puppet nftables

# Reference

<!-- DO NOT EDIT: This document was generated by Puppet Strings -->

## Table of Contents

### Classes

* [`nftables`](#nftables): Configure nftables

* [`nftables::bridges`](#nftables--bridges): allow forwarding traffic on bridges

* [`nftables::inet_filter`](#nftables--inet_filter): manage basic chains in table inet filter

* [`nftables::inet_filter::fwd_conntrack`](#nftables--inet_filter--fwd_conntrack): enable conntrack for fwd

* [`nftables::inet_filter::in_out_conntrack`](#nftables--inet_filter--in_out_conntrack): manage input & output conntrack

* [`nftables::ip_nat`](#nftables--ip_nat): manage basic chains in table ip nat

* [`nftables::rules::activemq`](#nftables--rules--activemq): Provides input rules for Apache ActiveMQ

* [`nftables::rules::afs3_callback`](#nftables--rules--afs3_callback): Open call back port for AFS clients

* [`nftables::rules::ceph`](#nftables--rules--ceph): Ceph is a distributed object store and file system. Enable this to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS)

* [`nftables::rules::ceph_mon`](#nftables--rules--ceph_mon): Ceph is a distributed object store and file system.

Enable this option to support Ceph's Monitor Daemon.

* [`nftables::rules::dhcpv6_client`](#nftables--rules--dhcpv6_client): allow DHCPv6 requests in to a host

* [`nftables::rules::dns`](#nftables--rules--dns): manage in dns

* [`nftables::rules::docker_ce`](#nftables--rules--docker_ce): Default firewall configuration for Docker-CE

* [`nftables::rules::http`](#nftables--rules--http): manage in http

* [`nftables::rules::https`](#nftables--rules--https): manage in https

* [`nftables::rules::icinga2`](#nftables--rules--icinga2): manage in icinga2

* [`nftables::rules::icmp`](#nftables--rules--icmp)

* [`nftables::rules::ldap`](#nftables--rules--ldap): manage in ldap

* [`nftables::rules::mdns`](#nftables--rules--mdns): allow incoming multicast DNS

* [`nftables::rules::multicast`](#nftables--rules--multicast): allow incoming multicast traffic

* [`nftables::rules::nfs`](#nftables--rules--nfs): manage in nfs4

* [`nftables::rules::nfs3`](#nftables--rules--nfs3): manage in nfs3

* [`nftables::rules::node_exporter`](#nftables--rules--node_exporter): manage in node exporter

* [`nftables::rules::ospf`](#nftables--rules--ospf): manage in ospf

* [`nftables::rules::ospf3`](#nftables--rules--ospf3): manage in ospf3

* [`nftables::rules::out::active_directory`](#nftables--rules--out--active_directory): manage outgoing active diectory

* [`nftables::rules::out::all`](#nftables--rules--out--all): allow all outbound

* [`nftables::rules::out::ceph_client`](#nftables--rules--out--ceph_client): Ceph is a distributed object store and file system.

Enable this to be a client of Ceph's Monitor (MON),

Object Storage Daemons (OSD), Metadata Server Daemons (MDS),

and Manager Daemons (MGR).

* [`nftables::rules::out::chrony`](#nftables--rules--out--chrony): manage out chrony

* [`nftables::rules::out::dhcp`](#nftables--rules--out--dhcp): manage out dhcp

* [`nftables::rules::out::dhcpv6_client`](#nftables--rules--out--dhcpv6_client): Allow DHCPv6 requests out of a host

* [`nftables::rules::out::dns`](#nftables--rules--out--dns): manage out dns

* [`nftables::rules::out::hkp`](#nftables--rules--out--hkp): allow outgoing hkp connections to gpg keyservers

* [`nftables::rules::out::http`](#nftables--rules--out--http): manage out http

* [`nftables::rules::out::https`](#nftables--rules--out--https): manage out https

* [`nftables::rules::out::icmp`](#nftables--rules--out--icmp): control outbound icmp packages

* [`nftables::rules::out::imap`](#nftables--rules--out--imap): allow outgoing imap

* [`nftables::rules::out::kerberos`](#nftables--rules--out--kerberos): allows outbound access for kerberos

* [`nftables::rules::out::ldap`](#nftables--rules--out--ldap): manage outgoing ldap

