diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml
new file mode 100644
index 0000000..fc12fd8
--- /dev/null
+++ b/ansible/vars/standard.yml
@@ -0,0 +1,58 @@
+#security_group_rules: # maybe separate groups more
+#  - { description: "example", direction: "ingress", state: "{{ state }}", secgrp: "domain_controller", etc........}
+#  - { description: "example", direction: "ingress", state: "{{ state }}", secgrp: "domain_controller", etc........}
+
+os_network: external
+
+security_groups:
+  - domain_controller
+  - file_server
+  - wsus_server
+  - chocolatey_server
+  - user_vms
+  - domain_member
+
+remote_group_rules:
+# Domain Controllers
+  - { direction: "ingress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS UDP"}
+  - { direction: "ingress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS TCP"}
+  - { direction: "ingress", protocol: "udp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication UDP"}
+  - { direction: "ingress", protocol: "tcp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication TCP"}
+  - { direction: "ingress", protocol: "udp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP UDP"}
+  - { direction: "ingress", protocol: "tcp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP TCP"}
+  - { direction: "ingress", protocol: "udp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change UDP"}
+  - { direction: "ingress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change TCP"}
+  - { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135,  group: "domain_controller", remote_group: "domain_member", comment: "RPC"}
+  - { direction: "ingress", protocol: "udp", port_min: 137, port_max: 138,  group: "domain_controller", remote_group: "domain_member", comment: "NetBIOS"}
+  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_controller", remote_group: "domain_member", comment: "SMB"}
+  - { direction: "ingress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_controller", remote_group: "domain_member", comment: "LDAPS"}
+  - { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"}
+  - { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"}
+# File servers
+  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted
+# WSUS servers
+  - { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"}
+# Chocolatey servers
+  - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_controller", remote_group: "user_vms", comment: "http"}
+  - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "domain_controller", remote_group: "user_vms", comment: "https"}
+
+# 
+
+remote_ip_rules:
+# User VMs
+  - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"}
+# File servers
+  #- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "<transfer ip>", comment: "SMB"}
+
+# All Winwdows VMs
+  - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5985, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"}
+  - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5985, group: "domain_member", remote_ip: "10.24.3.172/32", comment: "WinRM rundeck 2"}
+  - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5985, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}
+
+
+# ONLY PROTECTED FOR PROXY SSH and http[s]
+  #- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.4.71/32", comment: "SSH rundeck 1"}
+  #- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.172/32", comment: "SSH rundeck 2"}
+  #- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.242/32", comment: "SSH rundeck 3"}
+  #- { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "proxy", remote_group: "<proxy client>", comment: "HTTP proxy"}
+  #- { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "proxy", remote_group: "<proxy client>", comment: "HTTPS proxy"}