puppet nftables

Révision 1a4f336e

start declaring the 'global' chain with module resources

the 'global' chain is a vestigial piece of early development on this
module, but it can be useful for creating fast short-circuits like
blocking traffic that match a certain set of IPs.

in the current state we can't inject rules inside the 'global' chain
since it's unknown to puppet. so let's remove the hard-coded definition
and use a puppet resource to declare it.

  include "inet-filter-chain-*.nft"

  # something we want for all

  chain global {

  }

      'INPUT',

      'OUTPUT',

      'FORWARD',

      'global',

    ]:;

  }

Formats disponibles : Unified diff