* [`nftables::rules::out::mysql`](#nftables--rules--out--mysql): manage out mysql

* [`nftables::rules::out::nfs`](#nftables--rules--out--nfs): manage out nfs

* [`nftables::rules::out::nfs3`](#nftables--rules--out--nfs3): manage out nfs3

* [`nftables::rules::out::openafs_client`](#nftables--rules--out--openafs_client): allows outbound access for afs clients

7000 - afs3-fileserver

7002 - afs3-ptserver

7003 - vlserver

* [`nftables::rules::out::ospf`](#nftables--rules--out--ospf): manage out ospf

* [`nftables::rules::out::ospf3`](#nftables--rules--out--ospf3): manage out ospf3

* [`nftables::rules::out::pop3`](#nftables--rules--out--pop3): allow outgoing pop3

* [`nftables::rules::out::postgres`](#nftables--rules--out--postgres): manage out postgres

* [`nftables::rules::out::puppet`](#nftables--rules--out--puppet): manage outgoing puppet

* [`nftables::rules::out::pxp_agent`](#nftables--rules--out--pxp_agent): manage outgoing pxp-agent

* [`nftables::rules::out::smtp`](#nftables--rules--out--smtp): allow outgoing smtp

* [`nftables::rules::out::smtp_client`](#nftables--rules--out--smtp_client): allow outgoing smtp client

* [`nftables::rules::out::ssh`](#nftables--rules--out--ssh): manage out ssh

* [`nftables::rules::out::ssh::remove`](#nftables--rules--out--ssh--remove): disable outgoing ssh

* [`nftables::rules::out::tor`](#nftables--rules--out--tor): manage out tor

* [`nftables::rules::out::whois`](#nftables--rules--out--whois): allow clients to query remote whois server

* [`nftables::rules::out::wireguard`](#nftables--rules--out--wireguard): manage out wireguard

* [`nftables::rules::puppet`](#nftables--rules--puppet): manage in puppet

* [`nftables::rules::pxp_agent`](#nftables--rules--pxp_agent): manage in pxp-agent

* [`nftables::rules::qemu`](#nftables--rules--qemu): Bridged network configuration for qemu/libvirt

* [`nftables::rules::samba`](#nftables--rules--samba): manage Samba, the suite to allow Windows file sharing on Linux resources.

* [`nftables::rules::smtp`](#nftables--rules--smtp): manage in smtp

* [`nftables::rules::smtp_submission`](#nftables--rules--smtp_submission): manage in smtp submission

* [`nftables::rules::smtps`](#nftables--rules--smtps): manage in smtps

* [`nftables::rules::spotify`](#nftables--rules--spotify): allow incoming spotify

* [`nftables::rules::ssh`](#nftables--rules--ssh): manage in ssh

* [`nftables::rules::tor`](#nftables--rules--tor): manage in tor

* [`nftables::rules::wireguard`](#nftables--rules--wireguard): manage in wireguard

* [`nftables::services::dhcpv6_client`](#nftables--services--dhcpv6_client): Allow in and outbound traffic for DHCPv6 server

* [`nftables::services::openafs_client`](#nftables--services--openafs_client): Open inbound and outbound ports for an AFS client

### Defined types

* [`nftables::chain`](#nftables--chain): manage a chain

* [`nftables::config`](#nftables--config): manage a config snippet

* [`nftables::file`](#nftables--file): Insert a file into the nftables configuration

* [`nftables::rule`](#nftables--rule): Provides an interface to create a firewall rule

* [`nftables::rules::dnat4`](#nftables--rules--dnat4): manage a ipv4 dnat rule

* [`nftables::rules::masquerade`](#nftables--rules--masquerade): masquerade all outgoing traffic

* [`nftables::rules::snat4`](#nftables--rules--snat4): manage a ipv4 snat rule

* [`nftables::set`](#nftables--set): manage a named set

* [`nftables::simplerule`](#nftables--simplerule): Provides a simplified interface to nftables::rule

### Data types

* [`Nftables::Addr`](#Nftables--Addr): Represents an address expression to be used within a rule.

* [`Nftables::Addr::Set`](#Nftables--Addr--Set): Represents a set expression to be used within a rule.

