Révision 09cba182
Enable parameter_documentation lint
The linter checks that every parameter has been documented.
While corrections have been made to great many classes some more
complicated examples have been left for now. Should be updated
as the files get touched.
https://github.com/domcleal/puppet-lint-param-docs
| REFERENCE.md | ||
|---|---|---|
| 12 | 12 |
* [`nftables::ip_nat`](#nftablesip_nat): manage basic chains in table ip nat |
| 13 | 13 |
* [`nftables::rules::afs3_callback`](#nftablesrulesafs3_callback): Open call back port for AFS clients |
| 14 | 14 |
* [`nftables::rules::ceph`](#nftablesrulesceph): Ceph is a distributed object store and file system. Enable this to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS) |
| 15 |
* [`nftables::rules::ceph_mon`](#nftablesrulesceph_mon): Ceph is a distributed object store and file system. Enable this option to support Ceph's Monitor Daemon. |
|
| 16 |
* [`nftables::rules::dhcpv6_client`](#nftablesrulesdhcpv6_client) |
|
| 15 |
* [`nftables::rules::ceph_mon`](#nftablesrulesceph_mon): Ceph is a distributed object store and file system. |
|
| 16 |
Enable this option to support Ceph's Monitor Daemon. |
|
| 17 |
* [`nftables::rules::dhcpv6_client`](#nftablesrulesdhcpv6_client): allow DHCPv6 requests in to a host |
|
| 17 | 18 |
* [`nftables::rules::dns`](#nftablesrulesdns): manage in dns |
| 18 | 19 |
* [`nftables::rules::http`](#nftablesruleshttp): manage in http |
| 19 | 20 |
* [`nftables::rules::https`](#nftablesruleshttps): manage in https |
| ... | ... | |
| 25 | 26 |
* [`nftables::rules::ospf`](#nftablesrulesospf): manage in ospf |
| 26 | 27 |
* [`nftables::rules::ospf3`](#nftablesrulesospf3): manage in ospf3 |
| 27 | 28 |
* [`nftables::rules::out::all`](#nftablesrulesoutall): allow all outbound |
| 28 |
* [`nftables::rules::out::ceph_client`](#nftablesrulesoutceph_client): Ceph is a distributed object store and file system. Enable this to be a client of Ceph's Monitor (MON), Object Storage Daemons (OSD), Metadat |
|
| 29 |
* [`nftables::rules::out::ceph_client`](#nftablesrulesoutceph_client): Ceph is a distributed object store and file system. |
|
| 30 |
Enable this to be a client of Ceph's Monitor (MON), |
|
| 31 |
Object Storage Daemons (OSD), Metadata Server Daemons (MDS), |
|
| 32 |
and Manager Daemons (MGR). |
|
| 29 | 33 |
* [`nftables::rules::out::chrony`](#nftablesrulesoutchrony): manage out chrony |
| 30 | 34 |
* [`nftables::rules::out::dhcp`](#nftablesrulesoutdhcp): manage out dhcp |
| 31 |
* [`nftables::rules::out::dhcpv6_client`](#nftablesrulesoutdhcpv6_client) |
|
| 35 |
* [`nftables::rules::out::dhcpv6_client`](#nftablesrulesoutdhcpv6_client): Allow DHCPv6 requests out of a host
|
|
| 32 | 36 |
* [`nftables::rules::out::dns`](#nftablesrulesoutdns): manage out dns |
| 33 | 37 |
* [`nftables::rules::out::http`](#nftablesrulesouthttp): manage out http |
| 34 | 38 |
* [`nftables::rules::out::https`](#nftablesrulesouthttps): manage out https |
| 35 |
* [`nftables::rules::out::icmp`](#nftablesrulesouticmp) |
|
| 39 |
* [`nftables::rules::out::icmp`](#nftablesrulesouticmp): control outbound icmp packages
|
|
| 36 | 40 |
* [`nftables::rules::out::kerberos`](#nftablesrulesoutkerberos): allows outbound access for kerberos |
| 37 | 41 |
* [`nftables::rules::out::mysql`](#nftablesrulesoutmysql): manage out mysql |
| 38 | 42 |
* [`nftables::rules::out::nfs`](#nftablesrulesoutnfs): manage out nfs |
| 39 | 43 |
* [`nftables::rules::out::nfs3`](#nftablesrulesoutnfs3): manage out nfs3 |
| 40 | 44 |
* [`nftables::rules::out::openafs_client`](#nftablesrulesoutopenafs_client): allows outbound access for afs clients |
| 45 |
7000 - afs3-fileserver |
|
| 46 |
7002 - afs3-ptserver |
|
| 47 |
7003 - vlserver |
|
| 41 | 48 |
* [`nftables::rules::out::ospf`](#nftablesrulesoutospf): manage out ospf |
| 42 | 49 |
* [`nftables::rules::out::ospf3`](#nftablesrulesoutospf3): manage out ospf3 |
| 43 | 50 |
* [`nftables::rules::out::postgres`](#nftablesrulesoutpostgres): manage out postgres |
| ... | ... | |
| 54 | 61 |
* [`nftables::rules::ssh`](#nftablesrulesssh): manage in ssh |
| 55 | 62 |
* [`nftables::rules::tor`](#nftablesrulestor): manage in tor |
| 56 | 63 |
* [`nftables::rules::wireguard`](#nftablesruleswireguard): manage in wireguard |
| 57 |
* [`nftables::services::dhcpv6_client`](#nftablesservicesdhcpv6_client) |
|
| 58 |
* [`nftables::services::openafs_client`](#nftablesservicesopenafs_client) |
|
| 64 |
* [`nftables::services::dhcpv6_client`](#nftablesservicesdhcpv6_client): Allow in and outbound traffic for DHCPv6 server
|
|
| 65 |
* [`nftables::services::openafs_client`](#nftablesservicesopenafs_client): Open inbound and outbound ports for an AFS client
|
|
| 59 | 66 |
|
| 60 | 67 |
### Defined types |
| 61 | 68 |
|
| ... | ... | |
| 82 | 89 |
|
| 83 | 90 |
## Classes |
| 84 | 91 |
|
| 85 |
### `nftables` |
|
| 92 |
### <a name="nftables"></a>`nftables`
|
|
| 86 | 93 |
|
| 87 | 94 |
Configure nftables |
| 88 | 95 |
|
| ... | ... | |
| 107 | 114 |
|
| 108 | 115 |
#### Parameters |
| 109 | 116 |
|
| 110 |
The following parameters are available in the `nftables` class. |
|
| 111 |
|
|
| 112 |
##### `out_all` |
|
| 117 |
The following parameters are available in the `nftables` class: |
|
| 118 |
|
|
| 119 |
* [`out_all`](#out_all) |
|
| 120 |
* [`out_ntp`](#out_ntp) |
|
| 121 |
* [`out_http`](#out_http) |
|
| 122 |
* [`out_dns`](#out_dns) |
|
| 123 |
* [`out_https`](#out_https) |
|
| 124 |
* [`out_icmp`](#out_icmp) |
|
| 125 |
* [`in_ssh`](#in_ssh) |
|
| 126 |
* [`in_icmp`](#in_icmp) |
|
| 127 |
* [`nat`](#nat) |
|
| 128 |
* [`sets`](#sets) |
|
| 129 |
* [`log_prefix`](#log_prefix) |
|
| 130 |
* [`log_limit`](#log_limit) |
|
| 131 |
* [`reject_with`](#reject_with) |
|
| 132 |
* [`in_out_conntrack`](#in_out_conntrack) |
|
| 133 |
* [`fwd_conntrack`](#fwd_conntrack) |
|
| 134 |
* [`firewalld_enable`](#firewalld_enable) |
|
| 135 |
* [`noflush_tables`](#noflush_tables) |
|
| 136 |
* [`rules`](#rules) |
|
| 137 |
|
|
| 138 |
##### <a name="out_all"></a>`out_all` |
|
| 113 | 139 |
|
| 114 | 140 |
Data type: `Boolean` |
| 115 | 141 |
|
| ... | ... | |
| 119 | 145 |
|
| 120 | 146 |
Default value: ``false`` |
| 121 | 147 |
|
| 122 |
##### `out_ntp` |
|
| 148 |
##### <a name="out_ntp"></a>`out_ntp`
|
|
| 123 | 149 |
|
| 124 | 150 |
Data type: `Boolean` |
| 125 | 151 |
|
| ... | ... | |
| 127 | 153 |
|
| 128 | 154 |
Default value: ``true`` |
| 129 | 155 |
|
| 130 |
##### `out_http` |
|
| 156 |
##### <a name="out_http"></a>`out_http`
|
|
| 131 | 157 |
|
| 132 | 158 |
Data type: `Boolean` |
| 133 | 159 |
|
| ... | ... | |
| 135 | 161 |
|
| 136 | 162 |
Default value: ``true`` |
| 137 | 163 |
|
| 138 |
##### `out_https`
|
|
| 164 |
##### <a name="out_dns"></a>`out_dns`
|
|
| 139 | 165 |
|
| 140 | 166 |
Data type: `Boolean` |
| 141 | 167 |
|
| 142 |
Allow outbound to https servers.
|
|
| 168 |
Allow outbound to dns servers.
