puppet nftables

# Reference

<!-- DO NOT EDIT: This document was generated by Puppet Strings -->

## Table of Contents

### Classes

* [`nftables`](#nftables): Configure nftables

* [`nftables::bridges`](#nftables--bridges): allow forwarding traffic on bridges

* [`nftables::inet_filter`](#nftables--inet_filter): manage basic chains in table inet filter

* [`nftables::inet_filter::fwd_conntrack`](#nftables--inet_filter--fwd_conntrack): enable conntrack for fwd

* [`nftables::inet_filter::in_out_conntrack`](#nftables--inet_filter--in_out_conntrack): manage input & output conntrack

* [`nftables::ip_nat`](#nftables--ip_nat): manage basic chains in table ip nat

* [`nftables::rules::activemq`](#nftables--rules--activemq): Provides input rules for Apache ActiveMQ

* [`nftables::rules::afs3_callback`](#nftables--rules--afs3_callback): Open call back port for AFS clients

* [`nftables::rules::ceph`](#nftables--rules--ceph): Ceph is a distributed object store and file system. Enable this to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS)

* [`nftables::rules::ceph_mon`](#nftables--rules--ceph_mon): Ceph is a distributed object store and file system.

Enable this option to support Ceph's Monitor Daemon.

* [`nftables::rules::dhcpv6_client`](#nftables--rules--dhcpv6_client): allow DHCPv6 requests in to a host

* [`nftables::rules::dns`](#nftables--rules--dns): manage in dns

* [`nftables::rules::docker_ce`](#nftables--rules--docker_ce): Default firewall configuration for Docker-CE

* [`nftables::rules::ftp`](#nftables--rules--ftp): manage in ftp (with conntrack helper)

* [`nftables::rules::http`](#nftables--rules--http): manage in http

* [`nftables::rules::https`](#nftables--rules--https): manage in https

* [`nftables::rules::icinga2`](#nftables--rules--icinga2): manage in icinga2

* [`nftables::rules::icmp`](#nftables--rules--icmp): allows incoming ICMP

* [`nftables::rules::igmp`](#nftables--rules--igmp): allow incoming IGMP messages

* [`nftables::rules::ldap`](#nftables--rules--ldap): manage in ldap

* [`nftables::rules::llmnr`](#nftables--rules--llmnr): allow incoming Link-Local Multicast Name Resolution

* [`nftables::rules::mdns`](#nftables--rules--mdns): allow incoming multicast DNS

* [`nftables::rules::multicast`](#nftables--rules--multicast): allow incoming multicast traffic

* [`nftables::rules::nfs`](#nftables--rules--nfs): manage in nfs4

* [`nftables::rules::nfs3`](#nftables--rules--nfs3): manage in nfs3

* [`nftables::rules::node_exporter`](#nftables--rules--node_exporter): manage in node exporter

* [`nftables::rules::ospf`](#nftables--rules--ospf): manage in ospf

* [`nftables::rules::ospf3`](#nftables--rules--ospf3): manage in ospf3

* [`nftables::rules::out::active_directory`](#nftables--rules--out--active_directory): manage outgoing active diectory

* [`nftables::rules::out::all`](#nftables--rules--out--all): allow all outbound

* [`nftables::rules::out::ceph_client`](#nftables--rules--out--ceph_client): Ceph is a distributed object store and file system.

Enable this to be a client of Ceph's Monitor (MON),

Object Storage Daemons (OSD), Metadata Server Daemons (MDS),

and Manager Daemons (MGR).

* [`nftables::rules::out::chrony`](#nftables--rules--out--chrony): manage out chrony

* [`nftables::rules::out::dhcp`](#nftables--rules--out--dhcp): manage out dhcp

* [`nftables::rules::out::dhcpv6_client`](#nftables--rules--out--dhcpv6_client): Allow DHCPv6 requests out of a host

* [`nftables::rules::out::dns`](#nftables--rules--out--dns): manage out dns

* [`nftables::rules::out::hkp`](#nftables--rules--out--hkp): allow outgoing hkp connections to gpg keyservers

* [`nftables::rules::out::http`](#nftables--rules--out--http): manage out http

* [`nftables::rules::out::https`](#nftables--rules--out--https): manage out https

* [`nftables::rules::out::icinga2`](#nftables--rules--out--icinga2): allow outgoing icinga2

* [`nftables::rules::out::icmp`](#nftables--rules--out--icmp): control outbound icmp packages