* [`Nftables::Port`](#Nftables--Port): Represents a port expression to be used within a rule.

* [`Nftables::Port::Range`](#Nftables--Port--Range): Represents a port range expression to be used within a rule.

* [`Nftables::RuleName`](#Nftables--RuleName): Represents a rule name to be used in a raw rule created via nftables::rule.

It's a dash separated string. The first component describes the chain to

add the rule to, the second the rule name and the (optional) third a number.

Ex: 'default_in-sshd', 'default_out-my_service-2'.

* [`Nftables::SimpleRuleName`](#Nftables--SimpleRuleName): Represents a simple rule name to be used in a rule created via nftables::simplerule

## Classes

### <a name="nftables"></a>`nftables`

Configure nftables

#### Examples

##### allow dns out and do not allow ntp out

```puppet

class{ 'nftables':

  out_ntp => false,

  out_dns => true,

}

```

##### do not flush particular tables, fail2ban in this case

```puppet

class{ 'nftables':

  noflush_tables => ['inet-f2b-table'],

}

```

#### Parameters

The following parameters are available in the `nftables` class:

* [`out_all`](#-nftables--out_all)

* [`out_ntp`](#-nftables--out_ntp)

* [`out_http`](#-nftables--out_http)

* [`out_dns`](#-nftables--out_dns)

* [`out_https`](#-nftables--out_https)

* [`out_icmp`](#-nftables--out_icmp)

* [`in_ssh`](#-nftables--in_ssh)

* [`in_icmp`](#-nftables--in_icmp)

* [`inet_filter`](#-nftables--inet_filter)

* [`nat`](#-nftables--nat)

* [`nat_table_name`](#-nftables--nat_table_name)

* [`sets`](#-nftables--sets)

* [`log_prefix`](#-nftables--log_prefix)

* [`log_limit`](#-nftables--log_limit)

* [`reject_with`](#-nftables--reject_with)

* [`in_out_conntrack`](#-nftables--in_out_conntrack)

* [`fwd_conntrack`](#-nftables--fwd_conntrack)

* [`firewalld_enable`](#-nftables--firewalld_enable)

* [`noflush_tables`](#-nftables--noflush_tables)

* [`rules`](#-nftables--rules)

* [`configuration_path`](#-nftables--configuration_path)

* [`nft_path`](#-nftables--nft_path)

* [`echo`](#-nftables--echo)

* [`default_config_mode`](#-nftables--default_config_mode)

##### <a name="-nftables--out_all"></a>`out_all`

Data type: `Boolean`

Allow all outbound connections. If `true` then all other

out parameters `out_ntp`, `out_dns`, ... will be assuemed

false.

Default value: `false`

##### <a name="-nftables--out_ntp"></a>`out_ntp`

Data type: `Boolean`

Allow outbound to ntp servers.

Default value: `true`

##### <a name="-nftables--out_http"></a>`out_http`

Data type: `Boolean`

Allow outbound to http servers.

Default value: `true`

##### <a name="-nftables--out_dns"></a>`out_dns`

Data type: `Boolean`

Allow outbound to dns servers.

Default value: `true`

##### <a name="-nftables--out_https"></a>`out_https`

Data type: `Boolean`

Allow outbound to https servers.

Default value: `true`

##### <a name="-nftables--out_icmp"></a>`out_icmp`

Data type: `Boolean`

Allow outbound ICMPv4/v6 traffic.

Default value: `true`

##### <a name="-nftables--in_ssh"></a>`in_ssh`

Data type: `Boolean`

Allow inbound to ssh servers.

Default value: `true`

##### <a name="-nftables--in_icmp"></a>`in_icmp`

Data type: `Boolean`

Allow inbound ICMPv4/v6 traffic.

Default value: `true`

##### <a name="-nftables--inet_filter"></a>`inet_filter`

Data type: `Boolean`

Add default tables, chains and rules to process traffic.

Default value: `true`

##### <a name="-nftables--nat"></a>`nat`

Data type: `Boolean`

Add default tables and chains to process NAT traffic.

Default value: `true`

##### <a name="-nftables--nat_table_name"></a>`nat_table_name`

Data type: `String[1]`

The name of the 'nat' table.

Default value: `'nat'`

##### <a name="-nftables--sets"></a>`sets`

Data type: `Hash`

Allows sourcing set definitions directly from Hiera.

