dataset/seed/host-systemd-machined/templates/risottofirewall.service

[Unit]
Description=Firewall for Risotto
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
%set %%has_rules = False
%for %%dns in %%machined.machines
  %set %%machine = %%normalize_family(%%dns)
  %set %%outgoing = %%machined['machine_' + %%machine]['outgoing_ports_' + %%machine]
  %if %%outgoing
    %set %%ip = %%machined['machine_' + %%machine]['ip_' + %%machine]
    %for %%port in %%outgoing
      %if ':' in %%port
  %set %%protocol, %%port = %%port.split(':')
      %else
  %set %%protocol = 'tcp'
      %end if
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s %%ip -p %%protocol -m %%protocol --dport %%port -o %%output_interface -j MASQUERADE
ExecStop=-/sbin/iptables -t nat -D POSTROUTING -s %%ip -p %%protocol -m %%protocol --dport %%port -o %%output_interface -j MASQUERADE
       %set %%has_rules = False
    %end for
  %end if
%end for
%if not %%has_rules
ExecStart=/usr/bin/echo "No rule"
%end if

[Install]
WantedBy=multi-user.target