|
|
| 143 | 169 |
|
| 144 | 170 |
Default value: ``true`` |
| 145 | 171 |
|
| 146 |
##### `out_https` |
|
| 172 |
##### <a name="out_https"></a>`out_https` |
|
| 173 |
|
|
| 174 |
Data type: `Boolean` |
|
| 147 | 175 |
|
| 148 | 176 |
Allow outbound to https servers. |
| 149 | 177 |
|
| 150 | 178 |
Default value: ``true`` |
| 151 | 179 |
|
| 152 |
##### `out_icmp` |
|
| 180 |
##### <a name="out_icmp"></a>`out_icmp`
|
|
| 153 | 181 |
|
| 154 | 182 |
Data type: `Boolean` |
| 155 | 183 |
|
| ... | ... | |
| 157 | 185 |
|
| 158 | 186 |
Default value: ``true`` |
| 159 | 187 |
|
| 160 |
##### `in_ssh` |
|
| 188 |
##### <a name="in_ssh"></a>`in_ssh`
|
|
| 161 | 189 |
|
| 162 | 190 |
Data type: `Boolean` |
| 163 | 191 |
|
| ... | ... | |
| 165 | 193 |
|
| 166 | 194 |
Default value: ``true`` |
| 167 | 195 |
|
| 168 |
##### `in_icmp` |
|
| 196 |
##### <a name="in_icmp"></a>`in_icmp`
|
|
| 169 | 197 |
|
| 170 | 198 |
Data type: `Boolean` |
| 171 | 199 |
|
| ... | ... | |
| 173 | 201 |
|
| 174 | 202 |
Default value: ``true`` |
| 175 | 203 |
|
| 176 |
##### `nat` |
|
| 204 |
##### <a name="nat"></a>`nat`
|
|
| 177 | 205 |
|
| 178 | 206 |
Data type: `Boolean` |
| 179 | 207 |
|
| ... | ... | |
| 181 | 209 |
|
| 182 | 210 |
Default value: ``true`` |
| 183 | 211 |
|
| 184 |
##### `sets` |
|
| 212 |
##### <a name="sets"></a>`sets`
|
|
| 185 | 213 |
|
| 186 | 214 |
Data type: `Hash` |
| 187 | 215 |
|
| ... | ... | |
| 189 | 217 |
|
| 190 | 218 |
Default value: `{}`
|
| 191 | 219 |
|
| 192 |
##### `log_prefix` |
|
| 220 |
##### <a name="log_prefix"></a>`log_prefix`
|
|
| 193 | 221 |
|
| 194 | 222 |
Data type: `String` |
| 195 | 223 |
|
| ... | ... | |
| 200 | 228 |
|
| 201 | 229 |
Default value: `'[nftables] %<chain>s %<comment>s'` |
| 202 | 230 |
|
| 203 |
##### `log_limit` |
|
| 231 |
##### <a name="log_limit"></a>`log_limit`
|
|
| 204 | 232 |
|
| 205 | 233 |
Data type: `Variant[Boolean[false], String]` |
| 206 | 234 |
|
| ... | ... | |
| 210 | 238 |
|
| 211 | 239 |
Default value: `'3/minute burst 5 packets'` |
| 212 | 240 |
|
| 213 |
##### `reject_with` |
|
| 241 |
##### <a name="reject_with"></a>`reject_with`
|
|
| 214 | 242 |
|
| 215 | 243 |
Data type: `Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]]` |
| 216 | 244 |
|
| ... | ... | |
| 221 | 249 |
|
| 222 | 250 |
Default value: `'icmpx type port-unreachable'` |
| 223 | 251 |
|
| 224 |
##### `in_out_conntrack` |
|
| 252 |
##### <a name="in_out_conntrack"></a>`in_out_conntrack`
|
|
| 225 | 253 |
|
| 226 | 254 |
Data type: `Boolean` |
| 227 | 255 |
|
| ... | ... | |
| 230 | 258 |
|
| 231 | 259 |
Default value: ``true`` |
| 232 | 260 |
|
| 233 |
##### `fwd_conntrack` |
|
| 261 |
##### <a name="fwd_conntrack"></a>`fwd_conntrack`
|
|
| 234 | 262 |
|
| 235 | 263 |
Data type: `Boolean` |
| 236 | 264 |
|
| ... | ... | |
| 239 | 267 |
|
| 240 | 268 |
Default value: ``false`` |
| 241 | 269 |
|
| 242 |
##### `firewalld_enable` |
|
| 270 |
##### <a name="firewalld_enable"></a>`firewalld_enable`
|
|
| 243 | 271 |
|
| 244 | 272 |
Data type: `Variant[Boolean[false], Enum['mask']]` |
| 245 | 273 |
|
| ... | ... | |
| 249 | 277 |
|
| 250 | 278 |
Default value: `'mask'` |
| 251 | 279 |
|
| 252 |
##### `noflush_tables` |
|
| 280 |
##### <a name="noflush_tables"></a>`noflush_tables`
|
|
| 253 | 281 |
|
| 254 | 282 |
Data type: `Optional[Array[Pattern[/^(ip|ip6|inet)-[-a-zA-Z0-9_]+$/],1]]` |
| 255 | 283 |
|
| ... | ... | |
| 258 | 286 |
|
| 259 | 287 |
Default value: ``undef`` |
| 260 | 288 |
|
| 261 |
##### `out_dns` |
|
| 262 |
|
|
| 263 |
Data type: `Boolean` |
|
| 264 |
|
|
| 265 |
|
|
| 266 |
|
|
| 267 |
Default value: ``true`` |
|
| 268 |
|
|
| 269 |
##### `rules` |
|
| 289 |
##### <a name="rules"></a>`rules` |
|
| 270 | 290 |
|
| 271 | 291 |
Data type: `Hash` |
| 272 | 292 |
|
| 273 |
|
|
| 293 |
Specify hashes of `nftables::rule`s via hiera |
|
| 274 | 294 |
|
| 275 | 295 |
Default value: `{}`
|
| 276 | 296 |
|
| 277 |
### `nftables::bridges` |
|
| 297 |
### <a name="nftablesbridges"></a>`nftables::bridges`
|
|
| 278 | 298 |
|
| 279 | 299 |
allow forwarding traffic on bridges |
| 280 | 300 |
|
| 281 | 301 |
#### Parameters |
| 282 | 302 |
|
| 283 |
The following parameters are available in the `nftables::bridges` class.
|
|
| 303 |
The following parameters are available in the `nftables::bridges` class:
|
|
| 284 | 304 |
|
| 285 |
##### `ensure` |
|
| 305 |
* [`ensure`](#ensure) |
|
| 306 |
* [`bridgenames`](#bridgenames) |
|
| 307 |
|
|
| 308 |
##### <a name="ensure"></a>`ensure` |
|
| 286 | 309 |
|
| 287 | 310 |
Data type: `Enum['present','absent']` |
| 288 | 311 |
|
| ... | ... | |
| 290 | 313 |
|
| 291 | 314 |
Default value: `'present'` |
| 292 | 315 |
|
| 293 |
##### `bridgenames` |
|
| 316 |
##### <a name="bridgenames"></a>`bridgenames`
|
|
| 294 | 317 |
|
| 295 | 318 |
Data type: `Regexp` |
| 296 | 319 |
|
| ... | ... | |
| 298 | 321 |
|
| 299 | 322 |
Default value: `/^br.+/` |
| 300 | 323 |
|
| 301 |
### `nftables::inet_filter` |
|
| 324 |
### <a name="nftablesinet_filter"></a>`nftables::inet_filter`
|
|
| 302 | 325 |
|
| 303 | 326 |
manage basic chains in table inet filter |
| 304 | 327 |
|
| 305 |
### `nftables::ip_nat` |
|
| 328 |
### <a name="nftablesip_nat"></a>`nftables::ip_nat`
|
|
| 306 | 329 |
|
| 307 | 330 |
manage basic chains in table ip nat |
| 308 | 331 |
|
| 309 |
### `nftables::rules::afs3_callback` |
|
| 332 |
### <a name="nftablesrulesafs3_callback"></a>`nftables::rules::afs3_callback` |
|
| 333 |
|
|
| 334 |
Open call back port for AFS clients |
|
| 310 | 335 |
|
| 336 |
#### Examples |
|
| 337 |
|
|
| 338 |
##### allow call backs from particular hosts |
|
| 339 |
|
|
| 340 |
```puppet |
|
| 311 | 341 |
class{'nftables::rules::afs3_callback':
|
| 312 | 342 |
saddr => ['192.168.0.0/16', '10.0.0.222'] |
| 313 | 343 |
} |
| 344 |
``` |
|
| 314 | 345 |
|
| 315 | 346 |
#### Parameters |
| 316 | 347 |
|
| 317 |
The following parameters are available in the `nftables::rules::afs3_callback` class. |
|
| 348 |
The following parameters are available in the `nftables::rules::afs3_callback` class: |
|
| 349 |
|
|
| 350 |
* [`saddr`](#saddr) |
|
| 318 | 351 |
|
| 319 |
##### `saddr` |
|
| 352 |
##### <a name="saddr"></a>`saddr`
|
|
| 320 | 353 |
|
| 321 | 354 |
Data type: `Array[Stdlib::IP::Address::V4,1]` |
| 322 | 355 |
|
| ... | ... | |
| 324 | 357 |
|
| 325 | 358 |
Default value: `['0.0.0.0/0']` |
| 326 | 359 |
|
| 327 |
### `nftables::rules::ceph` |
|
| 360 |
### <a name="nftablesrulesceph"></a>`nftables::rules::ceph`
|
|
| 328 | 361 |
|
| 329 | 362 |
Ceph is a distributed object store and file system. |
| 330 | 363 |
Enable this to support Ceph's Object Storage Daemons (OSD), |
| 331 | 364 |
Metadata Server Daemons (MDS), or Manager Daemons (MGR). |
| 332 | 365 |
|
| 333 |
### `nftables::rules::ceph_mon` |
|
| 366 |
### <a name="nftablesrulesceph_mon"></a>`nftables::rules::ceph_mon`
|
|
| 334 | 367 |
|
| 335 | 368 |
Ceph is a distributed object store and file system. |
| 336 | 369 |
Enable this option to support Ceph's Monitor Daemon. |
| 337 | 370 |
|
| 338 | 371 |
#### Parameters |
| 339 | 372 |
|
| 340 |
The following parameters are available in the `nftables::rules::ceph_mon` class.