Default value: `{}`

##### <a name="-nftables--log_prefix"></a>`log_prefix`

Data type: `String`

String that will be used as prefix when logging packets. It can contain

two variables using standard sprintf() string-formatting:

 * chain: Will be replaced by the name of the chain.

 * comment: Allows chains to add extra comments.

Default value: `'[nftables] %<chain>s %<comment>s'`

##### <a name="-nftables--log_limit"></a>`log_limit`

Data type: `Variant[Boolean[false], String]`

String with the content of a limit statement to be applied

to the rules that log discarded traffic. Set to false to

disable rate limiting.

Default value: `'3/minute burst 5 packets'`

##### <a name="-nftables--reject_with"></a>`reject_with`

Data type: `Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]]`

How to discard packets not matching any rule. If `false`, the

fate of the packet will be defined by the chain policy (normally

drop), otherwise the packet will be rejected with the REJECT_WITH

policy indicated by the value of this parameter.

Default value: `'icmpx type port-unreachable'`

##### <a name="-nftables--in_out_conntrack"></a>`in_out_conntrack`

Data type: `Boolean`

Adds INPUT and OUTPUT rules to allow traffic that's part of an

established connection and also to drop invalid packets.

Default value: `true`

##### <a name="-nftables--fwd_conntrack"></a>`fwd_conntrack`

Data type: `Boolean`

Adds FORWARD rules to allow traffic that's part of an

established connection and also to drop invalid packets.

Default value: `false`

##### <a name="-nftables--firewalld_enable"></a>`firewalld_enable`

Data type: `Variant[Boolean[false], Enum['mask']]`

Configures how the firewalld systemd service unit is enabled. It might be

useful to set this to false if you're externaly removing firewalld from

the system completely.

Default value: `'mask'`

##### <a name="-nftables--noflush_tables"></a>`noflush_tables`

Data type: `Optional[Array[Pattern[/^(ip|ip6|inet|arp|bridge|netdev)-[-a-zA-Z0-9_]+$/],1]]`

If specified only other existings tables will be flushed.

If left unset all tables will be flushed via a `flush ruleset`

Default value: `undef`

##### <a name="-nftables--rules"></a>`rules`

Data type: `Hash`

Specify hashes of `nftables::rule`s via hiera

Default value: `{}`

##### <a name="-nftables--configuration_path"></a>`configuration_path`

Data type: `Stdlib::Unixpath`

The absolute path to the principal nftables configuration file. The default

varies depending on the system, and is set in the module's data.

##### <a name="-nftables--nft_path"></a>`nft_path`

Data type: `Stdlib::Unixpath`

Path to the nft binary

##### <a name="-nftables--echo"></a>`echo`

Data type: `Stdlib::Unixpath`

Path to the echo binary

##### <a name="-nftables--default_config_mode"></a>`default_config_mode`

Data type: `Stdlib::Filemode`

The default file & dir mode for configuration files and directories. The

default varies depending on the system, and is set in the module's data.

### <a name="nftables--bridges"></a>`nftables::bridges`

allow forwarding traffic on bridges

#### Parameters

The following parameters are available in the `nftables::bridges` class:

* [`ensure`](#-nftables--bridges--ensure)

* [`bridgenames`](#-nftables--bridges--bridgenames)

##### <a name="-nftables--bridges--ensure"></a>`ensure`

Data type: `Enum['present','absent']`

Default value: `'present'`

##### <a name="-nftables--bridges--bridgenames"></a>`bridgenames`

Data type: `Regexp`

Default value: `/^br.+/`

### <a name="nftables--inet_filter"></a>`nftables::inet_filter`

manage basic chains in table inet filter

### <a name="nftables--inet_filter--fwd_conntrack"></a>`nftables::inet_filter::fwd_conntrack`

enable conntrack for fwd

### <a name="nftables--inet_filter--in_out_conntrack"></a>`nftables::inet_filter::in_out_conntrack`

manage input & output conntrack

### <a name="nftables--ip_nat"></a>`nftables::ip_nat`

manage basic chains in table ip nat

### <a name="nftables--rules--activemq"></a>`nftables::rules::activemq`

Provides input rules for Apache ActiveMQ

#### Parameters

The following parameters are available in the `nftables::rules::activemq` class:

* [`tcp`](#-nftables--rules--activemq--tcp)

* [`udp`](#-nftables--rules--activemq--udp)

* [`port`](#-nftables--rules--activemq--port)

##### <a name="-nftables--rules--activemq--tcp"></a>`tcp`

Data type: `Boolean`

Create the rule for TCP traffic.