* [`nftables::rules::out::igmp`](#nftables--rules--out--igmp): allow outgoing IGMP messages

* [`nftables::rules::out::imap`](#nftables--rules--out--imap): allow outgoing imap

* [`nftables::rules::out::kerberos`](#nftables--rules--out--kerberos): allows outbound access for kerberos

* [`nftables::rules::out::ldap`](#nftables--rules--out--ldap): manage outgoing ldap

* [`nftables::rules::out::mdns`](#nftables--rules--out--mdns): allow outgoing multicast DNS

* [`nftables::rules::out::mldv2`](#nftables--rules--out--mldv2): allow multicast listener requests

* [`nftables::rules::out::mysql`](#nftables--rules--out--mysql): manage out mysql

* [`nftables::rules::out::nfs`](#nftables--rules--out--nfs): manage out nfs

* [`nftables::rules::out::nfs3`](#nftables--rules--out--nfs3): manage out nfs3

* [`nftables::rules::out::openafs_client`](#nftables--rules--out--openafs_client): allows outbound access for afs clients

7000 - afs3-fileserver

7002 - afs3-ptserver

7003 - vlserver

* [`nftables::rules::out::ospf`](#nftables--rules--out--ospf): manage out ospf

* [`nftables::rules::out::ospf3`](#nftables--rules--out--ospf3): manage out ospf3

* [`nftables::rules::out::pop3`](#nftables--rules--out--pop3): allow outgoing pop3

* [`nftables::rules::out::postgres`](#nftables--rules--out--postgres): manage out postgres

* [`nftables::rules::out::puppet`](#nftables--rules--out--puppet): manage outgoing puppet

* [`nftables::rules::out::pxp_agent`](#nftables--rules--out--pxp_agent): manage outgoing pxp-agent

* [`nftables::rules::out::smtp`](#nftables--rules--out--smtp): allow outgoing smtp

* [`nftables::rules::out::smtp_client`](#nftables--rules--out--smtp_client): allow outgoing smtp client

* [`nftables::rules::out::ssdp`](#nftables--rules--out--ssdp): allow outgoing SSDP

* [`nftables::rules::out::ssh`](#nftables--rules--out--ssh): manage out ssh

* [`nftables::rules::out::ssh::remove`](#nftables--rules--out--ssh--remove): disable outgoing ssh

* [`nftables::rules::out::tor`](#nftables--rules--out--tor): manage out tor

* [`nftables::rules::out::whois`](#nftables--rules--out--whois): allow clients to query remote whois server

* [`nftables::rules::out::wireguard`](#nftables--rules--out--wireguard): manage out wireguard

* [`nftables::rules::podman`](#nftables--rules--podman): Rules for Podman, a tool for managing OCI containers and pods.

This class defines additional forwarding rules to let root containers

reach external networks when using Netavark (since v4.0) or CNI (deprecated).

At the time of writing, Podman supports automatic configuration

of firewall rules with iptables and firewalld only.

* [`nftables::rules::puppet`](#nftables--rules--puppet): manage in puppet

* [`nftables::rules::pxp_agent`](#nftables--rules--pxp_agent): manage in pxp-agent

* [`nftables::rules::qemu`](#nftables--rules--qemu): Bridged network configuration for qemu/libvirt

* [`nftables::rules::rsync`](#nftables--rules--rsync): allow rsync connections

* [`nftables::rules::samba`](#nftables--rules--samba): manage Samba, the suite to allow Windows file sharing on Linux resources.

* [`nftables::rules::smtp`](#nftables--rules--smtp): manage in smtp

* [`nftables::rules::smtp_submission`](#nftables--rules--smtp_submission): manage in smtp submission

* [`nftables::rules::smtps`](#nftables--rules--smtps): manage in smtps

* [`nftables::rules::spotify`](#nftables--rules--spotify): allow incoming spotify

* [`nftables::rules::ssdp`](#nftables--rules--ssdp): allow incoming SSDP

* [`nftables::rules::ssh`](#nftables--rules--ssh): manage in ssh

* [`nftables::rules::tor`](#nftables--rules--tor): manage in tor

* [`nftables::rules::wireguard`](#nftables--rules--wireguard): manage in wireguard

* [`nftables::rules::wsd`](#nftables--rules--wsd): allow incoming webservice discovery

* [`nftables::services::dhcpv6_client`](#nftables--services--dhcpv6_client): Allow in and outbound traffic for DHCPv6 server

