Projet

Général

Profil

Révision b9785000

IDb9785000a83fb7db180cf096a883a706386d0bf3
Parent 03d8e696
Enfant 354a3ea5

Ajouté par Steve Traylen il y a plus de 4 ans

Correct layout of ignore chain example

Voir les différences:

REFERENCE.md
11 11 
* [`nftables::inet_filter`](#nftablesinet_filter): manage basic chains in table inet filter
12 12 
* [`nftables::ip_nat`](#nftablesip_nat): manage basic chains in table ip nat
13 13 
* [`nftables::rules::afs3_callback`](#nftablesrulesafs3_callback): Open call back port for AFS clients
14 
* [`nftables::rules::ceph`](#nftablesrulesceph): Ceph is a distributed object store and file system. Enable this to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS)
15 
* [`nftables::rules::ceph_mon`](#nftablesrulesceph_mon): Ceph is a distributed object store and file system. Enable this option to support Ceph's Monitor Daemon.
14 16 
* [`nftables::rules::dhcpv6_client`](#nftablesrulesdhcpv6_client)
15 17 
* [`nftables::rules::dns`](#nftablesrulesdns): manage in dns
16 18 
* [`nftables::rules::http`](#nftablesruleshttp): manage in http
17 19 
* [`nftables::rules::https`](#nftablesruleshttps): manage in https
18 20 
* [`nftables::rules::icinga2`](#nftablesrulesicinga2): manage in icinga2
19 21 
* [`nftables::rules::icmp`](#nftablesrulesicmp)
22 
* [`nftables::rules::nfs`](#nftablesrulesnfs): manage in nfs4
23 
* [`nftables::rules::nfs3`](#nftablesrulesnfs3): manage in nfs3
20 24 
* [`nftables::rules::node_exporter`](#nftablesrulesnode_exporter): manage in node exporter
21 25 
* [`nftables::rules::ospf`](#nftablesrulesospf): manage in ospf
22 26 
* [`nftables::rules::ospf3`](#nftablesrulesospf3): manage in ospf3
23 27 
* [`nftables::rules::out::all`](#nftablesrulesoutall): allow all outbound
28 
* [`nftables::rules::out::ceph_client`](#nftablesrulesoutceph_client): Ceph is a distributed object store and file system. Enable this to be a client of Ceph's Monitor (MON), Object Storage Daemons (OSD), Metadat
24 29 
* [`nftables::rules::out::chrony`](#nftablesrulesoutchrony): manage out chrony
25 30 
* [`nftables::rules::out::dhcp`](#nftablesrulesoutdhcp): manage out dhcp
26 31 
* [`nftables::rules::out::dhcpv6_client`](#nftablesrulesoutdhcpv6_client)
......
30 35 
* [`nftables::rules::out::icmp`](#nftablesrulesouticmp)
31 36 
* [`nftables::rules::out::kerberos`](#nftablesrulesoutkerberos): allows outbound access for kerberos
32 37 
* [`nftables::rules::out::mysql`](#nftablesrulesoutmysql): manage out mysql
38 
* [`nftables::rules::out::nfs`](#nftablesrulesoutnfs): manage out nfs
39 
* [`nftables::rules::out::nfs3`](#nftablesrulesoutnfs3): manage out nfs3
33 40 
* [`nftables::rules::out::openafs_client`](#nftablesrulesoutopenafs_client): allows outbound access for afs clients
34 41 
* [`nftables::rules::out::ospf`](#nftablesrulesoutospf): manage out ospf
35 42 
* [`nftables::rules::out::ospf3`](#nftablesrulesoutospf3): manage out ospf3
......
68 75 

  		




  69
  76
  
    
#### Examples


  		




  70
  77
  
    

  		




  71
  
  
    
##### 


  		




  
  78
  
    
##### allow dns out and do not allow ntp out


  		




  72
  79
  
    

  		




  73
  80
  
    
```puppet


  		




  74
  81
  
    
class{'nftables:


  		




  ......




  77
  84
  
    
}


  		




  78
  85
  
    
```


  		




  79
  86
  
    

  		




  
  87
  
    
##### do not flush particular tables, fail2ban in this case


  		




  
  88
  
    

  		




  
  89
  
    
```puppet


  		




  
  90
  
    
class{'nftables':


  		




  
  91
  
    
  noflush_tables = ['inet-f2b-table'],


  		




  
  92
  
    
}


  		




  
  93
  
    
```


  		




  
  94
  
    

  		




  80
  95
  
    
#### Parameters


  		




  81
  96
  
    

  		




  82
  97
  
    
The following parameters are available in the `nftables` class.


