root / manifests / init.pp @ 5df9303f
Historique | Voir | Annoter | Télécharger (3,14 ko)
| 1 |
# manage nftables |
|---|---|
| 2 |
class nftables ( |
| 3 |
Boolean $in_ssh = true, |
| 4 |
Boolean $out_ntp = true, |
| 5 |
Boolean $out_dns = true, |
| 6 |
Boolean $out_http = true, |
| 7 |
Boolean $out_https = true, |
| 8 |
) {
|
| 9 |
|
| 10 |
package{'nftables':
|
| 11 |
ensure => installed, |
| 12 |
} -> file_line{
|
| 13 |
'enable_nftables': |
| 14 |
line => 'include "/etc/nftables/puppet.nft"', |
| 15 |
path => '/etc/sysconfig/nftables.conf', |
| 16 |
notify => Service['nftables'], |
| 17 |
} -> file{
|
| 18 |
default: |
| 19 |
owner => 'root', |
| 20 |
group => 'root', |
| 21 |
mode => '0640'; |
| 22 |
'/etc/nftables/puppet.nft': |
| 23 |
ensure => file, |
| 24 |
source => 'puppet:///modules/nftables/config/puppet.nft'; |
| 25 |
'/etc/nftables/puppet': |
| 26 |
ensure => directory, |
| 27 |
mode => '0750', |
| 28 |
purge => true, |
| 29 |
force => true, |
| 30 |
recurse => true; |
| 31 |
} ~> service{'nftables':
|
| 32 |
ensure => running, |
| 33 |
enable => true, |
| 34 |
} |
| 35 |
|
| 36 |
nftables::config{
|
| 37 |
'inet-filter': |
| 38 |
source => 'puppet:///modules/nftables/config/puppet-filter.nft'; |
| 39 |
'ip-nat': |
| 40 |
source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft'; |
| 41 |
} |
| 42 |
|
| 43 |
nftables::chain{
|
| 44 |
[ |
| 45 |
'INPUT', |
| 46 |
'OUTPUT', |
| 47 |
'FORWARD', |
| 48 |
]:; |
| 49 |
} |
| 50 |
|
| 51 |
nftables::chain{
|
| 52 |
'default_in': |
| 53 |
inject => '10-INPUT'; |
| 54 |
'default_out': |
| 55 |
inject => '10-OUTPUT'; |
| 56 |
'default_fwd': |
| 57 |
inject => '10-FORWARD'; |
| 58 |
} |
| 59 |
|
| 60 |
# filter-chain-INPUT |
| 61 |
nftables::rule{
|
| 62 |
'INPUT-type': |
| 63 |
order => '01', |
| 64 |
content => 'type filter hook input priority 0'; |
| 65 |
'INPUT-policy': |
| 66 |
order => '02', |
| 67 |
content => 'policy drop'; |
| 68 |
'INPUT-lo': |
| 69 |
order => '03', |
| 70 |
content => 'iifname lo accept'; |
| 71 |
'INPUT-jump_global': |
| 72 |
order => '04', |
| 73 |
content => 'jump global'; |
| 74 |
'INPUT-log_rejected': |
| 75 |
order => '98', |
| 76 |
content => 'log prefix "[nftables] INPUT Rejected: " flags all counter reject with icmpx type port-unreachable'; |
| 77 |
} |
| 78 |
|
| 79 |
# filter-chain-OUTPUT |
| 80 |
nftables::rule{
|
| 81 |
'OUTPUT-type': |
| 82 |
order => '01', |
| 83 |
content => 'type filter hook output priority 0'; |
| 84 |
'OUTPUT-policy': |
| 85 |
order => '02', |
| 86 |
content => 'policy drop'; |
| 87 |
'OUTPUT-lo': |
| 88 |
order => '03', |
| 89 |
content => 'oifname lo accept'; |
| 90 |
'OUTPUT-jump_global': |
| 91 |
order => '04', |
| 92 |
content => 'jump global'; |
| 93 |
'OUTPUT-log_rejected': |
| 94 |
order => '98', |
| 95 |
content => 'log prefix "[nftables] OUTPUT Rejected: " flags all counter reject with icmpx type port-unreachable'; |
| 96 |
} |
| 97 |
|
| 98 |
# filter-chain-FORWARD |
| 99 |
nftables::rule{
|
| 100 |
'FORWARD-type': |
| 101 |
order => '01', |
| 102 |
content => 'type filter hook forward priority 0'; |
| 103 |
'FORWARD-policy': |
| 104 |
order => '02', |
| 105 |
content => 'policy drop'; |
| 106 |
'FORWARD-jump_global': |
| 107 |
order => '03', |
| 108 |
content => 'jump global'; |
| 109 |
'FORWARD-log_rejected': |
| 110 |
order => '98', |
| 111 |
content => 'log prefix "[nftables] FORWARD Rejected: " flags all counter reject with icmpx type port-unreachable'; |
| 112 |
} |
| 113 |
|
| 114 |
# basic ingoing rules |
| 115 |
if $in_ssh {
|
| 116 |
include nftables::rules::ssh |
| 117 |
} |
| 118 |
|
| 119 |
# basic outgoing rules |
| 120 |
if $out_ntp {
|
| 121 |
include nftables::rules::out::chrony |
| 122 |
} |
| 123 |
if $out_dns {
|
| 124 |
include nftables::rules::out::dns |
| 125 |
} |
| 126 |
if $out_http {
|
| 127 |
include nftables::rules::out::http |
| 128 |
} |
| 129 |
if $out_https {
|
| 130 |
include nftables::rules::out::https |
| 131 |
} |
| 132 |
} |