* [`nftables::services::openafs_client`](#nftables--services--openafs_client): Open inbound and outbound ports for an AFS client

### Defined types

* [`nftables::chain`](#nftables--chain): manage a chain

* [`nftables::config`](#nftables--config): manage a config snippet

* [`nftables::file`](#nftables--file): Insert a file into the nftables configuration

* [`nftables::helper`](#nftables--helper): manage a conntrack helper

* [`nftables::rule`](#nftables--rule): Provides an interface to create a firewall rule

* [`nftables::rules::dnat4`](#nftables--rules--dnat4): manage a ipv4 dnat rule

* [`nftables::rules::masquerade`](#nftables--rules--masquerade): masquerade all outgoing traffic

* [`nftables::rules::snat4`](#nftables--rules--snat4): manage a ipv4 snat rule

* [`nftables::set`](#nftables--set): manage a named set

* [`nftables::simplerule`](#nftables--simplerule): Provides a simplified interface to nftables::rule

### Data types

* [`Nftables::Addr`](#Nftables--Addr): Represents an address expression to be used within a rule.

* [`Nftables::Addr::Set`](#Nftables--Addr--Set): Represents a set expression to be used within a rule.

* [`Nftables::Port`](#Nftables--Port): Represents a port expression to be used within a rule.

* [`Nftables::Port::Range`](#Nftables--Port--Range): Represents a port range expression to be used within a rule.

* [`Nftables::RuleName`](#Nftables--RuleName): Represents a rule name to be used in a raw rule created via nftables::rule.

It's a dash separated string. The first component describes the chain to

add the rule to, the second the rule name and the (optional) third a number.

Ex: 'default_in-sshd', 'default_out-my_service-2'.

* [`Nftables::SimpleRuleName`](#Nftables--SimpleRuleName): Represents a simple rule name to be used in a rule created via nftables::simplerule

## Classes

### <a name="nftables"></a>`nftables`

Configure nftables

#### Examples

##### allow dns out and do not allow ntp out

```puppet

class{ 'nftables':

  out_ntp => false,

  out_dns => true,

}

```

##### do not flush particular tables, fail2ban in this case

```puppet

class{ 'nftables':

  noflush_tables => ['inet-f2b-table'],

}

```

#### Parameters

The following parameters are available in the `nftables` class:

* [`out_all`](#-nftables--out_all)

* [`out_ntp`](#-nftables--out_ntp)

* [`out_http`](#-nftables--out_http)

* [`out_dns`](#-nftables--out_dns)

* [`out_https`](#-nftables--out_https)

* [`out_icmp`](#-nftables--out_icmp)

* [`in_ssh`](#-nftables--in_ssh)

* [`in_icmp`](#-nftables--in_icmp)

* [`inet_filter`](#-nftables--inet_filter)

* [`nat`](#-nftables--nat)

* [`nat_table_name`](#-nftables--nat_table_name)

* [`purge_unmanaged_rules`](#-nftables--purge_unmanaged_rules)

* [`inmem_rules_hash_file`](#-nftables--inmem_rules_hash_file)

* [`sets`](#-nftables--sets)

* [`log_prefix`](#-nftables--log_prefix)

* [`log_discarded`](#-nftables--log_discarded)

* [`log_limit`](#-nftables--log_limit)

* [`reject_with`](#-nftables--reject_with)

* [`in_out_conntrack`](#-nftables--in_out_conntrack)

* [`in_out_drop_invalid`](#-nftables--in_out_drop_invalid)

* [`fwd_conntrack`](#-nftables--fwd_conntrack)

* [`fwd_drop_invalid`](#-nftables--fwd_drop_invalid)

* [`firewalld_enable`](#-nftables--firewalld_enable)

* [`noflush_tables`](#-nftables--noflush_tables)

* [`rules`](#-nftables--rules)

* [`configuration_path`](#-nftables--configuration_path)

* [`nft_path`](#-nftables--nft_path)

* [`echo`](#-nftables--echo)

* [`default_config_mode`](#-nftables--default_config_mode)

* [`clobber_default_config`](#-nftables--clobber_default_config)

##### <a name="-nftables--out_all"></a>`out_all`

Data type: `Boolean`

Allow all outbound connections. If `true` then all other

out parameters `out_ntp`, `out_dns`, ... will be assuemed

false.

Default value: `false`

##### <a name="-nftables--out_ntp"></a>`out_ntp`

Data type: `Boolean`

Allow outbound to ntp servers.

