---
- name: IPtables | Get iptables rules
  command: iptables -L --wait
  register: iptablesrules
  always_run: yes

- name: IPtables | Open vxlan with iptables
  command: /sbin/iptables -I INPUT 1 -p udp --dport 4789 -j ACCEPT -m comment --comment "nuage-vxlan"
  when: "'nuage-vxlan' not in iptablesrules.stdout"

- name: Allow traffic from overlay to underlay
  command: /sbin/iptables -I FORWARD 1 -s {{ nuage_cluster_nw_cidr }} -j ACCEPT -m comment --comment "nuage-overlay-underlay"    
  when: "'nuage-overlay-underlay' not in iptablesrules.stdout"

- name: Allow traffic from underlay to overlay
  command: /sbin/iptables -I FORWARD 1 -d {{ nuage_cluster_nw_cidr }} -j ACCEPT -m comment --comment "nuage-underlay-overlay"   
  when: "'nuage-underlay-overlay' not in iptablesrules.stdout"

---
- name: IPtables | Get iptables rules
  command: iptables -L --wait
  register: iptablesrules
  always_run: yes

- name: IPtables | Open vxlan with iptables
  command: /sbin/iptables -I INPUT 1 -p udp --dport 4789 -j ACCEPT -m comment --comment "nuage-vxlan"
  when: "'nuage-vxlan' not in iptablesrules.stdout"

- name: Allow traffic from overlay to underlay
  command: /sbin/iptables -I FORWARD 1 -s {{ nuage_cluster_nw_cidr }} -j ACCEPT -m comment --comment "nuage-overlay-underlay"    
  when: "'nuage-overlay-underlay' not in iptablesrules.stdout"

- name: Allow traffic from underlay to overlay
  command: /sbin/iptables -I FORWARD 1 -d {{ nuage_cluster_nw_cidr }} -j ACCEPT -m comment --comment "nuage-underlay-overlay"   
  when: "'nuage-underlay-overlay' not in iptablesrules.stdout"

- name: Allow traffic to kube API server 
  command: /sbin/iptables -I INPUT 1 -d {{ kube_service_addresses|ipaddr('net')|ipaddr(1)|ipaddr('address') }} -j ACCEPT -m comment --comment "service-ip-allow"
  when: "'service-ip-allow' not in iptablesrules.stdout" 

Add iptable rule to permit the kube api server IP traffic
Add iptable rule to permit the kube api server IP traffic
