Révision 7f6cacc5
Refresh REFERENCE
| REFERENCE.md | ||
|---|---|---|
| 7 | 7 |
### Classes |
| 8 | 8 |
|
| 9 | 9 |
* [`nftables`](#nftables): Configure nftables |
| 10 |
* [`nftables::bridges`](#nftablesbridges): allow forwarding traffic on bridges |
|
| 10 | 11 |
* [`nftables::inet_filter`](#nftablesinet_filter): manage basic chains in table inet filter |
| 11 | 12 |
* [`nftables::ip_nat`](#nftablesip_nat): manage basic chains in table ip nat |
| 13 |
* [`nftables::rules::afs3_callback`](#nftablesrulesafs3_callback): Open call back port for AFS clients |
|
| 14 |
* [`nftables::rules::dhcpv6_client`](#nftablesrulesdhcpv6_client) |
|
| 15 |
* [`nftables::rules::dns`](#nftablesrulesdns): manage in dns |
|
| 12 | 16 |
* [`nftables::rules::http`](#nftablesruleshttp): manage in http |
| 13 | 17 |
* [`nftables::rules::https`](#nftablesruleshttps): manage in https |
| 14 | 18 |
* [`nftables::rules::icinga2`](#nftablesrulesicinga2): manage in icinga2 |
| 19 |
* [`nftables::rules::icmp`](#nftablesrulesicmp) |
|
| 20 |
* [`nftables::rules::node_exporter`](#nftablesrulesnode_exporter): manage in node exporter |
|
| 15 | 21 |
* [`nftables::rules::ospf`](#nftablesrulesospf): manage in ospf |
| 16 | 22 |
* [`nftables::rules::ospf3`](#nftablesrulesospf3): manage in ospf3 |
| 17 | 23 |
* [`nftables::rules::out::all`](#nftablesrulesoutall): allow all outbound |
| 18 | 24 |
* [`nftables::rules::out::chrony`](#nftablesrulesoutchrony): manage out chrony |
| 19 | 25 |
* [`nftables::rules::out::dhcp`](#nftablesrulesoutdhcp): manage out dhcp |
| 26 |
* [`nftables::rules::out::dhcpv6_client`](#nftablesrulesoutdhcpv6_client) |
|
| 20 | 27 |
* [`nftables::rules::out::dns`](#nftablesrulesoutdns): manage out dns |
| 21 | 28 |
* [`nftables::rules::out::http`](#nftablesrulesouthttp): manage out http |
| 22 | 29 |
* [`nftables::rules::out::https`](#nftablesrulesouthttps): manage out https |
| 30 |
* [`nftables::rules::out::icmp`](#nftablesrulesouticmp) |
|
| 31 |
* [`nftables::rules::out::kerberos`](#nftablesrulesoutkerberos): allows outbound access for kerberos |
|
| 23 | 32 |
* [`nftables::rules::out::mysql`](#nftablesrulesoutmysql): manage out mysql |
| 33 |
* [`nftables::rules::out::openafs_client`](#nftablesrulesoutopenafs_client): allows outbound access for afs clients |
|
| 24 | 34 |
* [`nftables::rules::out::ospf`](#nftablesrulesoutospf): manage out ospf |
| 25 | 35 |
* [`nftables::rules::out::ospf3`](#nftablesrulesoutospf3): manage out ospf3 |
| 26 | 36 |
* [`nftables::rules::out::postgres`](#nftablesrulesoutpostgres): manage out postgres |
| ... | ... | |
| 37 | 47 |
* [`nftables::rules::ssh`](#nftablesrulesssh): manage in ssh |
| 38 | 48 |
* [`nftables::rules::tor`](#nftablesrulestor): manage in tor |
| 39 | 49 |
* [`nftables::rules::wireguard`](#nftablesruleswireguard): manage in wireguard |
| 50 |
* [`nftables::services::dhcpv6_client`](#nftablesservicesdhcpv6_client) |
|
| 51 |
* [`nftables::services::openafs_client`](#nftablesservicesopenafs_client) |
|
| 40 | 52 |
|
| 41 | 53 |
### Defined types |
| 42 | 54 |
|
| ... | ... | |
