root / manifests / init.pp @ 5df9303f
Historique | Voir | Annoter | Télécharger (3,14 ko)
| 1 | 0ba57c66 | mh | # manage nftables |
|---|---|---|---|
| 2 | be0b08e1 | tr | class nftables ( |
| 3 | Boolean $in_ssh = true, |
||
| 4 | Boolean $out_ntp = true, |
||
| 5 | Boolean $out_dns = true, |
||
| 6 | cd664666 | tr | Boolean $out_http = true, |
| 7 | be0b08e1 | tr | Boolean $out_https = true, |
| 8 | ) {
|
||
| 9 | |||
| 10 | 0ba57c66 | mh | package{'nftables':
|
| 11 | ensure => installed, |
||
| 12 | } -> file_line{
|
||
| 13 | 'enable_nftables': |
||
| 14 | line => 'include "/etc/nftables/puppet.nft"', |
||
| 15 | path => '/etc/sysconfig/nftables.conf', |
||
| 16 | notify => Service['nftables'], |
||
| 17 | } -> file{
|
||
| 18 | default: |
||
| 19 | e140adff | tr | owner => 'root', |
| 20 | group => 'root', |
||
| 21 | mode => '0640'; |
||
| 22 | 0ba57c66 | mh | '/etc/nftables/puppet.nft': |
| 23 | 5acb554a | tr | ensure => file, |
| 24 | 0ba57c66 | mh | source => 'puppet:///modules/nftables/config/puppet.nft'; |
| 25 | '/etc/nftables/puppet': |
||
| 26 | ensure => directory, |
||
| 27 | 5acb554a | tr | mode => '0750', |
| 28 | 0ba57c66 | mh | purge => true, |
| 29 | force => true, |
||
| 30 | recurse => true; |
||
| 31 | } ~> service{'nftables':
|
||
| 32 | e140adff | tr | ensure => running, |
| 33 | enable => true, |
||
| 34 | 0ba57c66 | mh | } |
| 35 | |||
| 36 | nftables::config{
|
||
| 37 | 5df9303f | tr | 'inet-filter': |
| 38 | 0ba57c66 | mh | source => 'puppet:///modules/nftables/config/puppet-filter.nft'; |
| 39 | 5933ab8e | tr | 'ip-nat': |
| 40 | source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft'; |
||
| 41 | 0ba57c66 | mh | } |
| 42 | |||
| 43 | 8efbdf9a | tr | nftables::chain{
|
| 44 | 0ba57c66 | mh | [ |
| 45 | 8efbdf9a | tr | 'INPUT', |
| 46 | 'OUTPUT', |
||
| 47 | 'FORWARD', |
||
| 48 | 0ba57c66 | mh | ]:; |
| 49 | } |
||
| 50 | be0b08e1 | tr | |
| 51 | 8efbdf9a | tr | nftables::chain{
|
| 52 | 'default_in': |
||
| 53 | inject => '10-INPUT'; |
||
| 54 | 'default_out': |
||
| 55 | inject => '10-OUTPUT'; |
||
| 56 | 'default_fwd': |
||
| 57 | inject => '10-FORWARD'; |
||
| 58 | } |
||
| 59 | |||
| 60 | # filter-chain-INPUT |
||
| 61 | nftables::rule{
|
||
| 62 | 'INPUT-type': |
||
| 63 | order => '01', |
||
| 64 | content => 'type filter hook input priority 0'; |
||
| 65 | 'INPUT-policy': |
||
| 66 | order => '02', |
||
| 67 | content => 'policy drop'; |
||
| 68 | 'INPUT-lo': |
||
| 69 | order => '03', |
||
| 70 | content => 'iifname lo accept'; |
||
| 71 | 'INPUT-jump_global': |
||
| 72 | order => '04', |
||
| 73 | content => 'jump global'; |
||
| 74 | 'INPUT-log_rejected': |
||
| 75 | order => '98', |
||
| 76 | content => 'log prefix "[nftables] INPUT Rejected: " flags all counter reject with icmpx type port-unreachable'; |
||
| 77 | } |
||
| 78 | |||
| 79 | # filter-chain-OUTPUT |
||
| 80 | nftables::rule{
|
||
| 81 | 'OUTPUT-type': |
||
| 82 | order => '01', |
||
| 83 | content => 'type filter hook output priority 0'; |
||
| 84 | 'OUTPUT-policy': |
||
| 85 | order => '02', |
||
| 86 | content => 'policy drop'; |
||
| 87 | 'OUTPUT-lo': |
||
| 88 | order => '03', |
||
| 89 | content => 'oifname lo accept'; |
||
| 90 | 'OUTPUT-jump_global': |
||
| 91 | order => '04', |
||
| 92 | content => 'jump global'; |
||
| 93 | 'OUTPUT-log_rejected': |
||
| 94 | order => '98', |
||
| 95 | content => 'log prefix "[nftables] OUTPUT Rejected: " flags all counter reject with icmpx type port-unreachable'; |
||
| 96 | } |
||
| 97 | |||
| 98 | # filter-chain-FORWARD |
||
| 99 | nftables::rule{
|
||
| 100 | 'FORWARD-type': |
||
| 101 | order => '01', |
||
| 102 | content => 'type filter hook forward priority 0'; |
||
| 103 | 'FORWARD-policy': |
||
| 104 | order => '02', |
||
| 105 | content => 'policy drop'; |
||
| 106 | 'FORWARD-jump_global': |
||
| 107 | order => '03', |
||
| 108 | content => 'jump global'; |
||
| 109 | 'FORWARD-log_rejected': |
||
| 110 | order => '98', |
||
| 111 | content => 'log prefix "[nftables] FORWARD Rejected: " flags all counter reject with icmpx type port-unreachable'; |
||
| 112 | } |
||
| 113 | |||
| 114 | be0b08e1 | tr | # basic ingoing rules |
| 115 | if $in_ssh {
|
||
| 116 | include nftables::rules::ssh |
||
| 117 | } |
||
| 118 | |||
| 119 | 0ba57c66 | mh | # basic outgoing rules |
| 120 | be0b08e1 | tr | if $out_ntp {
|
| 121 | 188e569f | tr | include nftables::rules::out::chrony |
| 122 | be0b08e1 | tr | } |
| 123 | if $out_dns {
|
||
| 124 | include nftables::rules::out::dns |
||
| 125 | } |
||
| 126 | cd664666 | tr | if $out_http {
|
| 127 | include nftables::rules::out::http |
||
| 128 | } |
||
| 129 | be0b08e1 | tr | if $out_https {
|
| 130 | include nftables::rules::out::https |
||
| 131 | 0ba57c66 | mh | } |
| 132 | } |