puppet nftables

Révision 7b9d6ffc

Allow creating a totally empty firewall

By setting `nftables::inet_filter` and `nftables::nat` to `false`
users can now start off from a totally empty firewall and add the
tables, chains and rules they'd like.

The default skeleton for inet-filter, ip-nat and ip6-nat is kept
enabled by default.

Fixes #95.

<%- |

  Boolean $inet_filter,

  Boolean $nat,

  Optional[Array[String[1],1]] $noflush = undef,

|-%>

<%= $_flush_command.join("\n") %>

include "custom-*.nft"

<% if $inet_filter { -%>

include "inet-filter.nft"

<% } -%>

<% if $nat { -%>

include "ip-nat.nft"

include "ip6-nat.nft"

Formats disponibles : Unified diff