|
|
| 373 |
The following parameters are available in the `nftables::rules::ceph_mon` class:
|
|
| 341 | 374 |
|
| 342 |
##### `ports`
|
|
| 375 |
* [`ports`](#ports)
|
|
| 343 | 376 |
|
| 344 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 377 |
##### <a name="ports"></a>`ports`
|
|
| 345 | 378 |
|
| 379 |
Data type: `Array[Stdlib::Port,1]` |
|
| 346 | 380 |
|
| 381 |
specify ports for ceph service |
|
| 347 | 382 |
|
| 348 | 383 |
Default value: `[3300, 6789]` |
| 349 | 384 |
|
| 350 |
### `nftables::rules::dhcpv6_client` |
|
| 385 |
### <a name="nftablesrulesdhcpv6_client"></a>`nftables::rules::dhcpv6_client`
|
|
| 351 | 386 |
|
| 352 |
The nftables::rules::dhcpv6_client class.
|
|
| 387 |
allow DHCPv6 requests in to a host
|
|
| 353 | 388 |
|
| 354 |
### `nftables::rules::dns` |
|
| 389 |
### <a name="nftablesrulesdns"></a>`nftables::rules::dns`
|
|
| 355 | 390 |
|
| 356 | 391 |
manage in dns |
| 357 | 392 |
|
| 358 | 393 |
#### Parameters |
| 359 | 394 |
|
| 360 |
The following parameters are available in the `nftables::rules::dns` class.
|
|
| 395 |
The following parameters are available in the `nftables::rules::dns` class:
|
|
| 361 | 396 |
|
| 362 |
##### `ports`
|
|
| 397 |
* [`ports`](#ports)
|
|
| 363 | 398 |
|
| 364 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 399 |
##### <a name="ports"></a>`ports`
|
|
| 365 | 400 |
|
| 401 |
Data type: `Array[Stdlib::Port,1]` |
|
| 366 | 402 |
|
| 403 |
Specify ports for dns. |
|
| 367 | 404 |
|
| 368 | 405 |
Default value: `[53]` |
| 369 | 406 |
|
| 370 |
### `nftables::rules::http` |
|
| 407 |
### <a name="nftablesruleshttp"></a>`nftables::rules::http`
|
|
| 371 | 408 |
|
| 372 | 409 |
manage in http |
| 373 | 410 |
|
| 374 |
### `nftables::rules::https` |
|
| 411 |
### <a name="nftablesruleshttps"></a>`nftables::rules::https`
|
|
| 375 | 412 |
|
| 376 | 413 |
manage in https |
| 377 | 414 |
|
| 378 |
### `nftables::rules::icinga2` |
|
| 415 |
### <a name="nftablesrulesicinga2"></a>`nftables::rules::icinga2`
|
|
| 379 | 416 |
|
| 380 | 417 |
manage in icinga2 |
| 381 | 418 |
|
| 382 | 419 |
#### Parameters |
| 383 | 420 |
|
| 384 |
The following parameters are available in the `nftables::rules::icinga2` class.
|
|
| 421 |
The following parameters are available in the `nftables::rules::icinga2` class:
|
|
| 385 | 422 |
|
| 386 |
##### `ports`
|
|
| 423 |
* [`ports`](#ports)
|
|
| 387 | 424 |
|
| 388 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 425 |
##### <a name="ports"></a>`ports`
|
|
| 389 | 426 |
|
| 427 |
Data type: `Array[Stdlib::Port,1]` |
|
| 390 | 428 |
|
| 429 |
Specify ports for icinga1 |
|
| 391 | 430 |
|
| 392 | 431 |
Default value: `[5665]` |
| 393 | 432 |
|
| 394 |
### `nftables::rules::icmp` |
|
| 433 |
### <a name="nftablesrulesicmp"></a>`nftables::rules::icmp`
|
|
| 395 | 434 |
|
| 396 | 435 |
The nftables::rules::icmp class. |
| 397 | 436 |
|
| 398 | 437 |
#### Parameters |
| 399 | 438 |
|
| 400 |
The following parameters are available in the `nftables::rules::icmp` class. |
|
| 439 |
The following parameters are available in the `nftables::rules::icmp` class: |
|
| 440 |
|
|
| 441 |
* [`v4_types`](#v4_types) |
|
| 442 |
* [`v6_types`](#v6_types) |
|
| 443 |
* [`order`](#order) |
|
| 401 | 444 |
|
| 402 |
##### `v4_types` |
|
| 445 |
##### <a name="v4_types"></a>`v4_types`
|
|
| 403 | 446 |
|
| 404 | 447 |
Data type: `Optional[Array[String]]` |
| 405 | 448 |
|
| ... | ... | |
| 407 | 450 |
|
| 408 | 451 |
Default value: ``undef`` |
| 409 | 452 |
|
| 410 |
##### `v6_types` |
|
| 453 |
##### <a name="v6_types"></a>`v6_types`
|
|
| 411 | 454 |
|
| 412 | 455 |
Data type: `Optional[Array[String]]` |
| 413 | 456 |
|
| ... | ... | |
| 415 | 458 |
|
| 416 | 459 |
Default value: ``undef`` |
| 417 | 460 |
|
| 418 |
##### `order` |
|
| 461 |
##### <a name="order"></a>`order`
|
|
| 419 | 462 |
|
| 420 | 463 |
Data type: `String` |
| 421 | 464 |
|
| ... | ... | |
| 423 | 466 |
|
| 424 | 467 |
Default value: `'10'` |
| 425 | 468 |
|
| 426 |
### `nftables::rules::nfs` |
|
| 469 |
### <a name="nftablesrulesnfs"></a>`nftables::rules::nfs`
|
|
| 427 | 470 |
|
| 428 | 471 |
manage in nfs4 |
| 429 | 472 |
|
| 430 |
### `nftables::rules::nfs3` |
|
| 473 |
### <a name="nftablesrulesnfs3"></a>`nftables::rules::nfs3`
|
|
| 431 | 474 |
|
| 432 | 475 |
manage in nfs3 |
| 433 | 476 |
|
| 434 |
### `nftables::rules::node_exporter` |
|
| 477 |
### <a name="nftablesrulesnode_exporter"></a>`nftables::rules::node_exporter`
|
|
| 435 | 478 |
|
| 436 | 479 |
manage in node exporter |
| 437 | 480 |
|
| 438 | 481 |
#### Parameters |
| 439 | 482 |
|
| 440 |
The following parameters are available in the `nftables::rules::node_exporter` class.
|
|
| 483 |
The following parameters are available in the `nftables::rules::node_exporter` class:
|
|
| 441 | 484 |
|
| 442 |
##### `prometheus_server` |
|
| 485 |
* [`prometheus_server`](#prometheus_server) |
|
| 486 |
* [`port`](#port) |
|
| 443 | 487 |
|
| 444 |
Data type: `Optional[Variant[String,Array[String,1]]]`
|
|
| 488 |
##### <a name="prometheus_server"></a>`prometheus_server`
|
|
| 445 | 489 |
|
| 490 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
|
| 446 | 491 |
|
| 492 |
Specify server name |
|
| 447 | 493 |
|
| 448 | 494 |
Default value: ``undef`` |
| 449 | 495 |
|
| 450 |
##### `port` |
|
| 496 |
##### <a name="port"></a>`port`
|
|
| 451 | 497 |
|
| 452 | 498 |
Data type: `Stdlib::Port` |
| 453 | 499 |
|
| 454 |
|
|
| 500 |
Specify port to open |
|
| 455 | 501 |
|
| 456 | 502 |
Default value: `9100` |
| 457 | 503 |
|
| 458 |
### `nftables::rules::ospf` |
|
| 504 |
### <a name="nftablesrulesospf"></a>`nftables::rules::ospf`
|
|
| 459 | 505 |
|
| 460 | 506 |
manage in ospf |
| 461 | 507 |
|
| 462 |
### `nftables::rules::ospf3` |
|
| 508 |
### <a name="nftablesrulesospf3"></a>`nftables::rules::ospf3`
|
|
| 463 | 509 |
|
| 464 | 510 |
manage in ospf3 |
| 465 | 511 |
|
| 466 |
### `nftables::rules::out::all` |
|
| 512 |
### <a name="nftablesrulesoutall"></a>`nftables::rules::out::all`
|
|
| 467 | 513 |
|
| 468 | 514 |
allow all outbound |
| 469 | 515 |
|
| 470 |
### `nftables::rules::out::ceph_client` |
|
| 516 |
### <a name="nftablesrulesoutceph_client"></a>`nftables::rules::out::ceph_client`
|
|
| 471 | 517 |
|
| 472 | 518 |
Ceph is a distributed object store and file system. |
| 473 | 519 |
Enable this to be a client of Ceph's Monitor (MON), |
| ... | ... | |
| 476 | 522 |
|
| 477 | 523 |
#### Parameters |
| 478 | 524 |
|
| 479 |
The following parameters are available in the `nftables::rules::out::ceph_client` class.