Default value: `true`

##### <a name="-nftables--rules--activemq--udp"></a>`udp`

Data type: `Boolean`

Create the rule for UDP traffic.

Default value: `true`

##### <a name="-nftables--rules--activemq--port"></a>`port`

Data type: `Stdlib::Port`

The port number for the ActiveMQ daemon.

Default value: `61616`

### <a name="nftables--rules--afs3_callback"></a>`nftables::rules::afs3_callback`

Open call back port for AFS clients

#### Examples

##### allow call backs from particular hosts

```puppet

class{'nftables::rules::afs3_callback':

  saddr => ['192.168.0.0/16', '10.0.0.222']

}

```

#### Parameters

The following parameters are available in the `nftables::rules::afs3_callback` class:

* [`saddr`](#-nftables--rules--afs3_callback--saddr)

##### <a name="-nftables--rules--afs3_callback--saddr"></a>`saddr`

Data type: `Array[Stdlib::IP::Address::V4,1]`

list of source network ranges to a

Default value: `['0.0.0.0/0']`

### <a name="nftables--rules--ceph"></a>`nftables::rules::ceph`

Ceph is a distributed object store and file system.

Enable this to support Ceph's Object Storage Daemons (OSD),

Metadata Server Daemons (MDS), or Manager Daemons (MGR).

### <a name="nftables--rules--ceph_mon"></a>`nftables::rules::ceph_mon`

Ceph is a distributed object store and file system.

Enable this option to support Ceph's Monitor Daemon.

#### Parameters

The following parameters are available in the `nftables::rules::ceph_mon` class:

* [`ports`](#-nftables--rules--ceph_mon--ports)

##### <a name="-nftables--rules--ceph_mon--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

specify ports for ceph service

Default value: `[3300, 6789]`

### <a name="nftables--rules--dhcpv6_client"></a>`nftables::rules::dhcpv6_client`

allow DHCPv6 requests in to a host

### <a name="nftables--rules--dns"></a>`nftables::rules::dns`

manage in dns

#### Parameters

The following parameters are available in the `nftables::rules::dns` class:

* [`ports`](#-nftables--rules--dns--ports)

##### <a name="-nftables--rules--dns--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

Specify ports for dns.

Default value: `[53]`

### <a name="nftables--rules--docker_ce"></a>`nftables::rules::docker_ce`

The configuration distributed in this class represents the default firewall

configuration done by docker-ce when the iptables integration is enabled.

This class is needed as the default docker-ce rules added to ip-filter conflict

with the inet-filter forward rules set by default in this module.

When using this class 'docker::iptables: false' should be set.

#### Parameters

The following parameters are available in the `nftables::rules::docker_ce` class:

* [`docker_interface`](#-nftables--rules--docker_ce--docker_interface)

* [`docker_prefix`](#-nftables--rules--docker_ce--docker_prefix)

* [`manage_docker_chains`](#-nftables--rules--docker_ce--manage_docker_chains)

* [`manage_base_chains`](#-nftables--rules--docker_ce--manage_base_chains)

##### <a name="-nftables--rules--docker_ce--docker_interface"></a>`docker_interface`

Data type: `String[1]`

Interface name used by docker.

Default value: `'docker0'`

##### <a name="-nftables--rules--docker_ce--docker_prefix"></a>`docker_prefix`

Data type: `Stdlib::IP::Address::V4::CIDR`

The address space used by docker.

Default value: `'172.17.0.0/16'`

##### <a name="-nftables--rules--docker_ce--manage_docker_chains"></a>`manage_docker_chains`

Data type: `Boolean`

Flag to control whether the class should create the docker related chains.

Default value: `true`

##### <a name="-nftables--rules--docker_ce--manage_base_chains"></a>`manage_base_chains`

Data type: `Boolean`

Flag to control whether the class should create the base common chains.

