Historique | Voir | Annoter | Télécharger (5,26 ko)
Merge pull request #34 from traylenator/dedupe_flush
Remove duplicate flush on reload
Correct layout of ignore chain example
When nftables was reloaded a flush was being done both in the systemdreload call and in the nft script itself.
Comment why firewalld_enable parameter is required (#40)
Use single line for each parameter definition
lint_fix results
Merge pull request #29 from keachi/fwd_conntrack
Enable conntrack in FORWARD
New parameter noflush_tables to selectivly skip flush
Introduces a new structured fact nftables
```yamlnftables: tables: - inet-filter - ip-nat - ip6-nat - inet-f2b-table```
By default the nft script will continue to contain `nft flush ruleset`...
Merge pull request #22 from cernops/log_limit
Set a customisable rate limit to the logging rules
Allow sourcing sets from Hiera
Allow disabling default NAT tables and chains
Reload rules atomically
Background: The unit file for nftables on CentOS 8 contains:
```ExecStart=/sbin/nft -f /etc/sysconfig/nftables.confExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'ExecStop=/sbin/nft flush ruleset```...
Merge pull request #16 from cernops/icmp
Move ICMP stuff to separate classes allowing better customisation
Make masking Service['firewalld'] configurable
Move ICMP stuff to separate classes
Move ct rules from global to INPUT and OUTPUT
Allow tables to add comments to $log_prefix
Add a parameter to control the fate of discarded packets
Allow customising the log prefix
migrate create_resource to the generic loop over hash approach
create_resource is notorious for not providing exact line/file infowhen something fails. Since in puppet you can now loop over hashesand you have the splat assignment operator. This means you get much...
Allow to inject custom rules
New parameter out_all, default false
In order to allow all outbound traffic a parameter isadded to enable a simple `allow` entry on the out chain.
Default is false so backwards compatible.
If true all the other out_bound rules (ntp, ...) will be disabled...
Stop and mask firewalld service
Split init class
Use default
Rewrite ip-nat to concat
Replace filter with inet-filter
Refactoring
Write some spec tests for init class
Linting
Set NAT only for IPv4
Remove out rule ntp
Duplicate to chrony, but chrony allows every sport (which is required bychrony).
Allow http by default
CentOS mirrors are only available over http.
Apply a base firewall
Allow all services to install updates and manage the node.
initial release