Default value: `true`

##### <a name="-nftables--out_http"></a>`out_http`

Data type: `Boolean`

Allow outbound to http servers.

Default value: `true`

##### <a name="-nftables--out_dns"></a>`out_dns`

Data type: `Boolean`

Allow outbound to dns servers.

Default value: `true`

##### <a name="-nftables--out_https"></a>`out_https`

Data type: `Boolean`

Allow outbound to https servers.

Default value: `true`

##### <a name="-nftables--out_icmp"></a>`out_icmp`

Data type: `Boolean`

Allow outbound ICMPv4/v6 traffic.

Default value: `true`

##### <a name="-nftables--in_ssh"></a>`in_ssh`

Data type: `Boolean`

Allow inbound to ssh servers.

Default value: `true`

##### <a name="-nftables--in_icmp"></a>`in_icmp`

Data type: `Boolean`

Allow inbound ICMPv4/v6 traffic.

Default value: `true`

##### <a name="-nftables--inet_filter"></a>`inet_filter`

Data type: `Boolean`

Add default tables, chains and rules to process traffic.

Default value: `true`

##### <a name="-nftables--nat"></a>`nat`

Data type: `Boolean`

Add default tables and chains to process NAT traffic.

Default value: `true`

##### <a name="-nftables--nat_table_name"></a>`nat_table_name`

Data type: `String[1]`

The name of the 'nat' table.

Default value: `'nat'`

##### <a name="-nftables--purge_unmanaged_rules"></a>`purge_unmanaged_rules`

Data type: `Boolean`

Prohibits in-memory rules that are not declared in Puppet

code. Setting this to true activates a check that reloads nftables

if the rules in memory have been modified without Puppet.

Default value: `false`

##### <a name="-nftables--inmem_rules_hash_file"></a>`inmem_rules_hash_file`

Data type: `Stdlib::Unixpath`

The name of the file where the hash of the in-memory rules

will be stored.

Default value: `'/var/tmp/puppet-nft-memhash'`

##### <a name="-nftables--sets"></a>`sets`

Data type: `Hash`

Allows sourcing set definitions directly from Hiera.

Default value: `{}`

##### <a name="-nftables--log_prefix"></a>`log_prefix`

Data type: `String`

String that will be used as prefix when logging packets. It can contain

two variables using standard sprintf() string-formatting:

 * chain: Will be replaced by the name of the chain.

 * comment: Allows chains to add extra comments.

Default value: `'[nftables] %<chain>s %<comment>s'`

##### <a name="-nftables--log_discarded"></a>`log_discarded`

Data type: `Boolean`

Allow to log discarded packets

Default value: `true`

##### <a name="-nftables--log_limit"></a>`log_limit`

Data type: `Variant[Boolean[false], String]`

String with the content of a limit statement to be applied

to the rules that log discarded traffic. Set to false to

disable rate limiting.

Default value: `'3/minute burst 5 packets'`

##### <a name="-nftables--reject_with"></a>`reject_with`

Data type: `Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]]`

How to discard packets not matching any rule. If `false`, the

fate of the packet will be defined by the chain policy (normally

drop), otherwise the packet will be rejected with the REJECT_WITH

policy indicated by the value of this parameter.

Default value: `'icmpx type port-unreachable'`

##### <a name="-nftables--in_out_conntrack"></a>`in_out_conntrack`

Data type: `Boolean`

Adds INPUT and OUTPUT rules to allow traffic that's part of an

established connection and also to drop invalid packets.

Default value: `true`

##### <a name="-nftables--in_out_drop_invalid"></a>`in_out_drop_invalid`

Data type: `Boolean`

Drops invalid packets in INPUT and OUTPUT

Default value: `$in_out_conntrack`

##### <a name="-nftables--fwd_conntrack"></a>`fwd_conntrack`

Data type: `Boolean`

Adds FORWARD rules to allow traffic that's part of an

established connection and also to drop invalid packets.

Default value: `false`

##### <a name="-nftables--fwd_drop_invalid"></a>`fwd_drop_invalid`

Data type: `Boolean`

Drops invalid packets in FORWARD

Default value: `$fwd_conntrack`

##### <a name="-nftables--firewalld_enable"></a>`firewalld_enable`

Data type: `Variant[Boolean[false], Enum['mask']]`

Configures how the firewalld systemd service unit is enabled. It might be

useful to set this to false if you're externaly removing firewalld from

the system completely.