Default value: `true`

### <a name="nftables--rules--http"></a>`nftables::rules::http`

manage in http

### <a name="nftables--rules--https"></a>`nftables::rules::https`

manage in https

### <a name="nftables--rules--icinga2"></a>`nftables::rules::icinga2`

manage in icinga2

#### Parameters

The following parameters are available in the `nftables::rules::icinga2` class:

* [`ports`](#-nftables--rules--icinga2--ports)

##### <a name="-nftables--rules--icinga2--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

Specify ports for icinga2

Default value: `[5665]`

### <a name="nftables--rules--icmp"></a>`nftables::rules::icmp`

The nftables::rules::icmp class.

#### Parameters

The following parameters are available in the `nftables::rules::icmp` class:

* [`v4_types`](#-nftables--rules--icmp--v4_types)

* [`v6_types`](#-nftables--rules--icmp--v6_types)

* [`order`](#-nftables--rules--icmp--order)

##### <a name="-nftables--rules--icmp--v4_types"></a>`v4_types`

Data type: `Optional[Array[String]]`

Default value: `undef`

##### <a name="-nftables--rules--icmp--v6_types"></a>`v6_types`

Data type: `Optional[Array[String]]`

Default value: `undef`

##### <a name="-nftables--rules--icmp--order"></a>`order`

Data type: `String`

Default value: `'10'`

### <a name="nftables--rules--ldap"></a>`nftables::rules::ldap`

manage in ldap

#### Parameters

The following parameters are available in the `nftables::rules::ldap` class:

* [`ports`](#-nftables--rules--ldap--ports)

##### <a name="-nftables--rules--ldap--ports"></a>`ports`

Data type: `Array[Integer,1]`

ldap server ports

Default value: `[389, 636]`

### <a name="nftables--rules--mdns"></a>`nftables::rules::mdns`

allow incoming multicast DNS

### <a name="nftables--rules--multicast"></a>`nftables::rules::multicast`

allow incoming multicast traffic

### <a name="nftables--rules--nfs"></a>`nftables::rules::nfs`

manage in nfs4

### <a name="nftables--rules--nfs3"></a>`nftables::rules::nfs3`

manage in nfs3

### <a name="nftables--rules--node_exporter"></a>`nftables::rules::node_exporter`

manage in node exporter

#### Parameters

The following parameters are available in the `nftables::rules::node_exporter` class:

* [`prometheus_server`](#-nftables--rules--node_exporter--prometheus_server)

* [`port`](#-nftables--rules--node_exporter--port)

##### <a name="-nftables--rules--node_exporter--prometheus_server"></a>`prometheus_server`

Data type: `Optional[Variant[String,Array[String,1]]]`

Specify server name

Default value: `undef`

##### <a name="-nftables--rules--node_exporter--port"></a>`port`

Data type: `Stdlib::Port`

Specify port to open

Default value: `9100`

### <a name="nftables--rules--ospf"></a>`nftables::rules::ospf`

manage in ospf

### <a name="nftables--rules--ospf3"></a>`nftables::rules::ospf3`

manage in ospf3

### <a name="nftables--rules--out--active_directory"></a>`nftables::rules::out::active_directory`

manage outgoing active diectory

#### Parameters

The following parameters are available in the `nftables::rules::out::active_directory` class:

* [`adserver`](#-nftables--rules--out--active_directory--adserver)

* [`adserver_ports`](#-nftables--rules--out--active_directory--adserver_ports)

##### <a name="-nftables--rules--out--active_directory--adserver"></a>`adserver`

Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]`

adserver IPs

##### <a name="-nftables--rules--out--active_directory--adserver_ports"></a>`adserver_ports`

Data type: `Array[Stdlib::Port,1]`

adserver ports

Default value: `[389, 636, 3268, 3269]`

### <a name="nftables--rules--out--all"></a>`nftables::rules::out::all`

allow all outbound

### <a name="nftables--rules--out--ceph_client"></a>`nftables::rules::out::ceph_client`

Ceph is a distributed object store and file system.

Enable this to be a client of Ceph's Monitor (MON),

Object Storage Daemons (OSD), Metadata Server Daemons (MDS),

and Manager Daemons (MGR).

