUT -i lo -j ACCEPT

# Allow established/related connections
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH
-A INPUT -p tcp --dport {{ firewall_ssh_port }} -j ACCEPT

# Allow additional host ports
{% for port in firewall_allowed_tcp_ports %}
-A INPUT -p tcp --dport {{ port }} -j ACCEPT
{% endfor %}
{% for port in firewall_allowed_udp_ports %}
-A INPUT -p udp --dport {{ port }} -j ACCEPT
{% endfor %}


# --- DOCKER-USER ---

# Allow loopback
-A DOCKER-USER -i lo -j RETURN

# Allow outgoing from Docker IP range
-A DOCKER-USER -s 172.16.0.0/12 -j RETURN

# Whitelist specific TCP ports to containers
{% for port in docker_user_allowed_tcp_ports %}
-A DOCKER-USER -p tcp --dport {{ port }} -j RETURN
{% endfor %}

# Whitelist specific UDP ports to containers
{% for port in docker_user_allowed_udp_ports %}
-A DOCKER-USER -p udp --dport {{ port }} -j RETURN
{% endfor %}

# Allow all already established connections
-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN

# Drop everything else to containers
-A DOCKER-USER -j DROP

COMMIT