|
|
| 525 |
The following parameters are available in the `nftables::rules::out::ceph_client` class:
|
|
| 480 | 526 |
|
| 481 |
##### `ports`
|
|
| 527 |
* [`ports`](#ports)
|
|
| 482 | 528 |
|
| 483 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 529 |
##### <a name="ports"></a>`ports`
|
|
| 484 | 530 |
|
| 531 |
Data type: `Array[Stdlib::Port,1]` |
|
| 485 | 532 |
|
| 533 |
Specify ports to open |
|
| 486 | 534 |
|
| 487 | 535 |
Default value: `[3300, 6789]` |
| 488 | 536 |
|
| 489 |
### `nftables::rules::out::chrony` |
|
| 537 |
### <a name="nftablesrulesoutchrony"></a>`nftables::rules::out::chrony`
|
|
| 490 | 538 |
|
| 491 | 539 |
manage out chrony |
| 492 | 540 |
|
| 493 |
### `nftables::rules::out::dhcp` |
|
| 541 |
### <a name="nftablesrulesoutdhcp"></a>`nftables::rules::out::dhcp`
|
|
| 494 | 542 |
|
| 495 | 543 |
manage out dhcp |
| 496 | 544 |
|
| 497 |
### `nftables::rules::out::dhcpv6_client` |
|
| 545 |
### <a name="nftablesrulesoutdhcpv6_client"></a>`nftables::rules::out::dhcpv6_client`
|
|
| 498 | 546 |
|
| 499 |
The nftables::rules::out::dhcpv6_client class.
|
|
| 547 |
Allow DHCPv6 requests out of a host
|
|
| 500 | 548 |
|
| 501 |
### `nftables::rules::out::dns` |
|
| 549 |
### <a name="nftablesrulesoutdns"></a>`nftables::rules::out::dns`
|
|
| 502 | 550 |
|
| 503 | 551 |
manage out dns |
| 504 | 552 |
|
| 505 | 553 |
#### Parameters |
| 506 | 554 |
|
| 507 |
The following parameters are available in the `nftables::rules::out::dns` class.
|
|
| 555 |
The following parameters are available in the `nftables::rules::out::dns` class:
|
|
| 508 | 556 |
|
| 509 |
##### `dns_server`
|
|
| 557 |
* [`dns_server`](#dns_server)
|
|
| 510 | 558 |
|
| 511 |
Data type: `Optional[Variant[String,Array[String,1]]]`
|
|
| 559 |
##### <a name="dns_server"></a>`dns_server`
|
|
| 512 | 560 |
|
| 561 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
|
| 513 | 562 |
|
| 563 |
specify dns_server name |
|
| 514 | 564 |
|
| 515 | 565 |
Default value: ``undef`` |
| 516 | 566 |
|
| 517 |
### `nftables::rules::out::http` |
|
| 567 |
### <a name="nftablesrulesouthttp"></a>`nftables::rules::out::http`
|
|
| 518 | 568 |
|
| 519 | 569 |
manage out http |
| 520 | 570 |
|
| 521 |
### `nftables::rules::out::https` |
|
| 571 |
### <a name="nftablesrulesouthttps"></a>`nftables::rules::out::https`
|
|
| 522 | 572 |
|
| 523 | 573 |
manage out https |
| 524 | 574 |
|
| 525 |
### `nftables::rules::out::icmp` |
|
| 575 |
### <a name="nftablesrulesouticmp"></a>`nftables::rules::out::icmp`
|
|
| 526 | 576 |
|
| 527 |
The nftables::rules::out::icmp class.
|
|
| 577 |
control outbound icmp packages
|
|
| 528 | 578 |
|
| 529 | 579 |
#### Parameters |
| 530 | 580 |
|
| 531 |
The following parameters are available in the `nftables::rules::out::icmp` class. |
|
| 581 |
The following parameters are available in the `nftables::rules::out::icmp` class: |
|
| 582 |
|
|
| 583 |
* [`v4_types`](#v4_types) |
|
| 584 |
* [`v6_types`](#v6_types) |
|
| 585 |
* [`order`](#order) |
|
| 532 | 586 |
|
| 533 |
##### `v4_types` |
|
| 587 |
##### <a name="v4_types"></a>`v4_types`
|
|
| 534 | 588 |
|
| 535 | 589 |
Data type: `Optional[Array[String]]` |
| 536 | 590 |
|
| ... | ... | |
| 538 | 592 |
|
| 539 | 593 |
Default value: ``undef`` |
| 540 | 594 |
|
| 541 |
##### `v6_types` |
|
| 595 |
##### <a name="v6_types"></a>`v6_types`
|
|
| 542 | 596 |
|
| 543 | 597 |
Data type: `Optional[Array[String]]` |
| 544 | 598 |
|
| ... | ... | |
| 546 | 600 |
|
| 547 | 601 |
Default value: ``undef`` |
| 548 | 602 |
|
| 549 |
##### `order` |
|
| 603 |
##### <a name="order"></a>`order`
|
|
| 550 | 604 |
|
| 551 | 605 |
Data type: `String` |
| 552 | 606 |
|
| ... | ... | |
| 554 | 608 |
|
| 555 | 609 |
Default value: `'10'` |
| 556 | 610 |
|
| 557 |
### `nftables::rules::out::kerberos` |
|
| 611 |
### <a name="nftablesrulesoutkerberos"></a>`nftables::rules::out::kerberos`
|
|
| 558 | 612 |
|
| 559 | 613 |
allows outbound access for kerberos |
| 560 | 614 |
|
| 561 |
### `nftables::rules::out::mysql` |
|
| 615 |
### <a name="nftablesrulesoutmysql"></a>`nftables::rules::out::mysql`
|
|
| 562 | 616 |
|
| 563 | 617 |
manage out mysql |
| 564 | 618 |
|
| 565 |
### `nftables::rules::out::nfs` |
|
| 619 |
### <a name="nftablesrulesoutnfs"></a>`nftables::rules::out::nfs`
|
|
| 566 | 620 |
|
| 567 | 621 |
manage out nfs |
| 568 | 622 |
|
| 569 |
### `nftables::rules::out::nfs3` |
|
| 623 |
### <a name="nftablesrulesoutnfs3"></a>`nftables::rules::out::nfs3`
|
|
| 570 | 624 |
|
| 571 | 625 |
manage out nfs3 |
| 572 | 626 |
|
| 573 |
### `nftables::rules::out::openafs_client` |
|
| 627 |
### <a name="nftablesrulesoutopenafs_client"></a>`nftables::rules::out::openafs_client`
|
|
| 574 | 628 |
|
| 629 |
allows outbound access for afs clients |
|
| 575 | 630 |
7000 - afs3-fileserver |
| 576 | 631 |
7002 - afs3-ptserver |
| 577 | 632 |
7003 - vlserver |
| ... | ... | |
| 582 | 637 |
|
| 583 | 638 |
#### Parameters |
| 584 | 639 |
|
| 585 |
The following parameters are available in the `nftables::rules::out::openafs_client` class.
|
|
| 640 |
The following parameters are available in the `nftables::rules::out::openafs_client` class:
|
|
| 586 | 641 |
|
| 587 |
##### `ports`
|
|
| 642 |
* [`ports`](#ports)
|
|
| 588 | 643 |
|
| 589 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 644 |
##### <a name="ports"></a>`ports`
|
|
| 590 | 645 |
|
| 646 |
Data type: `Array[Stdlib::Port,1]` |
|
| 591 | 647 |
|
| 648 |
port numbers to use |
|
| 592 | 649 |
|
| 593 | 650 |
Default value: `[7000, 7002, 7003]` |
| 594 | 651 |
|
| 595 |
### `nftables::rules::out::ospf` |
|
| 652 |
### <a name="nftablesrulesoutospf"></a>`nftables::rules::out::ospf`
|
|
| 596 | 653 |
|
| 597 | 654 |
manage out ospf |
| 598 | 655 |
|
| 599 |
### `nftables::rules::out::ospf3` |
|
| 656 |
### <a name="nftablesrulesoutospf3"></a>`nftables::rules::out::ospf3`
|
|
| 600 | 657 |
|
| 601 | 658 |
manage out ospf3 |
| 602 | 659 |
|
| 603 |
### `nftables::rules::out::postgres` |
|
| 660 |
### <a name="nftablesrulesoutpostgres"></a>`nftables::rules::out::postgres`
|
|
| 604 | 661 |
|
| 605 | 662 |
manage out postgres |
| 606 | 663 |
|
| 607 |
### `nftables::rules::out::puppet` |
|
| 664 |
### <a name="nftablesrulesoutpuppet"></a>`nftables::rules::out::puppet`
|
|
| 608 | 665 |
|
| 609 | 666 |
manage outgoing puppet |
| 610 | 667 |
|
| 611 | 668 |
#### Parameters |
| 612 | 669 |
|
| 613 |
The following parameters are available in the `nftables::rules::out::puppet` class.