Default value: `'mask'`

##### <a name="-nftables--noflush_tables"></a>`noflush_tables`

Data type: `Optional[Array[Pattern[/^(ip|ip6|inet|arp|bridge|netdev)-[-a-zA-Z0-9_]+$/],1]]`

If specified only other existings tables will be flushed.

If left unset all tables will be flushed via a `flush ruleset`

Default value: `undef`

##### <a name="-nftables--rules"></a>`rules`

Data type: `Hash`

Specify hashes of `nftables::rule`s via hiera

Default value: `{}`

##### <a name="-nftables--configuration_path"></a>`configuration_path`

Data type: `Stdlib::Unixpath`

The absolute path to the principal nftables configuration file. The default

varies depending on the system, and is set in the module's data.

##### <a name="-nftables--nft_path"></a>`nft_path`

Data type: `Stdlib::Unixpath`

Path to the nft binary

##### <a name="-nftables--echo"></a>`echo`

Data type: `Stdlib::Unixpath`

Path to the echo binary

##### <a name="-nftables--default_config_mode"></a>`default_config_mode`

Data type: `Stdlib::Filemode`

The default file & dir mode for configuration files and directories. The

default varies depending on the system, and is set in the module's data.

##### <a name="-nftables--clobber_default_config"></a>`clobber_default_config`

Data type: `Boolean`

Should the existing OS provided rules in the `configuration_path` be removed? If

they are not being removed this module will add all of its configuration to the end of

the existing rules.

Default value: `false`

### <a name="nftables--bridges"></a>`nftables::bridges`

allow forwarding traffic on bridges

#### Parameters

The following parameters are available in the `nftables::bridges` class:

* [`ensure`](#-nftables--bridges--ensure)

* [`bridgenames`](#-nftables--bridges--bridgenames)

##### <a name="-nftables--bridges--ensure"></a>`ensure`

Data type: `Enum['present','absent']`

Default value: `'present'`

##### <a name="-nftables--bridges--bridgenames"></a>`bridgenames`

Data type: `Regexp`

Default value: `/^br.+/`

### <a name="nftables--inet_filter"></a>`nftables::inet_filter`

manage basic chains in table inet filter

### <a name="nftables--inet_filter--fwd_conntrack"></a>`nftables::inet_filter::fwd_conntrack`

enable conntrack for fwd

### <a name="nftables--inet_filter--in_out_conntrack"></a>`nftables::inet_filter::in_out_conntrack`

manage input & output conntrack

### <a name="nftables--ip_nat"></a>`nftables::ip_nat`

manage basic chains in table ip nat

### <a name="nftables--rules--activemq"></a>`nftables::rules::activemq`

Provides input rules for Apache ActiveMQ

#### Parameters

The following parameters are available in the `nftables::rules::activemq` class:

* [`tcp`](#-nftables--rules--activemq--tcp)

* [`udp`](#-nftables--rules--activemq--udp)

* [`port`](#-nftables--rules--activemq--port)

##### <a name="-nftables--rules--activemq--tcp"></a>`tcp`

Data type: `Boolean`

Create the rule for TCP traffic.

Default value: `true`

##### <a name="-nftables--rules--activemq--udp"></a>`udp`

Data type: `Boolean`

Create the rule for UDP traffic.

Default value: `true`

##### <a name="-nftables--rules--activemq--port"></a>`port`

Data type: `Stdlib::Port`

The port number for the ActiveMQ daemon.

Default value: `61616`

### <a name="nftables--rules--afs3_callback"></a>`nftables::rules::afs3_callback`

Open call back port for AFS clients

#### Examples

##### allow call backs from particular hosts

```puppet

class{'nftables::rules::afs3_callback':

  saddr => ['192.168.0.0/16', '10.0.0.222']

}

```

#### Parameters

The following parameters are available in the `nftables::rules::afs3_callback` class:

* [`saddr`](#-nftables--rules--afs3_callback--saddr)

##### <a name="-nftables--rules--afs3_callback--saddr"></a>`saddr`

Data type: `Array[Stdlib::IP::Address::V4,1]`

list of source network ranges to a

Default value: `['0.0.0.0/0']`

### <a name="nftables--rules--ceph"></a>`nftables::rules::ceph`

Ceph is a distributed object store and file system.

Enable this to support Ceph's Object Storage Daemons (OSD),

Metadata Server Daemons (MDS), or Manager Daemons (MGR).

