- name: masquerade the vpn server traffic coming from cpinput to cpoutput
  iptables:
    table: nat
    chain: POSTROUTING
    source: "{{ hostvars[inventory_hostname].ansible_cpinput.ipv4.network }}/{{ hostvars[inventory_hostname].ansible_cpinput.ipv4.netmask }}"
    out_interface: cpoutput
    jump: MASQUERADE

- name: forward from cpinput
  iptables:
    chain: FORWARD
    in_interface: cpinput
    jump: ACCEPT

- name: masquerade the vpn server traffic coming from cpinput to cpoutput
  iptables:
    table: nat
    chain: POSTROUTING
    source: "{{ hostvars[inventory_hostname].ansible_cpinput.ipv4.network }}/{{ hostvars[inventory_hostname].ansible_cpinput.ipv4.netmask }}"
    out_interface: cpoutput
    jump: MASQUERADE

- name: forward from cpinput
  iptables:
    chain: FORWARD
    in_interface: cpinput
    jump: ACCEPT

- name: set default route to cpouput
  shell: |
    set -e
    ip route del default
    ip route add default dev cpoutput via 10.10.1.1
    # TODO: pass the gateway ip in a variable

Set the default route in the firewall to the cpoutput interface
Set the default route in the firewall to the cpoutput interface
