# Verwaltet von Ansible (Rolle pve-cluster, Vorlage cluster.fw.j2). Änderungen im Repo, nicht hier.
[OPTIONS]

enable: {{ 1 if knaster_pve.firewall.enable else 0 }}
policy_in: DROP
policy_out: ACCEPT
log_ratelimit: enable=1,rate=10/second,burst=5

[IPSET management] # Zugang zu 8006, 22, 5900-5999, 3128, 60000-60050 (Proxmox-Standardregeln)

{% for host in groups['pve_all'] | sort %}
{{ hostvars[host].ansible_host }} # Knoten {{ host }}
{% endfor %}
{% for m in knaster_pve.firewall.management %}
{{ m.ip }} # {{ m.comment }}
{% endfor %}

[RULES]

IN ACCEPT -source {{ knaster_pve.firewall.ping_from }} -p icmp -log nolog # Ping aus dem LAN