#### Parameters

The following parameters are available in the `nftables::rules::out::ceph_client` class:

* [`ports`](#-nftables--rules--out--ceph_client--ports)

##### <a name="-nftables--rules--out--ceph_client--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

Specify ports to open

Default value: `[3300, 6789]`

### <a name="nftables--rules--out--chrony"></a>`nftables::rules::out::chrony`

manage out chrony

#### Parameters

The following parameters are available in the `nftables::rules::out::chrony` class:

* [`servers`](#-nftables--rules--out--chrony--servers)

##### <a name="-nftables--rules--out--chrony--servers"></a>`servers`

Data type: `Array[Stdlib::IP::Address]`

single IP-Address or array of IP-addresses from NTP servers

Default value: `[]`

### <a name="nftables--rules--out--dhcp"></a>`nftables::rules::out::dhcp`

manage out dhcp

### <a name="nftables--rules--out--dhcpv6_client"></a>`nftables::rules::out::dhcpv6_client`

Allow DHCPv6 requests out of a host

### <a name="nftables--rules--out--dns"></a>`nftables::rules::out::dns`

manage out dns

#### Parameters

The following parameters are available in the `nftables::rules::out::dns` class:

* [`dns_server`](#-nftables--rules--out--dns--dns_server)

##### <a name="-nftables--rules--out--dns--dns_server"></a>`dns_server`

Data type: `Optional[Variant[String,Array[String,1]]]`

specify dns_server name

Default value: `undef`

### <a name="nftables--rules--out--hkp"></a>`nftables::rules::out::hkp`

allow outgoing hkp connections to gpg keyservers

### <a name="nftables--rules--out--http"></a>`nftables::rules::out::http`

manage out http

### <a name="nftables--rules--out--https"></a>`nftables::rules::out::https`

manage out https

### <a name="nftables--rules--out--icmp"></a>`nftables::rules::out::icmp`

control outbound icmp packages

#### Parameters

The following parameters are available in the `nftables::rules::out::icmp` class:

* [`v4_types`](#-nftables--rules--out--icmp--v4_types)

* [`v6_types`](#-nftables--rules--out--icmp--v6_types)

* [`order`](#-nftables--rules--out--icmp--order)

##### <a name="-nftables--rules--out--icmp--v4_types"></a>`v4_types`

Data type: `Optional[Array[String]]`

Default value: `undef`

##### <a name="-nftables--rules--out--icmp--v6_types"></a>`v6_types`

Data type: `Optional[Array[String]]`

Default value: `undef`

##### <a name="-nftables--rules--out--icmp--order"></a>`order`

Data type: `String`

Default value: `'10'`

### <a name="nftables--rules--out--imap"></a>`nftables::rules::out::imap`

allow outgoing imap

### <a name="nftables--rules--out--kerberos"></a>`nftables::rules::out::kerberos`

allows outbound access for kerberos

### <a name="nftables--rules--out--ldap"></a>`nftables::rules::out::ldap`

manage outgoing ldap

#### Parameters

The following parameters are available in the `nftables::rules::out::ldap` class:

* [`ldapserver`](#-nftables--rules--out--ldap--ldapserver)

* [`ldapserver_ports`](#-nftables--rules--out--ldap--ldapserver_ports)

##### <a name="-nftables--rules--out--ldap--ldapserver"></a>`ldapserver`

Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]`

ldapserver IPs

##### <a name="-nftables--rules--out--ldap--ldapserver_ports"></a>`ldapserver_ports`

Data type: `Array[Stdlib::Port,1]`

ldapserver ports

Default value: `[389, 636]`

### <a name="nftables--rules--out--mysql"></a>`nftables::rules::out::mysql`

manage out mysql

### <a name="nftables--rules--out--nfs"></a>`nftables::rules::out::nfs`

manage out nfs

### <a name="nftables--rules--out--nfs3"></a>`nftables::rules::out::nfs3`

manage out nfs3

### <a name="nftables--rules--out--openafs_client"></a>`nftables::rules::out::openafs_client`

allows outbound access for afs clients

7000 - afs3-fileserver

7002 - afs3-ptserver

7003 - vlserver

* **See also**

  * https://wiki.openafs.org/devel/AFSServicePorts/

    * AFS Service Ports

#### Parameters

The following parameters are available in the `nftables::rules::out::openafs_client` class:

* [`ports`](#-nftables--rules--out--openafs_client--ports)