### <a name="nftables--rules--ceph_mon"></a>`nftables::rules::ceph_mon`

Ceph is a distributed object store and file system.

Enable this option to support Ceph's Monitor Daemon.

#### Parameters

The following parameters are available in the `nftables::rules::ceph_mon` class:

* [`ports`](#-nftables--rules--ceph_mon--ports)

##### <a name="-nftables--rules--ceph_mon--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

specify ports for ceph service

Default value: `[3300, 6789]`

### <a name="nftables--rules--dhcpv6_client"></a>`nftables::rules::dhcpv6_client`

allow DHCPv6 requests in to a host

### <a name="nftables--rules--dns"></a>`nftables::rules::dns`

manage in dns

#### Examples

##### Allow access to stub dns resolver from docker containers

```puppet

class { 'nftables::rules::dns':

  iifname => ['docker0'],

}

```

#### Parameters

The following parameters are available in the `nftables::rules::dns` class:

* [`ports`](#-nftables--rules--dns--ports)

* [`iifname`](#-nftables--rules--dns--iifname)

##### <a name="-nftables--rules--dns--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

Specify ports for dns.

Default value: `[53]`

##### <a name="-nftables--rules--dns--iifname"></a>`iifname`

Data type: `Optional[Array[String[1],1]]`

Specify input interface names.

Default value: `undef`

### <a name="nftables--rules--docker_ce"></a>`nftables::rules::docker_ce`

The configuration distributed in this class represents the default firewall

configuration done by docker-ce when the iptables integration is enabled.

This class is needed as the default docker-ce rules added to ip-filter conflict

with the inet-filter forward rules set by default in this module.

When using this class 'docker::iptables: false' should be set.

#### Parameters

The following parameters are available in the `nftables::rules::docker_ce` class:

* [`docker_interface`](#-nftables--rules--docker_ce--docker_interface)

* [`docker_prefix`](#-nftables--rules--docker_ce--docker_prefix)

* [`manage_docker_chains`](#-nftables--rules--docker_ce--manage_docker_chains)

* [`manage_base_chains`](#-nftables--rules--docker_ce--manage_base_chains)

##### <a name="-nftables--rules--docker_ce--docker_interface"></a>`docker_interface`

Data type: `String[1]`

Interface name used by docker.

Default value: `'docker0'`

##### <a name="-nftables--rules--docker_ce--docker_prefix"></a>`docker_prefix`

Data type: `Stdlib::IP::Address::V4::CIDR`

The address space used by docker.

Default value: `'172.17.0.0/16'`

##### <a name="-nftables--rules--docker_ce--manage_docker_chains"></a>`manage_docker_chains`

Data type: `Boolean`

Flag to control whether the class should create the docker related chains.

Default value: `true`

##### <a name="-nftables--rules--docker_ce--manage_base_chains"></a>`manage_base_chains`

Data type: `Boolean`

Flag to control whether the class should create the base common chains.

Default value: `true`

### <a name="nftables--rules--ftp"></a>`nftables::rules::ftp`

manage in ftp (with conntrack helper)

#### Parameters

The following parameters are available in the `nftables::rules::ftp` class:

* [`enable_passive`](#-nftables--rules--ftp--enable_passive)

* [`passive_ports`](#-nftables--rules--ftp--passive_ports)

##### <a name="-nftables--rules--ftp--enable_passive"></a>`enable_passive`

Data type: `Boolean`

Enable FTP passive mode support

Default value: `true`

##### <a name="-nftables--rules--ftp--passive_ports"></a>`passive_ports`

Data type: `Nftables::Port::Range`

Set the FTP passive mode port range

Default value: `'10090-10100'`

### <a name="nftables--rules--http"></a>`nftables::rules::http`

manage in http

### <a name="nftables--rules--https"></a>`nftables::rules::https`

manage in https

### <a name="nftables--rules--icinga2"></a>`nftables::rules::icinga2`

manage in icinga2

#### Parameters

The following parameters are available in the `nftables::rules::icinga2` class:

* [`ports`](#-nftables--rules--icinga2--ports)

##### <a name="-nftables--rules--icinga2--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

Specify ports for icinga2

Default value: `[5665]`

### <a name="nftables--rules--icmp"></a>`nftables::rules::icmp`

allows incoming ICMP

#### Parameters

The following parameters are available in the `nftables::rules::icmp` class:

* [`v4_types`](#-nftables--rules--icmp--v4_types)