|
|
| 670 |
The following parameters are available in the `nftables::rules::out::puppet` class:
|
|
| 614 | 671 |
|
| 615 |
##### `puppetserver` |
|
| 672 |
* [`puppetserver`](#puppetserver) |
|
| 673 |
* [`puppetserver_port`](#puppetserver_port) |
|
| 616 | 674 |
|
| 617 |
Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]`
|
|
| 675 |
##### <a name="puppetserver"></a>`puppetserver`
|
|
| 618 | 676 |
|
| 677 |
Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]` |
|
| 619 | 678 |
|
| 679 |
puppetserver hostname |
|
| 620 | 680 |
|
| 621 |
##### `puppetserver_port` |
|
| 681 |
##### <a name="puppetserver_port"></a>`puppetserver_port`
|
|
| 622 | 682 |
|
| 623 | 683 |
Data type: `Stdlib::Port` |
| 624 | 684 |
|
| 625 |
|
|
| 685 |
puppetserver port |
|
| 626 | 686 |
|
| 627 | 687 |
Default value: `8140` |
| 628 | 688 |
|
| 629 |
### `nftables::rules::out::smtp` |
|
| 689 |
### <a name="nftablesrulesoutsmtp"></a>`nftables::rules::out::smtp`
|
|
| 630 | 690 |
|
| 631 | 691 |
manage out smtp |
| 632 | 692 |
|
| 633 |
### `nftables::rules::out::ssh` |
|
| 693 |
### <a name="nftablesrulesoutssh"></a>`nftables::rules::out::ssh`
|
|
| 634 | 694 |
|
| 635 | 695 |
manage out ssh |
| 636 | 696 |
|
| 637 |
### `nftables::rules::out::ssh::remove` |
|
| 697 |
### <a name="nftablesrulesoutsshremove"></a>`nftables::rules::out::ssh::remove`
|
|
| 638 | 698 |
|
| 639 | 699 |
disable outgoing ssh |
| 640 | 700 |
|
| 641 |
### `nftables::rules::out::tor` |
|
| 701 |
### <a name="nftablesrulesouttor"></a>`nftables::rules::out::tor`
|
|
| 642 | 702 |
|
| 643 | 703 |
manage out tor |
| 644 | 704 |
|
| 645 |
### `nftables::rules::out::wireguard` |
|
| 705 |
### <a name="nftablesrulesoutwireguard"></a>`nftables::rules::out::wireguard`
|
|
| 646 | 706 |
|
| 647 | 707 |
manage out wireguard |
| 648 | 708 |
|
| 649 | 709 |
#### Parameters |
| 650 | 710 |
|
| 651 |
The following parameters are available in the `nftables::rules::out::wireguard` class.
|
|
| 711 |
The following parameters are available in the `nftables::rules::out::wireguard` class:
|
|
| 652 | 712 |
|
| 653 |
##### `ports`
|
|
| 713 |
* [`ports`](#ports)
|
|
| 654 | 714 |
|
| 655 |
Data type: `Array[Integer,1]`
|
|
| 715 |
##### <a name="ports"></a>`ports`
|
|
| 656 | 716 |
|
| 717 |
Data type: `Array[Integer,1]` |
|
| 657 | 718 |
|
| 719 |
specify wireguard ports |
|
| 658 | 720 |
|
| 659 | 721 |
Default value: `[51820]` |
| 660 | 722 |
|
| 661 |
### `nftables::rules::puppet` |
|
| 723 |
### <a name="nftablesrulespuppet"></a>`nftables::rules::puppet`
|
|
| 662 | 724 |
|
| 663 | 725 |
manage in puppet |
| 664 | 726 |
|
| 665 | 727 |
#### Parameters |
| 666 | 728 |
|
| 667 |
The following parameters are available in the `nftables::rules::puppet` class.
|
|
| 729 |
The following parameters are available in the `nftables::rules::puppet` class:
|
|
| 668 | 730 |
|
| 669 |
##### `ports`
|
|
| 731 |
* [`ports`](#ports)
|
|
| 670 | 732 |
|
| 671 |
Data type: `Array[Integer,1]`
|
|
| 733 |
##### <a name="ports"></a>`ports`
|
|
| 672 | 734 |
|
| 735 |
Data type: `Array[Integer,1]` |
|
| 673 | 736 |
|
| 737 |
puppet server ports |
|
| 674 | 738 |
|
| 675 | 739 |
Default value: `[8140]` |
| 676 | 740 |
|
| 677 |
### `nftables::rules::smtp` |
|
| 741 |
### <a name="nftablesrulessmtp"></a>`nftables::rules::smtp`
|
|
| 678 | 742 |
|
| 679 | 743 |
manage in smtp |
| 680 | 744 |
|
| 681 |
### `nftables::rules::smtp_submission` |
|
| 745 |
### <a name="nftablesrulessmtp_submission"></a>`nftables::rules::smtp_submission`
|
|
| 682 | 746 |
|
| 683 | 747 |
manage in smtp submission |
| 684 | 748 |
|
| 685 |
### `nftables::rules::smtps` |
|
| 749 |
### <a name="nftablesrulessmtps"></a>`nftables::rules::smtps`
|
|
| 686 | 750 |
|
| 687 | 751 |
manage in smtps |
| 688 | 752 |
|
| 689 |
### `nftables::rules::ssh` |
|
| 753 |
### <a name="nftablesrulesssh"></a>`nftables::rules::ssh`
|
|
| 690 | 754 |
|
| 691 | 755 |
manage in ssh |
| 692 | 756 |
|
| 693 | 757 |
#### Parameters |
| 694 | 758 |
|
| 695 |
The following parameters are available in the `nftables::rules::ssh` class.
|
|
| 759 |
The following parameters are available in the `nftables::rules::ssh` class:
|
|
| 696 | 760 |
|
| 697 |
##### `ports`
|
|
| 761 |
* [`ports`](#ports)
|
|
| 698 | 762 |
|
| 699 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 763 |
##### <a name="ports"></a>`ports`
|
|
| 700 | 764 |
|
| 765 |
Data type: `Array[Stdlib::Port,1]` |
|
| 701 | 766 |
|
| 767 |
ssh ports |
|
| 702 | 768 |
|
| 703 | 769 |
Default value: `[22]` |
| 704 | 770 |
|
| 705 |
### `nftables::rules::tor` |
|
| 771 |
### <a name="nftablesrulestor"></a>`nftables::rules::tor`
|
|
| 706 | 772 |
|
| 707 | 773 |
manage in tor |
| 708 | 774 |
|
| 709 | 775 |
#### Parameters |
| 710 | 776 |
|
| 711 |
The following parameters are available in the `nftables::rules::tor` class.
|
|
| 777 |
The following parameters are available in the `nftables::rules::tor` class:
|
|
| 712 | 778 |
|
| 713 |
##### `ports`
|
|
| 779 |
* [`ports`](#ports)
|
|
| 714 | 780 |
|
| 715 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 781 |
##### <a name="ports"></a>`ports`
|
|
| 716 | 782 |
|
| 783 |
Data type: `Array[Stdlib::Port,1]` |
|
| 717 | 784 |
|
| 785 |
ports for tor |
|
| 718 | 786 |
|
| 719 | 787 |
Default value: `[9001]` |
| 720 | 788 |
|
| 721 |
### `nftables::rules::wireguard` |
|
| 789 |
### <a name="nftablesruleswireguard"></a>`nftables::rules::wireguard`
|
|
| 722 | 790 |
|
| 723 | 791 |
manage in wireguard |
| 724 | 792 |
|
| 725 | 793 |
#### Parameters |
| 726 | 794 |
|
| 727 |
The following parameters are available in the `nftables::rules::wireguard` class.
|
|
| 795 |
The following parameters are available in the `nftables::rules::wireguard` class:
|
|
| 728 | 796 |
|
| 729 |
##### `ports`
|
|
| 797 |
* [`ports`](#ports)
|
|
| 730 | 798 |
|
| 731 |
Data type: `Array[Stdlib::Port,1]`
|
|
| 799 |
##### <a name="ports"></a>`ports`
|
|
| 732 | 800 |
|
| 801 |
Data type: `Array[Stdlib::Port,1]` |
|
| 733 | 802 |
|
| 803 |
wiregueard port |
|
| 734 | 804 |
|
| 735 | 805 |
Default value: `[51820]` |
| 736 | 806 |
|
| 737 |
### `nftables::services::dhcpv6_client` |
|
| 807 |
### <a name="nftablesservicesdhcpv6_client"></a>`nftables::services::dhcpv6_client`
|
|
| 738 | 808 |
|
| 739 |
The nftables::services::dhcpv6_client class.
|
|
| 809 |
Allow in and outbound traffic for DHCPv6 server
|
|
| 740 | 810 |
|
| 741 |
### `nftables::services::openafs_client` |
|
| 811 |
### <a name="nftablesservicesopenafs_client"></a>`nftables::services::openafs_client`
|
|
| 742 | 812 |
|
| 743 |
The nftables::services::openafs_client class.
