# Reglas de firewall L3
firewall_rules = [
  {
    # Permite que los switches (VLAN MANAGEMENT) lleguen a internet para acceder al Dashboard de Meraki
    comment        = "Permitir MANAGEMENT a internet (acceso Dashboard Meraki)"
    policy         = "allow"
    protocol       = "any"
    src_cidr       = "10.2.55.0/24"  # VLAN 109 - MANAGEMENT
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    # Permite que los APs (VLAN APs) lleguen a internet para acceder al Dashboard de Meraki
    comment        = "Permitir APs a internet (acceso Dashboard Meraki)"
    policy         = "allow"
    protocol       = "any"
    src_cidr       = "10.2.54.0/24" # VLAN 108 - APs
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    # Permite que los clientes GUEST (VLAN GUEST) lleguen a internet
    comment        = "Permitir GUEST a internet"
    policy         = "allow"
    protocol       = "any"
    src_cidr       = "10.2.40.0/21"  # VLAN 101 - GUEST
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    comment        = "Acceso Javi a synology"
    policy         = "allow"
    protocol       = "any"
    src_cidr       = "10.2.40.0/21"  # VLAN 101 - GUEST
    src_port       = "any"
    dest_cidr      = "10.2.56.0/24"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    comment        = "Bloqueo temporal switch a 8.8.8.8"
    policy         = "deny"
    protocol       = "any"
    src_cidr       = "192.168.8.50/32"
    src_port       = "any"
    dest_cidr      = "8.8.8.8/32"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    comment        = "Bloqueo especifico DNS Cloudflare 1.1.1.1 desde VC"
    policy         = "deny"
    protocol       = "any"
    src_cidr       = "10.2.48.0/24" # VLAN 102 - VC
    src_port       = "any"
    dest_cidr      = "1.1.1.1/32"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    comment        = "Denegar el resto del trafico de salida"
    policy         = "deny"
    protocol       = "any"
    src_cidr       = "any"
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  }
]