* [`v6_types`](#-nftables--rules--icmp--v6_types)

* [`order`](#-nftables--rules--icmp--order)

##### <a name="-nftables--rules--icmp--v4_types"></a>`v4_types`

Data type: `Optional[Array[String]]`

ICMP v4 types that should be allowed

Default value: `undef`

##### <a name="-nftables--rules--icmp--v6_types"></a>`v6_types`

Data type: `Optional[Array[String]]`

ICMP v6 types that should be allowed

Default value: `undef`

##### <a name="-nftables--rules--icmp--order"></a>`order`

Data type: `String`

the ordering of the rules

Default value: `'10'`

### <a name="nftables--rules--igmp"></a>`nftables::rules::igmp`

allow incoming IGMP messages

### <a name="nftables--rules--ldap"></a>`nftables::rules::ldap`

manage in ldap

#### Parameters

The following parameters are available in the `nftables::rules::ldap` class:

* [`ports`](#-nftables--rules--ldap--ports)

##### <a name="-nftables--rules--ldap--ports"></a>`ports`

Data type: `Array[Integer,1]`

ldap server ports

Default value: `[389, 636]`

### <a name="nftables--rules--llmnr"></a>`nftables::rules::llmnr`

allow incoming Link-Local Multicast Name Resolution

* **See also**

  * https://datatracker.ietf.org/doc/html/rfc4795

#### Parameters

The following parameters are available in the `nftables::rules::llmnr` class:

* [`ipv4`](#-nftables--rules--llmnr--ipv4)

* [`ipv6`](#-nftables--rules--llmnr--ipv6)

* [`iifname`](#-nftables--rules--llmnr--iifname)

##### <a name="-nftables--rules--llmnr--ipv4"></a>`ipv4`

Data type: `Boolean`

Allow LLMNR over IPv4

Default value: `true`

##### <a name="-nftables--rules--llmnr--ipv6"></a>`ipv6`

Data type: `Boolean`

Allow LLMNR over IPv6

Default value: `true`

##### <a name="-nftables--rules--llmnr--iifname"></a>`iifname`

Data type: `Array[String[1]]`

optional list of incoming interfaces to filter on

Default value: `[]`

### <a name="nftables--rules--mdns"></a>`nftables::rules::mdns`

allow incoming multicast DNS

#### Parameters

The following parameters are available in the `nftables::rules::mdns` class:

* [`ipv4`](#-nftables--rules--mdns--ipv4)

* [`ipv6`](#-nftables--rules--mdns--ipv6)

* [`iifname`](#-nftables--rules--mdns--iifname)

##### <a name="-nftables--rules--mdns--ipv4"></a>`ipv4`

Data type: `Boolean`

Allow mdns over IPv4

Default value: `true`

##### <a name="-nftables--rules--mdns--ipv6"></a>`ipv6`

Data type: `Boolean`

Allow mdns over IPv6

Default value: `true`

##### <a name="-nftables--rules--mdns--iifname"></a>`iifname`

Data type: `Array[String[1]]`

name for incoming interfaces to filter

Default value: `[]`

### <a name="nftables--rules--multicast"></a>`nftables::rules::multicast`

allow incoming multicast traffic

### <a name="nftables--rules--nfs"></a>`nftables::rules::nfs`

manage in nfs4

### <a name="nftables--rules--nfs3"></a>`nftables::rules::nfs3`

manage in nfs3

### <a name="nftables--rules--node_exporter"></a>`nftables::rules::node_exporter`

manage in node exporter

#### Parameters

The following parameters are available in the `nftables::rules::node_exporter` class:

* [`prometheus_server`](#-nftables--rules--node_exporter--prometheus_server)

* [`port`](#-nftables--rules--node_exporter--port)

##### <a name="-nftables--rules--node_exporter--prometheus_server"></a>`prometheus_server`

Data type: `Optional[Variant[String,Array[String,1]]]`

Specify server name

Default value: `undef`

##### <a name="-nftables--rules--node_exporter--port"></a>`port`

Data type: `Stdlib::Port`

Specify port to open

Default value: `9100`

### <a name="nftables--rules--ospf"></a>`nftables::rules::ospf`

manage in ospf

### <a name="nftables--rules--ospf3"></a>`nftables::rules::ospf3`

manage in ospf3

#### Parameters

The following parameters are available in the `nftables::rules::ospf3` class:

* [`iifname`](#-nftables--rules--ospf3--iifname)

