source: trunk/packages/invirt-web-iptables/files/usr/share/invirt-web-iptables/iptables.rules.mako @ 1255

<%

from invirt.config import structs as cfg
h_port = cfg.vnc.base_port
port = cfg.vnc.base_port

%>\
*nat
:PREROUTING ACCEPT [5:300]
:POSTROUTING ACCEPT [8:674]
:OUTPUT ACCEPT [8:674]
% for h in cfg.hosts:
-A PREROUTING -s ! ${h.ip} -i eth0 -p tcp -m tcp --dport ${port} -j DNAT --to-destination ${h.ip}:${h_port}
-A POSTROUTING -d ${h.ip} -o eth0 -p tcp -m tcp --dport ${h_port} -j SNAT --to-source ${cfg.vnc.proxy_ip}
<% port += 1 %>
% endfor
COMMIT

*filter
:INPUT ACCEPT [366:44912]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [292:53151]
% for h in cfg.hosts:
-A FORWARD -d ${h.ip} -i eth0 -o eth0 -p tcp -m tcp --dport ${h_port} -j ACCEPT 
% endfor
COMMIT