|
|
| 813 |
Open inbound and outbound ports for an AFS client
|
|
| 744 | 814 |
|
| 745 | 815 |
## Defined types |
| 746 | 816 |
|
| 747 |
### `nftables::chain` |
|
| 817 |
### <a name="nftableschain"></a>`nftables::chain`
|
|
| 748 | 818 |
|
| 749 | 819 |
manage a chain |
| 750 | 820 |
|
| 751 | 821 |
#### Parameters |
| 752 | 822 |
|
| 753 |
The following parameters are available in the `nftables::chain` defined type. |
|
| 823 |
The following parameters are available in the `nftables::chain` defined type: |
|
| 824 |
|
|
| 825 |
* [`table`](#table) |
|
| 826 |
* [`chain`](#chain) |
|
| 827 |
* [`inject`](#inject) |
|
| 828 |
* [`inject_iif`](#inject_iif) |
|
| 829 |
* [`inject_oif`](#inject_oif) |
|
| 754 | 830 |
|
| 755 |
##### `table` |
|
| 831 |
##### <a name="table"></a>`table`
|
|
| 756 | 832 |
|
| 757 | 833 |
Data type: `Pattern[/^(ip|ip6|inet)-[a-zA-Z0-9_]+$/]` |
| 758 | 834 |
|
| ... | ... | |
| 760 | 836 |
|
| 761 | 837 |
Default value: `'inet-filter'` |
| 762 | 838 |
|
| 763 |
##### `chain` |
|
| 839 |
##### <a name="chain"></a>`chain`
|
|
| 764 | 840 |
|
| 765 | 841 |
Data type: `Pattern[/^[a-zA-Z0-9_]+$/]` |
| 766 | 842 |
|
| ... | ... | |
| 768 | 844 |
|
| 769 | 845 |
Default value: `$title` |
| 770 | 846 |
|
| 771 |
##### `inject` |
|
| 847 |
##### <a name="inject"></a>`inject`
|
|
| 772 | 848 |
|
| 773 | 849 |
Data type: `Optional[Pattern[/^\d\d-[a-zA-Z0-9_]+$/]]` |
| 774 | 850 |
|
| ... | ... | |
| 776 | 852 |
|
| 777 | 853 |
Default value: ``undef`` |
| 778 | 854 |
|
| 779 |
##### `inject_iif` |
|
| 855 |
##### <a name="inject_iif"></a>`inject_iif`
|
|
| 780 | 856 |
|
| 781 | 857 |
Data type: `Optional[String]` |
| 782 | 858 |
|
| ... | ... | |
| 784 | 860 |
|
| 785 | 861 |
Default value: ``undef`` |
| 786 | 862 |
|
| 787 |
##### `inject_oif` |
|
| 863 |
##### <a name="inject_oif"></a>`inject_oif`
|
|
| 788 | 864 |
|
| 789 | 865 |
Data type: `Optional[String]` |
| 790 | 866 |
|
| ... | ... | |
| 792 | 868 |
|
| 793 | 869 |
Default value: ``undef`` |
| 794 | 870 |
|
| 795 |
### `nftables::config` |
|
| 871 |
### <a name="nftablesconfig"></a>`nftables::config`
|
|
| 796 | 872 |
|
| 797 | 873 |
manage a config snippet |
| 798 | 874 |
|
| 799 | 875 |
#### Parameters |
| 800 | 876 |
|
| 801 |
The following parameters are available in the `nftables::config` defined type.
|
|
| 877 |
The following parameters are available in the `nftables::config` defined type:
|
|
| 802 | 878 |
|
| 803 |
##### `tablespec` |
|
| 879 |
* [`tablespec`](#tablespec) |
|
| 880 |
* [`content`](#content) |
|
| 881 |
* [`source`](#source) |
|
| 882 |
* [`prefix`](#prefix) |
|
| 883 |
|
|
| 884 |
##### <a name="tablespec"></a>`tablespec` |
|
| 804 | 885 |
|
| 805 | 886 |
Data type: `Pattern[/^\w+-\w+$/]` |
| 806 | 887 |
|
| ... | ... | |
| 808 | 889 |
|
| 809 | 890 |
Default value: `$title` |
| 810 | 891 |
|
| 811 |
##### `content` |
|
| 892 |
##### <a name="content"></a>`content`
|
|
| 812 | 893 |
|
| 813 | 894 |
Data type: `Optional[String]` |
| 814 | 895 |
|
| ... | ... | |
| 816 | 897 |
|
| 817 | 898 |
Default value: ``undef`` |
| 818 | 899 |
|
| 819 |
##### `source` |
|
| 900 |
##### <a name="source"></a>`source`
|
|
| 820 | 901 |
|
| 821 | 902 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
| 822 | 903 |
|
| ... | ... | |
| 824 | 905 |
|
| 825 | 906 |
Default value: ``undef`` |
| 826 | 907 |
|
| 827 |
##### `prefix` |
|
| 908 |
##### <a name="prefix"></a>`prefix`
|
|
| 828 | 909 |
|
| 829 | 910 |
Data type: `String` |
| 830 | 911 |
|
| ... | ... | |
| 832 | 913 |
|
| 833 | 914 |
Default value: `'custom-'` |
| 834 | 915 |
|
| 835 |
### `nftables::rule` |
|
| 916 |
### <a name="nftablesrule"></a>`nftables::rule`
|
|
| 836 | 917 |
|
| 837 | 918 |
manage a chain rule |
| 838 | 919 |
Name should be: |
| ... | ... | |
| 840 | 921 |
|
| 841 | 922 |
#### Parameters |
| 842 | 923 |
|
| 843 |
The following parameters are available in the `nftables::rule` defined type. |
|
| 924 |
The following parameters are available in the `nftables::rule` defined type: |
|
| 925 |
|
|
| 926 |
* [`ensure`](#ensure) |
|
| 927 |
* [`rulename`](#rulename) |
|
| 928 |
* [`order`](#order) |
|
| 929 |
* [`table`](#table) |
|
| 930 |
* [`content`](#content) |
|
| 931 |
* [`source`](#source) |
|
| 844 | 932 |
|
| 845 |
##### `ensure` |
|
| 933 |
##### <a name="ensure"></a>`ensure`
|
|
| 846 | 934 |
|
| 847 | 935 |
Data type: `Enum['present','absent']` |
| 848 | 936 |
|
| ... | ... | |
| 850 | 938 |
|
| 851 | 939 |
Default value: `'present'` |
| 852 | 940 |
|
| 853 |
##### `rulename` |
|
| 941 |
##### <a name="rulename"></a>`rulename`
|
|
| 854 | 942 |
|
| 855 | 943 |
Data type: `Nftables::RuleName` |
| 856 | 944 |
|
| ... | ... | |
| 858 | 946 |
|
| 859 | 947 |
Default value: `$title` |
| 860 | 948 |
|
| 861 |
##### `order` |
|
| 949 |
##### <a name="order"></a>`order`
|
|
| 862 | 950 |
|
| 863 | 951 |
Data type: `Pattern[/^\d\d$/]` |
| 864 | 952 |
|
| ... | ... | |
| 866 | 954 |
|
| 867 | 955 |
Default value: `'50'` |
| 868 | 956 |
|
| 869 |
##### `table` |
|
| 957 |
##### <a name="table"></a>`table`
|
|
| 870 | 958 |
|
| 871 | 959 |
Data type: `Optional[String]` |
| 872 | 960 |
|
| ... | ... | |
| 874 | 962 |
|
| 875 | 963 |
Default value: `'inet-filter'` |
| 876 | 964 |
|
| 877 |
##### `content` |
|
| 965 |
##### <a name="content"></a>`content`
|
|
| 878 | 966 |
|
| 879 | 967 |
Data type: `Optional[String]` |
| 880 | 968 |
|
| ... | ... | |
| 882 | 970 |
|
| 883 | 971 |
Default value: ``undef`` |
| 884 | 972 |
|
| 885 |
##### `source` |
|
| 973 |
##### <a name="source"></a>`source`
|
|
| 886 | 974 |
|
| 887 | 975 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
| 888 | 976 |
|
| ... | ... | |
| 890 | 978 |
|
| 891 | 979 |
Default value: ``undef`` |
| 892 | 980 |
|
| 893 |
### `nftables::rules::dnat4` |
|
| 981 |
### <a name="nftablesrulesdnat4"></a>`nftables::rules::dnat4`
|
|
| 894 | 982 |
|
| 895 | 983 |
manage a ipv4 dnat rule |
| 896 | 984 |
|
| 897 | 985 |
#### Parameters |
| 898 | 986 |
|
| 899 |
The following parameters are available in the `nftables::rules::dnat4` defined type. |
|
| 987 |
The following parameters are available in the `nftables::rules::dnat4` defined type: |