| 46 | 58 |
* [`nftables::rules::dnat4`](#nftablesrulesdnat4): manage a ipv4 dnat rule |
| 47 | 59 |
* [`nftables::rules::masquerade`](#nftablesrulesmasquerade): masquerade all outgoing traffic |
| 48 | 60 |
* [`nftables::rules::snat4`](#nftablesrulessnat4): manage a ipv4 snat rule |
| 61 |
* [`nftables::set`](#nftablesset): manage a named set |
|
| 49 | 62 |
|
| 50 | 63 |
## Classes |
| 51 | 64 |
|
| ... | ... | |
| 108 | 121 |
|
| 109 | 122 |
Default value: ``true`` |
| 110 | 123 |
|
| 124 |
##### `out_icmp` |
|
| 125 |
|
|
| 126 |
Data type: `Boolean` |
|
| 127 |
|
|
| 128 |
Allow outbound ICMPv4/v6 traffic. |
|
| 129 |
|
|
| 130 |
Default value: ``true`` |
|
| 131 |
|
|
| 111 | 132 |
##### `in_ssh` |
| 112 | 133 |
|
| 113 | 134 |
Data type: `Boolean` |
| ... | ... | |
| 116 | 137 |
|
| 117 | 138 |
Default value: ``true`` |
| 118 | 139 |
|
| 140 |
##### `in_icmp` |
|
| 141 |
|
|
| 142 |
Data type: `Boolean` |
|
| 143 |
|
|
| 144 |
Allow inbound ICMPv4/v6 traffic. |
|
| 145 |
|
|
| 146 |
Default value: ``true`` |
|
| 147 |
|
|
| 148 |
##### `nat` |
|
| 149 |
|
|
| 150 |
Data type: `Boolean` |
|
| 151 |
|
|
| 152 |
Add default tables and chains to process NAT traffic. |
|
| 153 |
|
|
| 154 |
Default value: ``true`` |
|
| 155 |
|
|
| 156 |
##### `log_prefix` |
|
| 157 |
|
|
| 158 |
Data type: `String` |
|
| 159 |
|
|
| 160 |
String that will be used as prefix when logging packets. It can contain |
|
| 161 |
two variables using standard sprintf() string-formatting: |
|
| 162 |
* chain: Will be replaced by the name of the chain. |
|
| 163 |
* comment: Allows chains to add extra comments. |
|
| 164 |
|
|
| 165 |
Default value: `'[nftables] %<chain>s %<comment>s'` |
|
| 166 |
|
|
| 167 |
##### `reject_with` |
|
| 168 |
|
|
| 169 |
Data type: `Variant[Boolean[false], Pattern[ |
|
| 170 |
/icmp(v6|x)? type .+|tcp reset/]]` |
|
| 171 |
|
|
| 172 |
How to discard packets not matching any rule. If `false`, the |
|
| 173 |
fate of the packet will be defined by the chain policy (normally |
|
| 174 |
drop), otherwise the packet will be rejected with the REJECT_WITH |
|
| 175 |
policy indicated by the value of this parameter. |
|
| 176 |
|
|
| 177 |
Default value: `'icmpx type port-unreachable'` |
|
| 178 |
|
|
| 179 |
##### `in_out_conntrack` |
|
| 180 |
|
|
| 181 |
Data type: `Boolean` |
|
| 182 |
|
|
| 183 |
Adds INPUT and OUTPUT rules to allow traffic that's part of an |
|
| 184 |
established connection and also to drop invalid packets. |
|
| 185 |
|
|
| 186 |
Default value: ``true`` |
|
| 187 |
|
|
| 188 |
##### `firewalld_enable` |
|
| 189 |
|
|
| 190 |
Data type: `Variant[Boolean[false], Enum['mask']]` |
|
| 191 |
|
|
| 192 |
Configures how the firewalld systemd service unit is enabled. It might be |
|
| 193 |
useful to set this to false if you're externaly removing firewalld from |
|
| 194 |
the system completely. |
|
| 195 |
|
|
| 196 |
Default value: `'mask'` |
|
| 197 |
|
|
| 119 | 198 |
##### `out_dns` |
| 120 | 199 |
|
| 121 | 200 |
Data type: `Boolean` |
| ... | ... | |
| 124 | 203 |
|
| 125 | 204 |
Default value: ``true`` |