  		




  ......




  153
  168
  
    

  		




  154
  169
  
    
Default value: ``true``


  		




  155
  170
  
    

  		




  
  171
  
    
##### `sets`


  		




  
  172
  
    

  		




  
  173
  
    
Data type: `Hash`


  		




  
  174
  
    

  		




  
  175
  
    
Allows sourcing set definitions directly from Hiera.


  		




  
  176
  
    

  		




  
  177
  
    
Default value: `{}`


  		




  
  178
  
    

  		




  156
  179
  
    
##### `log_prefix`


  		




  157
  180
  
    

  		




  158
  181
  
    
Data type: `String`


  		




  ......




  164
  187
  
    

  		




  165
  188
  
    
Default value: `'[nftables] %<chain>s %<comment>s'`


  		




  166
  189
  
    

  		




  
  190
  
    
##### `log_limit`


  		




  
  191
  
    

  		




  
  192
  
    
Data type: `Variant[Boolean[false], String]`


  		




  
  193
  
    

  		




  
  194
  
    
String with the content of a limit statement to be applied


  		




  
  195
  
    
to the rules that log discarded traffic. Set to false to


  		




  
  196
  
    
disable rate limiting.


  		




  
  197
  
    

  		




  
  198
  
    
Default value: `'3/minute burst 5 packets'`


  		




  
  199
  
    

  		




  167
  200
  
    
##### `reject_with`


  		




  168
  201
  
    

  		




  169
  
  
    
Data type: `Variant[Boolean[false], Pattern[


  		




  170
  
  
    
    /icmp(v6|x)? type .+|tcp reset/]]`


  		




  
  202
  
    
Data type: `Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]]`


  		




  171
  203
  
    

  		




  172
  204
  
    
How to discard packets not matching any rule. If `false`, the


  		




  173
  205
  
    
fate of the packet will be defined by the chain policy (normally


  		




  ......




  185
  217
  
    

  		




  186
  218
  
    
Default value: ``true``


  		




  187
  219
  
    

  		




  
  220
  
    
##### `fwd_conntrack`


  		




  
  221
  
    

  		




  
  222
  
    
Data type: `Boolean`


  		




  
  223
  
    

  		




  
  224
  
    
Adds FORWARD rules to allow traffic that's part of an


  		




  
  225
  
    
established connection and also to drop invalid packets.


  		




  
  226
  
    

  		




  
  227
  
    
Default value: ``false``


  		




  
  228
  
    

  		




  188
  229
  
    
##### `firewalld_enable`


  		




  189
  230
  
    

  		




  190
  231
  
    
Data type: `Variant[Boolean[false], Enum['mask']]`


  		




  ......




  195
  236
  
    

  		




  196
  237
  
    
Default value: `'mask'`


  		




  197
  238
  
    

  		




  
  239
  
    
##### `noflush_tables`


  		




  
  240
  
    

  		




  
  241
  
    
Data type: `Optional[Array[Pattern[/^(ip|ip6|inet)-[-a-zA-Z0-9_]+$/],1]]`


  		




  
  242
  
    

  		




  
  243
  
    
If specified only other existings tables will be flushed.


  		




  
  244
  
    
If left unset all tables will be flushed via a `flush ruleset`


  		




  
  245
  
    

  		




  
  246
  
    
Default value: ``undef``


  		




  
  247
  
    

  		




  198
  248
  
    
##### `out_dns`


  		




  199
  249
  
    

  		




  200
  250
  
    
Data type: `Boolean`


  		




  ......