|
| 988 |
|
|
| 989 |
* [`daddr`](#daddr) |
|
| 990 |
* [`port`](#port) |
|
| 991 |
* [`rulename`](#rulename) |
|
| 992 |
* [`order`](#order) |
|
| 993 |
* [`chain`](#chain) |
|
| 994 |
* [`iif`](#iif) |
|
| 995 |
* [`proto`](#proto) |
|
| 996 |
* [`dport`](#dport) |
|
| 997 |
* [`ensure`](#ensure) |
|
| 900 | 998 |
|
| 901 |
##### `daddr` |
|
| 999 |
##### <a name="daddr"></a>`daddr`
|
|
| 902 | 1000 |
|
| 903 | 1001 |
Data type: `Pattern[/^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/]`
|
| 904 | 1002 |
|
| 905 | 1003 |
|
| 906 | 1004 |
|
| 907 |
##### `port` |
|
| 1005 |
##### <a name="port"></a>`port`
|
|
| 908 | 1006 |
|
| 909 | 1007 |
Data type: `Variant[String,Stdlib::Port]` |
| 910 | 1008 |
|
| 911 | 1009 |
|
| 912 | 1010 |
|
| 913 |
##### `rulename` |
|
| 1011 |
##### <a name="rulename"></a>`rulename`
|
|
| 914 | 1012 |
|
| 915 | 1013 |
Data type: `Pattern[/^[a-zA-Z0-9_]+$/]` |
| 916 | 1014 |
|
| ... | ... | |
| 918 | 1016 |
|
| 919 | 1017 |
Default value: `$title` |
| 920 | 1018 |
|
| 921 |
##### `order` |
|
| 1019 |
##### <a name="order"></a>`order`
|
|
| 922 | 1020 |
|
| 923 | 1021 |
Data type: `Pattern[/^\d\d$/]` |
| 924 | 1022 |
|
| ... | ... | |
| 926 | 1024 |
|
| 927 | 1025 |
Default value: `'50'` |
| 928 | 1026 |
|
| 929 |
##### `chain` |
|
| 1027 |
##### <a name="chain"></a>`chain`
|
|
| 930 | 1028 |
|
| 931 | 1029 |
Data type: `String[1]` |
| 932 | 1030 |
|
| ... | ... | |
| 934 | 1032 |
|
| 935 | 1033 |
Default value: `'default_fwd'` |
| 936 | 1034 |
|
| 937 |
##### `iif` |
|
| 1035 |
##### <a name="iif"></a>`iif`
|
|
| 938 | 1036 |
|
| 939 | 1037 |
Data type: `Optional[String[1]]` |
| 940 | 1038 |
|
| ... | ... | |
| 942 | 1040 |
|
| 943 | 1041 |
Default value: ``undef`` |
| 944 | 1042 |
|
| 945 |
##### `proto` |
|
| 1043 |
##### <a name="proto"></a>`proto`
|
|
| 946 | 1044 |
|
| 947 | 1045 |
Data type: `Enum['tcp','udp']` |
| 948 | 1046 |
|
| ... | ... | |
| 950 | 1048 |
|
| 951 | 1049 |
Default value: `'tcp'` |
| 952 | 1050 |
|
| 953 |
##### `dport` |
|
| 1051 |
##### <a name="dport"></a>`dport`
|
|
| 954 | 1052 |
|
| 955 | 1053 |
Data type: `Optional[Variant[String,Stdlib::Port]]` |
| 956 | 1054 |
|
| ... | ... | |
| 958 | 1056 |
|
| 959 | 1057 |
Default value: `''` |
| 960 | 1058 |
|
| 961 |
##### `ensure` |
|
| 1059 |
##### <a name="ensure"></a>`ensure`
|
|
| 962 | 1060 |
|
| 963 | 1061 |
Data type: `Enum['present','absent']` |
| 964 | 1062 |
|
| ... | ... | |
| 966 | 1064 |
|
| 967 | 1065 |
Default value: `'present'` |
| 968 | 1066 |
|
| 969 |
### `nftables::rules::masquerade` |
|
| 1067 |
### <a name="nftablesrulesmasquerade"></a>`nftables::rules::masquerade`
|
|
| 970 | 1068 |
|
| 971 | 1069 |
masquerade all outgoing traffic |
| 972 | 1070 |
|
| 973 | 1071 |
#### Parameters |
| 974 | 1072 |
|
| 975 |
The following parameters are available in the `nftables::rules::masquerade` defined type.
|
|
| 1073 |
The following parameters are available in the `nftables::rules::masquerade` defined type:
|
|
| 976 | 1074 |
|
| 977 |
##### `rulename` |
|
| 1075 |
* [`rulename`](#rulename) |
|
| 1076 |
* [`order`](#order) |
|
| 1077 |
* [`chain`](#chain) |
|
| 1078 |
* [`oif`](#oif) |
|
| 1079 |
* [`saddr`](#saddr) |
|
| 1080 |
* [`daddr`](#daddr) |
|
| 1081 |
* [`proto`](#proto) |
|
| 1082 |
* [`dport`](#dport) |
|
| 1083 |
* [`ensure`](#ensure) |
|
| 1084 |
|
|
| 1085 |
##### <a name="rulename"></a>`rulename` |
|
| 978 | 1086 |
|
| 979 | 1087 |
Data type: `Pattern[/^[a-zA-Z0-9_]+$/]` |
| 980 | 1088 |
|
| ... | ... | |
| 982 | 1090 |
|
| 983 | 1091 |
Default value: `$title` |
| 984 | 1092 |
|
| 985 |
##### `order` |
|
| 1093 |
##### <a name="order"></a>`order`
|
|
| 986 | 1094 |
|
| 987 | 1095 |
Data type: `Pattern[/^\d\d$/]` |
| 988 | 1096 |
|
| ... | ... | |
| 990 | 1098 |
|
| 991 | 1099 |
Default value: `'70'` |
| 992 | 1100 |
|
| 993 |
##### `chain` |
|
| 1101 |
##### <a name="chain"></a>`chain`
|
|
| 994 | 1102 |
|
| 995 | 1103 |
Data type: `String[1]` |
| 996 | 1104 |
|
| ... | ... | |
| 998 | 1106 |
|
| 999 | 1107 |
Default value: `'POSTROUTING'` |
| 1000 | 1108 |
|
| 1001 |
##### `oif` |
|
| 1109 |
##### <a name="oif"></a>`oif`
|
|
| 1002 | 1110 |
|
| 1003 | 1111 |
Data type: `Optional[String[1]]` |
| 1004 | 1112 |
|
| ... | ... | |
| 1006 | 1114 |
|
| 1007 | 1115 |
Default value: ``undef`` |
| 1008 | 1116 |
|
| 1009 |
##### `saddr` |
|
| 1117 |
##### <a name="saddr"></a>`saddr`
|
|
| 1010 | 1118 |
|
| 1011 | 1119 |
Data type: `Optional[String[1]]` |
| 1012 | 1120 |
|
| ... | ... | |
| 1014 | 1122 |
|
| 1015 | 1123 |
Default value: ``undef`` |
| 1016 | 1124 |
|
| 1017 |
##### `daddr` |
|
| 1125 |
##### <a name="daddr"></a>`daddr`
|
|
| 1018 | 1126 |
|
| 1019 | 1127 |
Data type: `Optional[String[1]]` |
| 1020 | 1128 |
|
| ... | ... | |
| 1022 | 1130 |
|
| 1023 | 1131 |
Default value: ``undef`` |
| 1024 | 1132 |
|
| 1025 |
##### `proto` |
|
| 1133 |
##### <a name="proto"></a>`proto`
|
|
| 1026 | 1134 |
|
| 1027 | 1135 |
Data type: `Optional[Enum['tcp','udp']]` |
| 1028 | 1136 |
|
| ... | ... | |
| 1030 | 1138 |
|
| 1031 | 1139 |
Default value: ``undef`` |
| 1032 | 1140 |
|
| 1033 |
##### `dport` |
|
| 1141 |
##### <a name="dport"></a>`dport`
|
|
| 1034 | 1142 |
|
| 1035 | 1143 |
Data type: `Optional[Variant[String,Stdlib::Port]]` |
| 1036 | 1144 |
|
| ... | ... | |
| 1038 | 1146 |
|
| 1039 | 1147 |
Default value: ``undef`` |
| 1040 | 1148 |
|
| 1041 |
##### `ensure` |
|
| 1149 |
##### <a name="ensure"></a>`ensure`
|
|
| 1042 | 1150 |
|
| 1043 | 1151 |
Data type: `Enum['present','absent']` |
| 1044 | 1152 |
|
| ... | ... | |
| 1046 | 1154 |
|
| 1047 | 1155 |
Default value: `'present'` |
| 1048 | 1156 |
|
| 1049 |
### `nftables::rules::snat4` |
|
| 1157 |
### <a name="nftablesrulessnat4"></a>`nftables::rules::snat4`
|
|
| 1050 | 1158 |
|
| 1051 | 1159 |
manage a ipv4 snat rule |
| 1052 | 1160 |
|
| 1053 | 1161 |
#### Parameters |
| 1054 | 1162 |
|
| 1055 |
The following parameters are available in the `nftables::rules::snat4` defined type. |
|
| 1163 |
The following parameters are available in the `nftables::rules::snat4` defined type: |
|
| 1164 |
|
|
| 1165 |
* [`snat`](#snat) |
|
| 1166 |