##### <a name="-nftables--rules--ospf3--iifname"></a>`iifname`

Data type: `Array[String[1]]`

optional list of incoming interfaces to allow traffic

Default value: `[]`

### <a name="nftables--rules--out--active_directory"></a>`nftables::rules::out::active_directory`

manage outgoing active diectory

#### Parameters

The following parameters are available in the `nftables::rules::out::active_directory` class:

* [`adserver`](#-nftables--rules--out--active_directory--adserver)

* [`adserver_ports`](#-nftables--rules--out--active_directory--adserver_ports)

##### <a name="-nftables--rules--out--active_directory--adserver"></a>`adserver`

Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]`

adserver IPs

##### <a name="-nftables--rules--out--active_directory--adserver_ports"></a>`adserver_ports`

Data type: `Array[Stdlib::Port,1]`

adserver ports

Default value: `[389, 636, 3268, 3269]`

### <a name="nftables--rules--out--all"></a>`nftables::rules::out::all`

allow all outbound

### <a name="nftables--rules--out--ceph_client"></a>`nftables::rules::out::ceph_client`

Ceph is a distributed object store and file system.

Enable this to be a client of Ceph's Monitor (MON),

Object Storage Daemons (OSD), Metadata Server Daemons (MDS),

and Manager Daemons (MGR).

#### Parameters

The following parameters are available in the `nftables::rules::out::ceph_client` class:

* [`ports`](#-nftables--rules--out--ceph_client--ports)

##### <a name="-nftables--rules--out--ceph_client--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

Specify ports to open

Default value: `[3300, 6789]`

### <a name="nftables--rules--out--chrony"></a>`nftables::rules::out::chrony`

manage out chrony

#### Parameters

The following parameters are available in the `nftables::rules::out::chrony` class:

* [`servers`](#-nftables--rules--out--chrony--servers)

##### <a name="-nftables--rules--out--chrony--servers"></a>`servers`

Data type: `Array[Stdlib::IP::Address]`

single IP-Address or array of IP-addresses from NTP servers

Default value: `[]`

### <a name="nftables--rules--out--dhcp"></a>`nftables::rules::out::dhcp`

manage out dhcp

### <a name="nftables--rules--out--dhcpv6_client"></a>`nftables::rules::out::dhcpv6_client`

Allow DHCPv6 requests out of a host

### <a name="nftables--rules--out--dns"></a>`nftables::rules::out::dns`

manage out dns

#### Parameters

The following parameters are available in the `nftables::rules::out::dns` class:

* [`dns_server`](#-nftables--rules--out--dns--dns_server)

##### <a name="-nftables--rules--out--dns--dns_server"></a>`dns_server`

Data type: `Array[Stdlib::IP::Address]`

specify dns_server name

Default value: `[]`

### <a name="nftables--rules--out--hkp"></a>`nftables::rules::out::hkp`

allow outgoing hkp connections to gpg keyservers

### <a name="nftables--rules--out--http"></a>`nftables::rules::out::http`

manage out http

### <a name="nftables--rules--out--https"></a>`nftables::rules::out::https`

manage out https

### <a name="nftables--rules--out--icinga2"></a>`nftables::rules::out::icinga2`

allow outgoing icinga2

#### Parameters

The following parameters are available in the `nftables::rules::out::icinga2` class:

* [`ports`](#-nftables--rules--out--icinga2--ports)

##### <a name="-nftables--rules--out--icinga2--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

icinga2 ports

Default value: `[5665]`

### <a name="nftables--rules--out--icmp"></a>`nftables::rules::out::icmp`

control outbound icmp packages

#### Parameters

The following parameters are available in the `nftables::rules::out::icmp` class:

* [`v4_types`](#-nftables--rules--out--icmp--v4_types)

* [`v6_types`](#-nftables--rules--out--icmp--v6_types)

* [`order`](#-nftables--rules--out--icmp--order)

##### <a name="-nftables--rules--out--icmp--v4_types"></a>`v4_types`

Data type: `Optional[Array[String]]`

ICMP v4 types that should be allowed

Default value: `undef`

##### <a name="-nftables--rules--out--icmp--v6_types"></a>`v6_types`

Data type: `Optional[Array[String]]`

ICMP v6 types that should be allowed

Default value: `undef`

##### <a name="-nftables--rules--out--icmp--order"></a>`order`

Data type: `String`

the ordering of the rules

Default value: `'10'`