#
# Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
#
# Insert additional firewall rules to allow required services to function
# Insert them all on rule_num 5, and insert them in reverse order here:
- name: Allow SSH tarpit
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: 22
    ctstate: NEW
    syn: match
    jump: ACCEPT
    comment: Accept new SSH tarpit connections
  become: yes

- name: Allow SSH
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: 1202
    ctstate: NEW
    syn: match
    jump: ACCEPT
    comment: Accept new SSH connections
  become: yes

- name: "Allow HTTP on port {{ item }}"
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: "{{ item }}"
    ctstate: NEW
    syn: match
    jump: ACCEPT
    comment: "Accept new HTTP ({{ item }}) connections"
  with_items:
    - 80
    - 1080
  become: yes

- name: "Allow HTTPS on port {{ item }}"
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: "{{ item }}"
    ctstate: NEW
    syn: match
    jump: ACCEPT
    comment: "Accept new HTTPS ({{ item }}) connections"
  with_items:
    - 443
    - 1443
  become: yes