| 126 | 205 |
|
| 206 |
##### `rules` |
|
| 207 |
|
|
| 208 |
Data type: `Hash` |
|
| 209 |
|
|
| 210 |
|
|
| 211 |
|
|
| 212 |
Default value: `{}`
|
|
| 213 |
|
|
| 214 |
### `nftables::bridges` |
|
| 215 |
|
|
| 216 |
allow forwarding traffic on bridges |
|
| 217 |
|
|
| 218 |
#### Parameters |
|
| 219 |
|
|
| 220 |
The following parameters are available in the `nftables::bridges` class. |
|
| 221 |
|
|
| 222 |
##### `ensure` |
|
| 223 |
|
|
| 224 |
Data type: `Enum['present','absent']` |
|
| 225 |
|
|
| 226 |
|
|
| 227 |
|
|
| 228 |
Default value: `'present'` |
|
| 229 |
|
|
| 230 |
##### `bridgenames` |
|
| 231 |
|
|
| 232 |
Data type: `Regexp` |
|
| 233 |
|
|
| 234 |
|
|
| 235 |
|
|
| 236 |
Default value: `/^br.+/` |
|
| 237 |
|
|
| 127 | 238 |
### `nftables::inet_filter` |
| 128 | 239 |
|
| 129 | 240 |
manage basic chains in table inet filter |
| ... | ... | |
| 132 | 243 |
|
| 133 | 244 |
manage basic chains in table ip nat |
| 134 | 245 |
|
| 246 |
### `nftables::rules::afs3_callback` |
|
| 247 |
|
|
| 248 |
class{'nftables::rules::afs3_callback':
|
|
| 249 |
saddr => ['192.168.0.0/16', '10.0.0.222'] |
|
| 250 |
} |
|
| 251 |
|
|
| 252 |
#### Parameters |
|
| 253 |
|
|
| 254 |
The following parameters are available in the `nftables::rules::afs3_callback` class. |
|
| 255 |
|
|
| 256 |
##### `saddr` |
|
| 257 |
|
|
| 258 |
Data type: `Array[Stdlib::IP::Address::V4,1]` |
|
| 259 |
|
|
| 260 |
list of source network ranges to a |
|
| 261 |
|
|
| 262 |
Default value: `['0.0.0.0/0']` |
|
| 263 |
|
|
| 264 |
### `nftables::rules::dhcpv6_client` |
|
| 265 |
|
|
| 266 |
The nftables::rules::dhcpv6_client class. |
|
| 267 |
|
|
| 268 |
### `nftables::rules::dns` |
|
| 269 |
|
|
| 270 |
manage in dns |
|
| 271 |
|
|
| 272 |
#### Parameters |
|
| 273 |
|
|
| 274 |
The following parameters are available in the `nftables::rules::dns` class. |
|
| 275 |
|
|
| 276 |
##### `ports` |
|
| 277 |
|
|
| 278 |
Data type: `Array[Integer,1]` |
|
| 279 |
|
|
| 280 |
|
|
| 281 |
|
|
| 282 |
Default value: `[53]` |
|
| 283 |
|
|
| 135 | 284 |
### `nftables::rules::http` |
| 136 | 285 |
|
| 137 | 286 |
manage in http |
| ... | ... | |
| 156 | 305 |
|
| 157 | 306 |
Default value: `[5665]` |
| 158 | 307 |
|
| 308 |
### `nftables::rules::icmp` |
|
| 309 |
|
|
| 310 |
The nftables::rules::icmp class. |
|
| 311 |
|
|
| 312 |
#### Parameters |
|
| 313 |
|
|
| 314 |
The following parameters are available in the `nftables::rules::icmp` class. |
|
| 315 |
|
|
| 316 |
##### `v4_types` |
|
| 317 |
|
|
| 318 |
Data type: `Optional[Array[String]]` |
|
| 319 |
|
|
| 320 |
|
|
| 321 |
|
|
| 322 |
Default value: ``undef`` |
|
| 323 |
|
|
| 324 |
##### `v6_types` |
|
| 325 |
|
|
| 326 |
Data type: `Optional[Array[String]]` |
|
| 327 |
|
|
| 328 |
|
|
| 329 |
|
|
| 330 |
Default value: ``undef`` |
|
| 331 |
|
|
| 332 |
##### `order` |
|
| 333 |
|
|
| 334 |
Data type: `String` |
|
| 335 |
|
|
| 336 |
|
|
| 337 |
|
|
| 338 |
Default value: `'10'` |
|
| 339 |
|
|
| 340 |
### `nftables::rules::node_exporter` |
|
| 341 |
|
|
| 342 |
manage in node exporter |