##### <a name="-nftables--rules--out--openafs_client--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

port numbers to use

Default value: `[7000, 7002, 7003]`

### <a name="nftables--rules--out--ospf"></a>`nftables::rules::out::ospf`

manage out ospf

### <a name="nftables--rules--out--ospf3"></a>`nftables::rules::out::ospf3`

manage out ospf3

### <a name="nftables--rules--out--pop3"></a>`nftables::rules::out::pop3`

allow outgoing pop3

### <a name="nftables--rules--out--postgres"></a>`nftables::rules::out::postgres`

manage out postgres

### <a name="nftables--rules--out--puppet"></a>`nftables::rules::out::puppet`

manage outgoing puppet

#### Parameters

The following parameters are available in the `nftables::rules::out::puppet` class:

* [`puppetserver`](#-nftables--rules--out--puppet--puppetserver)

* [`puppetserver_port`](#-nftables--rules--out--puppet--puppetserver_port)

##### <a name="-nftables--rules--out--puppet--puppetserver"></a>`puppetserver`

Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]`

puppetserver hostname

##### <a name="-nftables--rules--out--puppet--puppetserver_port"></a>`puppetserver_port`

Data type: `Stdlib::Port`

puppetserver port

Default value: `8140`

### <a name="nftables--rules--out--pxp_agent"></a>`nftables::rules::out::pxp_agent`

manage outgoing pxp-agent

* **See also**

  * also

    * take a look at nftables::rules::out::puppet, because the PXP agent also connects to a Puppetserver

#### Parameters

The following parameters are available in the `nftables::rules::out::pxp_agent` class:

* [`broker`](#-nftables--rules--out--pxp_agent--broker)

* [`broker_port`](#-nftables--rules--out--pxp_agent--broker_port)

##### <a name="-nftables--rules--out--pxp_agent--broker"></a>`broker`

Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]`

PXP broker IP(s)

##### <a name="-nftables--rules--out--pxp_agent--broker_port"></a>`broker_port`

Data type: `Stdlib::Port`

PXP broker port

Default value: `8142`

### <a name="nftables--rules--out--smtp"></a>`nftables::rules::out::smtp`

allow outgoing smtp

### <a name="nftables--rules--out--smtp_client"></a>`nftables::rules::out::smtp_client`

allow outgoing smtp client

### <a name="nftables--rules--out--ssh"></a>`nftables::rules::out::ssh`

manage out ssh

### <a name="nftables--rules--out--ssh--remove"></a>`nftables::rules::out::ssh::remove`

disable outgoing ssh

### <a name="nftables--rules--out--tor"></a>`nftables::rules::out::tor`

manage out tor

### <a name="nftables--rules--out--whois"></a>`nftables::rules::out::whois`

allow clients to query remote whois server

### <a name="nftables--rules--out--wireguard"></a>`nftables::rules::out::wireguard`

manage out wireguard

#### Parameters

The following parameters are available in the `nftables::rules::out::wireguard` class:

* [`ports`](#-nftables--rules--out--wireguard--ports)

##### <a name="-nftables--rules--out--wireguard--ports"></a>`ports`

Data type: `Array[Integer,1]`

specify wireguard ports

Default value: `[51820]`

### <a name="nftables--rules--puppet"></a>`nftables::rules::puppet`

manage in puppet

#### Parameters

The following parameters are available in the `nftables::rules::puppet` class:

* [`ports`](#-nftables--rules--puppet--ports)

##### <a name="-nftables--rules--puppet--ports"></a>`ports`

Data type: `Array[Integer,1]`

puppet server ports

Default value: `[8140]`

### <a name="nftables--rules--pxp_agent"></a>`nftables::rules::pxp_agent`

manage in pxp-agent

#### Parameters

The following parameters are available in the `nftables::rules::pxp_agent` class:

* [`ports`](#-nftables--rules--pxp_agent--ports)

##### <a name="-nftables--rules--pxp_agent--ports"></a>`ports`

Data type: `Array[Stdlib::Port,1]`

pxp server ports

Default value: `[8142]`

### <a name="nftables--rules--qemu"></a>`nftables::rules::qemu`

This class configures the typical firewall setup that libvirt

creates. Depending on your requirements you can switch on and off