  261
  311
  
    

  		




  262
  312
  
    
Default value: `['0.0.0.0/0']`


  		




  263
  313
  
    

  		




  
  314
  
    
### `nftables::rules::ceph`


  		




  
  315
  
    

  		




  
  316
  
    
Ceph is a distributed object store and file system.


  		




  
  317
  
    
Enable this to support Ceph's Object Storage Daemons (OSD),


  		




  
  318
  
    
Metadata Server Daemons (MDS), or Manager Daemons (MGR).


  		




  
  319
  
    

  		




  
  320
  
    
### `nftables::rules::ceph_mon`


  		




  
  321
  
    

  		




  
  322
  
    
Ceph is a distributed object store and file system.


  		




  
  323
  
    
Enable this option to support Ceph's Monitor Daemon.


  		




  
  324
  
    

  		




  
  325
  
    
#### Parameters


  		




  
  326
  
    

  		




  
  327
  
    
The following parameters are available in the `nftables::rules::ceph_mon` class.


  		




  
  328
  
    

  		




  
  329
  
    
##### `ports`


  		




  
  330
  
    

  		




  
  331
  
    
Data type: `Array[Integer,1]`


  		




  
  332
  
    

  		




  
  333
  
    

  		




  
  334
  
    

  		




  
  335
  
    
Default value: `[3300, 6789]`


  		




  
  336
  
    

  		




  264
  337
  
    
### `nftables::rules::dhcpv6_client`


  		




  265
  338
  
    

  		




  266
  339
  
    
The nftables::rules::dhcpv6_client class.


  		




  ......




  337
  410
  
    

  		




  338
  411
  
    
Default value: `'10'`


  		




  339
  412
  
    

  		




  
  413
  
    
### `nftables::rules::nfs`


  		




  
  414
  
    

  		




  
  415
  
    
manage in nfs4


  		




  
  416
  
    

  		




  
  417
  
    
### `nftables::rules::nfs3`


  		




  
  418
  
    

  		




  
  419
  
    
manage in nfs3


  		




  
  420
  
    

  		




  340
  421
  
    
### `nftables::rules::node_exporter`


  		




  341
  422
  
    

  		




  342
  423
  
    
manage in node exporter


  		




  ......




  373
  454
  
    

  		




  374
  455
  
    
allow all outbound


  		




  375
  456
  
    

  		




  
  457
  
    
### `nftables::rules::out::ceph_client`


  		




  
  458
  
    

  		




  
  459
  
    
Ceph is a distributed object store and file system.


  		




  
  460
  
    
Enable this to be a client of Ceph's Monitor (MON),


  		




  
  461
  
    
Object Storage Daemons (OSD), Metadata Server Daemons (MDS),


  		




  
  462
  
    
and Manager Daemons (MGR).


  		




  
  463
  
    

  		




  
  464
  
    
#### Parameters


  		




  
  465
  
    

  		




  
  466
  
    
The following parameters are available in the `nftables::rules::out::ceph_client` class.


  		




  
  467
  
    

  		




  
  468
  
    
##### `ports`


  		




  
  469
  
    

  		




  
  470
  
    
Data type: `Array[Integer,1]`


  		




  
  471
  
    

  		




  
  472
  
    

  		




  
  473
  
    

  		




  
  474
  
    
Default value: `[3300, 6789]`


  		




  
  475
  
    

  		




  376
  476
  
    
### `nftables::rules::out::chrony`


  		




  377
  477
  
    

  		




  378
  478
  
    
manage out chrony


  		




  ......




  449
  549
  
    

  		




  450
  550
  
    
manage out mysql


  		




  451
  551
  
    

  		




  
  552
  
    
### `nftables::rules::out::nfs`


  		




  
  553
  
    

  		




  
  554
  
    
manage out nfs


  		




  
  555
  
    

  		




  
  556
  
    
### `nftables::rules::out::nfs3`


  		




  
  557
  
    

  		




  
  558
  
    
manage out nfs3


  		




  
  559
  
    

  		




  452
  560
  
    
### `nftables::rules::out::openafs_client`


  		




  453
  561
  
    

  		




  454
  562
  
    
7000 - afs3-fileserver


  		












Formats disponibles :  Unified diff