# TODO: implement SSH throttle check
# -A INPUT -p tcp -m tcp --dport 22 --rcheck --seconds 10 --name THROTTLE --rsource -j LOGDROP
# -A INPUT -p tcp -m tcp --dport 22 --set --name THROTTLE --rsource -j ACCEPT

default['iptables']['public_ports'] = ['22']
# TAA-885 ssh should only be allowed from hopoff & private subnet in case of AWS Bastion
default['iptables']['ssh_source_ip'] = ['10.0.0.0/8', '50.19.122.235/32']
default['iptables']['private_ports'] = []
#     {
#         :port => '80',
#         :source => '172.16.64.0/20',
#         :comment => 'Allow ELB access'
#     },
#     {
#         :port => '443',
#         :source => '172.16.64.0/20',
#         :comment => 'Allow ELB access'
#     }
# ]
default['iptables']['ip_blacklists_databag'] = 'ip_blacklists'
default['iptables']['ip_blacklists_databag_item'] = 'ip_blacklist_default'
default['iptables']['ip_blacklists_urls']['emergingthreats'] = 'http://rules.emergingthreats.net/fwrules/emerging-IPTABLES-ALL.rules'