|
| 343 |
|
|
| 344 |
#### Parameters |
|
| 345 |
|
|
| 346 |
The following parameters are available in the `nftables::rules::node_exporter` class. |
|
| 347 |
|
|
| 348 |
##### `prometheus_server` |
|
| 349 |
|
|
| 350 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
|
| 351 |
|
|
| 352 |
|
|
| 353 |
|
|
| 354 |
Default value: ``undef`` |
|
| 355 |
|
|
| 356 |
##### `port` |
|
| 357 |
|
|
| 358 |
Data type: `Integer` |
|
| 359 |
|
|
| 360 |
|
|
| 361 |
|
|
| 362 |
Default value: `9100` |
|
| 363 |
|
|
| 159 | 364 |
### `nftables::rules::ospf` |
| 160 | 365 |
|
| 161 | 366 |
manage in ospf |
| ... | ... | |
| 176 | 381 |
|
| 177 | 382 |
manage out dhcp |
| 178 | 383 |
|
| 384 |
### `nftables::rules::out::dhcpv6_client` |
|
| 385 |
|
|
| 386 |
The nftables::rules::out::dhcpv6_client class. |
|
| 387 |
|
|
| 179 | 388 |
### `nftables::rules::out::dns` |
| 180 | 389 |
|
| 181 | 390 |
manage out dns |
| ... | ... | |
| 200 | 409 |
|
| 201 | 410 |
manage out https |
| 202 | 411 |
|
| 412 |
### `nftables::rules::out::icmp` |
|
| 413 |
|
|
| 414 |
The nftables::rules::out::icmp class. |
|
| 415 |
|
|
| 416 |
#### Parameters |
|
| 417 |
|
|
| 418 |
The following parameters are available in the `nftables::rules::out::icmp` class. |
|
| 419 |
|
|
| 420 |
##### `v4_types` |
|
| 421 |
|
|
| 422 |
Data type: `Optional[Array[String]]` |
|
| 423 |
|
|
| 424 |
|
|
| 425 |
|
|
| 426 |
Default value: ``undef`` |
|
| 427 |
|
|
| 428 |
##### `v6_types` |
|
| 429 |
|
|
| 430 |
Data type: `Optional[Array[String]]` |
|
| 431 |
|
|
| 432 |
|
|
| 433 |
|
|
| 434 |
Default value: ``undef`` |
|
| 435 |
|
|
| 436 |
##### `order` |
|
| 437 |
|
|
| 438 |
Data type: `String` |
|
| 439 |
|
|
| 440 |
|
|
| 441 |
|
|
| 442 |
Default value: `'10'` |
|
| 443 |
|
|
| 444 |
### `nftables::rules::out::kerberos` |
|
| 445 |
|
|
| 446 |
allows outbound access for kerberos |
|
| 447 |
|
|
| 203 | 448 |
### `nftables::rules::out::mysql` |
| 204 | 449 |
|
| 205 | 450 |
manage out mysql |
| 206 | 451 |
|
| 452 |
### `nftables::rules::out::openafs_client` |
|
| 453 |
|
|
| 454 |
7000 - afs3-fileserver |
|
| 455 |
7002 - afs3-ptserver |
|
| 456 |
7003 - vlserver |
|
| 457 |
|
|
| 458 |
* **See also** |
|
| 459 |
* https://wiki.openafs.org/devel/AFSServicePorts/ |
|
| 460 |
* AFS Service Ports |
|
| 461 |
|
|
| 462 |
#### Parameters |
|
| 463 |
|
|
| 464 |
The following parameters are available in the `nftables::rules::out::openafs_client` class. |
|
| 465 |
|
|
| 466 |
##### `ports` |
|
| 467 |
|
|
| 468 |
Data type: `Array[Integer,1]` |
|
| 469 |
|
|
| 470 |
|
|
| 471 |
|
|
| 472 |
Default value: `[7000, 7002, 7003]` |
|
| 473 |
|
|
| 207 | 474 |
### `nftables::rules::out::ospf` |
| 208 | 475 |
|
| 209 | 476 |
manage out ospf |
| ... | ... | |
| 346 | 613 |
|
| 347 | 614 |
Default value: `[51820]` |
| 348 | 615 |
|
| 616 |
### `nftables::services::dhcpv6_client` |
|
| 617 |
|
|
| 618 |
The nftables::services::dhcpv6_client class. |
|
| 619 |
|
|
| 620 |
### `nftables::services::openafs_client` |
|
| 621 |
|
|
| 622 |
The nftables::services::openafs_client class. |
