simplerule: Allow multiple oifname/iifname
simplerule: Add support for outgoing interface filtering
simplerule: Add support for incoming interface filtering
fix #184: Add unit string for timeout,gc-interval
New nftables::file type to include raw file
For example:
```puppetnftables::file{'geoip': content => "include \"/files/geoipsets/dbip/*.ipv4\"\n",}```
will right a file or content into the nftables configuration.
The file written will be included in configuration....
make path to `nft` binary configureable
Add support for Arch Linux
Arch Linux stores the configuration in a different path and does notprovide firewalld without explicit installation.
This basically the same as #66 – I've reused their code since it hasn'tbeen merged in a while.
support a different table name for 'nat'- Some applications (such as libvirt) still use iptables to inject firewall rules- iptables will refuse to update tables that were initially created with nft- This commit allows defining the name of the 'nat' table in order to avoid...
Allow creating a totally empty firewall
By setting `nftables::inet_filter` and `nftables::nat` to `false`users can now start off from a totally empty firewall and add thetables, chains and rules they'd like.
The default skeleton for inet-filter, ip-nat and ip6-nat is kept...
Fix IPv4 source address type detection
Before this patch, a rule like this:
``` nftables::simplerule { 'foo': action => 'accept', dport => 443, proto => 'tcp4', saddr => '192.168.1.10', }```
would incorrectly generate this rule:...
fix #74 - ensure table are initialized before flushing them (#75)
Fix IP version filter for IPv6 traffic
Relax type validation in template
It comes already validated from the calling class.
Align template parameters
Encapsulate addr-related exprs in Nftables::Addr
Encapsulate port-related exprs in Nftables::Port
Sort template parameters alphabetically
Implement nftables::simplerule::saddr
Implement nftables::simplerule::sport
Handle dport internally always as an array
Implement nftables:;simplerule::counter
Implement nftables:;simplerule::daddr
Allow IPv4 and IPv6 only rules
Richer dport
Add nftables::simplerule
Remove duplicate flush on reload
When nftables was reloaded a flush was being done both in the systemdreload call and in the nft script itself.
New parameter noflush_tables to selectivly skip flush
Introduces a new structured fact nftables
```yamlnftables: tables: - inet-filter - ip-nat - ip6-nat - inet-f2b-table```
By default the nft script will continue to contain `nft flush ruleset`...
Merge pull request #22 from cernops/log_limit
Set a customisable rate limit to the logging rules
Allow disabling default NAT tables and chains
Add support for named sets