* [`rulename`](#rulename) |
|
| 1167 |
* [`order`](#order) |
|
| 1168 |
* [`chain`](#chain) |
|
| 1169 |
* [`oif`](#oif) |
|
| 1170 |
* [`saddr`](#saddr) |
|
| 1171 |
* [`proto`](#proto) |
|
| 1172 |
* [`dport`](#dport) |
|
| 1173 |
* [`ensure`](#ensure) |
|
| 1056 | 1174 |
|
| 1057 |
##### `snat` |
|
| 1175 |
##### <a name="snat"></a>`snat`
|
|
| 1058 | 1176 |
|
| 1059 | 1177 |
Data type: `String[1]` |
| 1060 | 1178 |
|
| 1061 | 1179 |
|
| 1062 | 1180 |
|
| 1063 |
##### `rulename` |
|
| 1181 |
##### <a name="rulename"></a>`rulename`
|
|
| 1064 | 1182 |
|
| 1065 | 1183 |
Data type: `Pattern[/^[a-zA-Z0-9_]+$/]` |
| 1066 | 1184 |
|
| ... | ... | |
| 1068 | 1186 |
|
| 1069 | 1187 |
Default value: `$title` |
| 1070 | 1188 |
|
| 1071 |
##### `order` |
|
| 1189 |
##### <a name="order"></a>`order`
|
|
| 1072 | 1190 |
|
| 1073 | 1191 |
Data type: `Pattern[/^\d\d$/]` |
| 1074 | 1192 |
|
| ... | ... | |
| 1076 | 1194 |
|
| 1077 | 1195 |
Default value: `'70'` |
| 1078 | 1196 |
|
| 1079 |
##### `chain` |
|
| 1197 |
##### <a name="chain"></a>`chain`
|
|
| 1080 | 1198 |
|
| 1081 | 1199 |
Data type: `String[1]` |
| 1082 | 1200 |
|
| ... | ... | |
| 1084 | 1202 |
|
| 1085 | 1203 |
Default value: `'POSTROUTING'` |
| 1086 | 1204 |
|
| 1087 |
##### `oif` |
|
| 1205 |
##### <a name="oif"></a>`oif`
|
|
| 1088 | 1206 |
|
| 1089 | 1207 |
Data type: `Optional[String[1]]` |
| 1090 | 1208 |
|
| ... | ... | |
| 1092 | 1210 |
|
| 1093 | 1211 |
Default value: ``undef`` |
| 1094 | 1212 |
|
| 1095 |
##### `saddr` |
|
| 1213 |
##### <a name="saddr"></a>`saddr`
|
|
| 1096 | 1214 |
|
| 1097 | 1215 |
Data type: `Optional[String[1]]` |
| 1098 | 1216 |
|
| ... | ... | |
| 1100 | 1218 |
|
| 1101 | 1219 |
Default value: ``undef`` |
| 1102 | 1220 |
|
| 1103 |
##### `proto` |
|
| 1221 |
##### <a name="proto"></a>`proto`
|
|
| 1104 | 1222 |
|
| 1105 | 1223 |
Data type: `Optional[Enum['tcp','udp']]` |
| 1106 | 1224 |
|
| ... | ... | |
| 1108 | 1226 |
|
| 1109 | 1227 |
Default value: ``undef`` |
| 1110 | 1228 |
|
| 1111 |
##### `dport` |
|
| 1229 |
##### <a name="dport"></a>`dport`
|
|
| 1112 | 1230 |
|
| 1113 | 1231 |
Data type: `Optional[Variant[String,Stdlib::Port]]` |
| 1114 | 1232 |
|
| ... | ... | |
| 1116 | 1234 |
|
| 1117 | 1235 |
Default value: ``undef`` |
| 1118 | 1236 |
|
| 1119 |
##### `ensure` |
|
| 1237 |
##### <a name="ensure"></a>`ensure`
|
|
| 1120 | 1238 |
|
| 1121 | 1239 |
Data type: `Enum['present','absent']` |
| 1122 | 1240 |
|
| ... | ... | |
| 1124 | 1242 |
|
| 1125 | 1243 |
Default value: `'present'` |
| 1126 | 1244 |
|
| 1127 |
### `nftables::set` |
|
| 1245 |
### <a name="nftablesset"></a>`nftables::set`
|
|
| 1128 | 1246 |
|
| 1129 | 1247 |
manage a named set |
| 1130 | 1248 |
|
| ... | ... | |
| 1143 | 1261 |
|
| 1144 | 1262 |
#### Parameters |
| 1145 | 1263 |
|
| 1146 |
The following parameters are available in the `nftables::set` defined type. |
|
| 1147 |
|
|
| 1148 |
##### `ensure` |
|
| 1264 |
The following parameters are available in the `nftables::set` defined type: |
|
| 1265 |
|
|
| 1266 |
* [`ensure`](#ensure) |
|
| 1267 |
* [`setname`](#setname) |
|
| 1268 |
* [`order`](#order) |
|
| 1269 |
* [`type`](#type) |
|
| 1270 |
* [`table`](#table) |
|
| 1271 |
* [`flags`](#flags) |
|
| 1272 |
* [`timeout`](#timeout) |
|
| 1273 |
* [`gc_interval`](#gc_interval) |
|
| 1274 |
* [`elements`](#elements) |
|
| 1275 |
* [`size`](#size) |
|
| 1276 |
* [`policy`](#policy) |
|
| 1277 |
* [`auto_merge`](#auto_merge) |
|
| 1278 |
* [`content`](#content) |
|
| 1279 |
* [`source`](#source) |
|
| 1280 |
|
|
| 1281 |
##### <a name="ensure"></a>`ensure` |
|
| 1149 | 1282 |
|
| 1150 | 1283 |
Data type: `Enum['present','absent']` |
| 1151 | 1284 |
|
| ... | ... | |
| 1153 | 1286 |
|
| 1154 | 1287 |
Default value: `'present'` |
| 1155 | 1288 |
|
| 1156 |
##### `setname` |
|
| 1289 |
##### <a name="setname"></a>`setname`
|
|
| 1157 | 1290 |
|
| 1158 | 1291 |
Data type: `Pattern[/^[-a-zA-Z0-9_]+$/]` |
| 1159 | 1292 |
|
| ... | ... | |
| 1161 | 1294 |
|
| 1162 | 1295 |
Default value: `$title` |
| 1163 | 1296 |
|
| 1164 |
##### `order` |
|
| 1297 |
##### <a name="order"></a>`order`
|
|
| 1165 | 1298 |
|
| 1166 | 1299 |
Data type: `Pattern[/^\d\d$/]` |
| 1167 | 1300 |
|
| ... | ... | |
| 1169 | 1302 |
|
| 1170 | 1303 |
Default value: `'10'` |
| 1171 | 1304 |
|
| 1172 |
##### `type` |
|
| 1305 |
##### <a name="type"></a>`type`
|
|
| 1173 | 1306 |
|
| 1174 | 1307 |
Data type: `Optional[Enum['ipv4_addr', 'ipv6_addr', 'ether_addr', 'inet_proto', 'inet_service', 'mark']]` |
| 1175 | 1308 |
|
| ... | ... | |
| 1177 | 1310 |
|
| 1178 | 1311 |
Default value: ``undef`` |
| 1179 | 1312 |
|
| 1180 |
##### `table` |
|
| 1313 |
##### <a name="table"></a>`table`
|
|
| 1181 | 1314 |
|
| 1182 | 1315 |
Data type: `String` |
| 1183 | 1316 |
|
| ... | ... | |
| 1185 | 1318 |
|
| 1186 | 1319 |
Default value: `'inet-filter'` |
| 1187 | 1320 |
|
| 1188 |
##### `flags` |
|
| 1321 |
##### <a name="flags"></a>`flags`
|
|
| 1189 | 1322 |
|
| 1190 | 1323 |
Data type: `Array[Enum['constant', 'dynamic', 'interval', 'timeout'], 0, 4]` |
| 1191 | 1324 |
|
| ... | ... | |
| 1193 | 1326 |
|
| 1194 | 1327 |
Default value: `[]` |
| 1195 | 1328 |
|
| 1196 |
##### `timeout` |
|
| 1329 |
##### <a name="timeout"></a>`timeout`
|
|
| 1197 | 1330 |
|
| 1198 | 1331 |
Data type: `Optional[Integer]` |
| 1199 | 1332 |
|
| ... | ... | |
| 1201 | 1334 |
|
| 1202 | 1335 |
Default value: ``undef`` |
| 1203 | 1336 |
|
| 1204 |
##### `gc_interval` |
|
| 1337 |
##### <a name="gc_interval"></a>`gc_interval`
|
|
| 1205 | 1338 |
|
| 1206 | 1339 |
Data type: `Optional[Integer]` |
| 1207 | 1340 |
|
| ... | ... | |
| 1209 | 1342 |
|
| 1210 | 1343 |
Default value: ``undef`` |
| 1211 | 1344 |
|
| 1212 |
##### `elements` |
|
| 1345 |
##### <a name="elements"></a>`elements`
|
|
| 1213 | 1346 |
|
| 1214 | 1347 |
Data type: `Optional[Array[String]]` |
| 1215 | 1348 |
|
| ... | ... | |
| 1217 | 1350 |
|
| 1218 | 1351 |
Default value: ``undef`` |
| 1219 | 1352 |
|
| 1220 |
##### `size` |
|
| 1353 |
##### <a name="size"></a>`size`
|
|
| 1221 | 1354 |
|
| 1222 | 1355 |
Data type: `Optional[Integer]` |
| 1223 | 1356 |
|
Formats disponibles : Unified diff