|
| 623 |
|
|
| 349 | 624 |
## Defined types |
| 350 | 625 |
|
| 351 | 626 |
### `nftables::chain` |
| ... | ... | |
| 712 | 987 |
|
| 713 | 988 |
Default value: `'present'` |
| 714 | 989 |
|
| 990 |
### `nftables::set` |
|
| 991 |
|
|
| 992 |
manage a named set |
|
| 993 |
|
|
| 994 |
#### Parameters |
|
| 995 |
|
|
| 996 |
The following parameters are available in the `nftables::set` defined type. |
|
| 997 |
|
|
| 998 |
##### `ensure` |
|
| 999 |
|
|
| 1000 |
Data type: `Enum['present','absent']` |
|
| 1001 |
|
|
| 1002 |
|
|
| 1003 |
|
|
| 1004 |
Default value: `'present'` |
|
| 1005 |
|
|
| 1006 |
##### `setname` |
|
| 1007 |
|
|
| 1008 |
Data type: `Pattern[/^[-a-zA-Z0-9_]+$/]` |
|
| 1009 |
|
|
| 1010 |
|
|
| 1011 |
|
|
| 1012 |
Default value: `$title` |
|
| 1013 |
|
|
| 1014 |
##### `order` |
|
| 1015 |
|
|
| 1016 |
Data type: `Pattern[/^\d\d$/]` |
|
| 1017 |
|
|
| 1018 |
|
|
| 1019 |
|
|
| 1020 |
Default value: `'10'` |
|
| 1021 |
|
|
| 1022 |
##### `type` |
|
| 1023 |
|
|
| 1024 |
Data type: `Optional[Enum['ipv4_addr', 'ipv6_addr', 'ether_addr', 'inet_proto', 'inet_service', 'mark']]` |
|
| 1025 |
|
|
| 1026 |
|
|
| 1027 |
|
|
| 1028 |
Default value: ``undef`` |
|
| 1029 |
|
|
| 1030 |
##### `table` |
|
| 1031 |
|
|
| 1032 |
Data type: `String` |
|
| 1033 |
|
|
| 1034 |
|
|
| 1035 |
|
|
| 1036 |
Default value: `'inet-filter'` |
|
| 1037 |
|
|
| 1038 |
##### `flags` |
|
| 1039 |
|
|
| 1040 |
Data type: `Array[Enum['constant', 'dynamic', 'interval', 'timeout'], 0, 4]` |
|
| 1041 |
|
|
| 1042 |
|
|
| 1043 |
|
|
| 1044 |
Default value: `[]` |
|
| 1045 |
|
|
| 1046 |
##### `timeout` |
|
| 1047 |
|
|
| 1048 |
Data type: `Optional[Integer]` |
|
| 1049 |
|
|
| 1050 |
|
|
| 1051 |
|
|
| 1052 |
Default value: ``undef`` |
|
| 1053 |
|
|
| 1054 |
##### `gc_interval` |
|
| 1055 |
|
|
| 1056 |
Data type: `Optional[Integer]` |
|
| 1057 |
|
|
| 1058 |
|
|
| 1059 |
|
|
| 1060 |
Default value: ``undef`` |
|
| 1061 |
|
|
| 1062 |
##### `elements` |
|
| 1063 |
|
|
| 1064 |
Data type: `Optional[Array[String]]` |
|
| 1065 |
|
|
| 1066 |
|
|
| 1067 |
|
|
| 1068 |
Default value: ``undef`` |
|
| 1069 |
|
|
| 1070 |
##### `size` |
|
| 1071 |
|
|
| 1072 |
Data type: `Optional[Integer]` |
|
| 1073 |
|
|
| 1074 |
|
|
| 1075 |
|
|
| 1076 |
Default value: ``undef`` |
|
| 1077 |
|
|
| 1078 |
##### `policy` |
|
| 1079 |
|
|
| 1080 |
Data type: `Optional[Enum['performance', 'memory']]` |
|
| 1081 |
|
|
| 1082 |
|
|
| 1083 |
|
|
| 1084 |
Default value: ``undef`` |
|
| 1085 |
|
|
| 1086 |
##### `auto_merge` |
|
| 1087 |
|
|
| 1088 |
Data type: `Boolean` |
|
| 1089 |
|
|
| 1090 |
|
|
| 1091 |
|
|
| 1092 |
Default value: ``false`` |
|
| 1093 |
|
|
| 1094 |
##### `content` |
|
| 1095 |
|
|
| 1096 |
Data type: `Optional[String]` |
|
| 1097 |
|
|
| 1098 |
|
|
| 1099 |
|
|
| 1100 |
Default value: ``undef`` |
|
| 1101 |
|
|
| 1102 |
##### `source` |
|
| 1103 |
|
|
| 1104 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
|
| 1105 |
|
|
| 1106 |
|
|
| 1107 |
|
|
| 1108 |
Default value: ``undef`` |
|
| 1109 |
|
|
Formats disponibles : Unified diff