---
profile::openstack::dashboard::firewall_extras:
  source: '129.177.0.0/16'
  destination: "%{ipaddress_public1}"
profile::openstack::network::calico::firewall_extras:
  source: '172.18.0.0/19'
profile::openstack::identity::firewall_extras:
  source: '129.177.0.0/16'
profile::openstack::identity::firewall_extras_a:
  destination: "%{ipaddress_mgmt1}"
profile::openstack::network::controller::firewall_extras:
  source: '129.177.0.0/16'
profile::openstack::image::api::firewall_extras:
  source: '129.177.0.0/16'
profile::openstack::image::registry::firewall_extras:
  source: '129.177.0.0/16'
profile::openstack::compute::api::firewall_extras:
  source: '129.177.0.0/16'

---
profile::openstack::dashboard::firewall_extras:
  source: '0.0.0.0/0'
  destination: "%{ipaddress_public1}"
profile::openstack::network::calico::firewall_extras:
  source: '172.18.0.0/19'
profile::openstack::identity::firewall_extras:
  source: '0.0.0.0/0'
profile::openstack::identity::firewall_extras_a:
  destination: "%{ipaddress_mgmt1}"
profile::openstack::network::controller::firewall_extras:
  source: '0.0.0.0/0'
profile::openstack::image::api::firewall_extras:
  source: '0.0.0.0/0'
profile::openstack::image::registry::firewall_extras:
  source: '0.0.0.0/0'
profile::openstack::compute::api::firewall_extras:
  source: '0.0.0.0/0'

Allow * traffic to bgo master
Allow * traffic to bgo master

Temporarily we'll use the forward chain on bgo leaf 01 to filter
what ranges are allowed to bgo master
