Update init.pp comments
Change default hash location to /var/tmp to survive reboots and avoid bogus nftables reload
Added shell provider to execs. Hash generate now in array. Ran rubocop:autocorrect
Changed path to use fact. Partial conversion of execs to arrays
Change exec title
Fix typos
Correct docstring
Added purge_unmanaged_rules new variant of method
New clobber_default_config paramter
Certain OSes namely Debian and Archlinux provide default ruleswith the OS.
This module has always respected those rules and appended all ofits own rules to the end of the existing rules.
The new parameter `clobber_default_config` if set `true` (default `false`)...
rules::llmnr: Allow interface filtering
rules::ospf3: Allow filtering on incoming interfaces
rules::out::ospf3: Allow filtering on outgoing interfaces
rules::mdns: Allow interface filtering
rules::out::mdns: Allow interface filtering
rules::icmp: Allow ICMP packets with extensions
out::icmp: simplify filtering/fix ICMP bug
out::icmp: Add parameter documentation
out::icmp: reformat code
simplerule: Allow multiple oifname/iifname
Make "dropping invalid packets" configureable
It doesn't make sense to explicitly drop those pakets when the defaultpolicy is already `DROP`. Also some applications, like ceph, are knownto send packets that might be marked as invalid.
simplerule: Add support for outgoing interface filtering
rules::out:dns: refactor for better readability
simplerule: Add support for incoming interface filtering
Document what the 'auto_merge' parameter does.
Support input interface specification to dns server
Useful when you want to allow docker/podman containersaccess to a hosts dns stub resolver.
```puppetclass{'nftables::rules::dns': iifname => ['docker0'],}```
Merge pull request #214 from traylenator/podman
Additional rules for podman root containers
Example how to redirect one port to another
Add example how to redirect traffic from one port to another.
This class defines additional forwarding rules to let root containersreach external networks when using Netavark (since v4.0) or CNI (deprecated).At the time of writing, Podman supports automatic configuration...
add ftp helper
This adds ability to enable a connection tracker helper and provides typical ftp rules
Co-authored-by: Vadym Chepkov <vchepkov@gmail.com>Co-authored-by: Yury Bushmelev <jay4mail@gmail.com>
provide an option to disable logging rejected packets
samba: Add option to drop traffic
Add nftables rules for ws-discovery
Add rule for incoming SSDP
init.pp: disable check_unsafe_interpolations
Add rule for incoming LLMNR
Add rule for outgoing multicast DNS
Add rule for multicast listener requests (MLDv2)
Rewrite mdns rules to limit to multicast and allow IPv6
This limits the mdns listener to only listen on multicast addresses withport 5353. One rule for IPv4 and one for IPv6, each controllable with aparameter.
The generic 5353 to 5353 rule is dropped since it's redundant when I...
Add rules for IGMP
mDNS: Allow udp port 5353
Add rule to allow multicast DNS
Add rule to allow incoming spotify broadcast
Add rule to allow incoming multicast traffic
change parameters order: required before optional
add ldap and active directory rules
Fix typo in icinga2 rule documentation
Add bridge as a valid family for chain tables
Merge pull request #149 from hugendudel/netdev_support
Allow netdev as table family in defined type nftables::chain
Align filemode on RedHat to distro default
The RPM acutally ships the configuration and directory with0600/0700 while this module sets the mode to 0640/0750.
However, this has the drawback that on new nftables RPM versions,we are setting it back to the modules mode and triggering an nft...
Add class for outgoing HKP firewalling
split conntrack management into dedicated classes so they get consumeable
New nftables::file type to include raw file
For example:
```puppetnftables::file{'geoip': content => "include \"/files/geoipsets/dbip/*.ipv4\"\n",}```
will right a file or content into the nftables configuration.
The file written will be included in configuration....
Merge pull request #144 from duritong/fix-143-properly-escape-rulename
Properly escape bridge in rulename
fix #143 - properly escape rulename for interfaces
Add all families as a valid noflush pattern
nftables has more valid families than the ones currently accepted by themodule.
This patch adds support for all the families currently supported as perthe documentation at:https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families
chrony: Allow filtering for outgoing NTP servers
Add rule to allow outgoing whois queries
Update manifests/rules/pxp_agent.pp
Co-authored-by: Steve Traylen <steve.traylen@cern.ch>
Add class for outgoing PXP connections
Add class for pxp-agent firewalling
Add Debian support
systemctl: Use relative path
make path to echo configureable
make path to `nft` binary configureable
Add support for Arch Linux
Arch Linux stores the configuration in a different path and does notprovide firewalld without explicit installation.
This basically the same as #66 – I've reused their code since it hasn'tbeen merged in a while.
Merge pull request #112 from keachi/ospf_protocol
Use protocol number instead of label
Fix typos in initial reference examples
The label was `ospf` and will be `ospfigp` in the future. Instead ofcreating a map use the protocol number to be compatible with newerversions.
support a different table name for 'nat'- Some applications (such as libvirt) still use iptables to inject firewall rules- iptables will refuse to update tables that were initially created with nft- This commit allows defining the name of the 'nat' table in order to avoid...
fix datatype for $dport
fix datatype for $table
Allow declaring the same set in several tables
Closes #100
Allow creating a totally empty firewall
By setting `nftables::inet_filter` and `nftables::nat` to `false`users can now start off from a totally empty firewall and add thetables, chains and rules they'd like.
The default skeleton for inet-filter, ip-nat and ip6-nat is kept...
Add rules for QEMU/libvirt guests
Add optional handling of chains
Fix doc defaults
Add newline & more tests
Add Docker-CE default rules
Add rules for Apache ActiveMQ
Merge pull request #73 from Koumbit/global_chain_not_hardcoded
start declaring the 'global' chain with module resources
the 'global' chain is a vestigial piece of early development on thismodule, but it can be useful for creating fast short-circuits likeblocking traffic that match a certain set of IPs.
in the current state we can't inject rules inside the 'global' chain...
Improve nftables::rule's documentation (#68)
add some mail related outgoing rules
Merge pull request #64 from traylenator/params
Enable parameter_documentation lint
Merge pull request #62 from glpatcern/master
Added Samba in rules
The linter checks that every parameter has been documented.
While corrections have been made to great many classes some morecomplicated examples have been left for now. Should be updatedas the files get touched.
https://github.com/domcleal/puppet-lint-param-docs
Removed unneeded parentheses
Updated docs
Co-authored-by: Nacho Barrientos <nacho@criptonita.com>
Made ctdb rule parameterized
Pull up rule regexp to type aliases
Align simplerule and rule rulename requirements
Use Stdlib::Port everywhere in place of Integer
Use Stdlib::Port in place of Integer for ports
Fixes #37
Update manifests/set.pp
Docs for nftables::set
switch naming to puppetserver
Prefix custom tables with custom- so they're loaded
Merge pull request #48 from cernops/config_template
Several fixes for nftables::config
Merge pull request #50 from traylenator/moretests
Correct nfs3 invalid udp /tcp matching rule and more tests
