rules::llmnr: Allow interface filtering
rules::ospf3: Allow filtering on incoming interfaces
rules::out::ospf3: Allow filtering on outgoing interfaces
rules::mdns: Allow interface filtering
rules::out::mdns: Allow interface filtering
rules::icmp: Allow ICMP packets with extensions
rules::out:dns: refactor for better readability
Support input interface specification to dns server
Useful when you want to allow docker/podman containersaccess to a hosts dns stub resolver.
```puppetclass{'nftables::rules::dns': iifname => ['docker0'],}```
Additional rules for podman root containers
This class defines additional forwarding rules to let root containersreach external networks when using Netavark (since v4.0) or CNI (deprecated).At the time of writing, Podman supports automatic configuration...
add ftp helper
This adds ability to enable a connection tracker helper and provides typical ftp rules
Co-authored-by: Vadym Chepkov <vchepkov@gmail.com>Co-authored-by: Yury Bushmelev <jay4mail@gmail.com>
chrony: Allow filtering for outgoing NTP servers
Add rule to allow outgoing whois queries
Add class for outgoing PXP connections
Add class for pxp-agent firewalling
rubocop:auto_correct results
Pet rubocop
support a different table name for 'nat'- Some applications (such as libvirt) still use iptables to inject firewall rules- iptables will refuse to update tables that were initially created with nft- This commit allows defining the name of the 'nat' table in order to avoid...
Add rules for QEMU/libvirt guests
Add optional handling of chains
Fix rulename spec in spec
Fix syntax
Add newline & more tests
Add Docker-CE default rules
Add rules for Apache ActiveMQ
add some mail related outgoing rules
Made ctdb rule parameterized
Added to tests
Use Stdlib::Port everywhere in place of Integer
Use Stdlib::Port in place of Integer for ports
Fixes #37
switch naming to puppetserver
Correct NFS udp and tcp port matching
There was a missing `th` from rule which from the examples in the manpage is meant to be there.
Cannot find the docs for what `th` does.
Test NFS rules
Signed-off-by: Dan van der Ster <daniel.vanderster@cern.ch>
Test ceph rules
Move ICMP stuff to separate classes
Add kerberos out and openafs_client out
Add rules for afs3_callback
In particular the afs callback to the cache manager(7001) which is UDP and alwaysIPv4 since there OpenAFS does not support IPv6.
https://wiki.openafs.org/devel/AFSServicePorts/
