root / manifests / init.pp @ be0b08e1
Historique | Voir | Annoter | Télécharger (1,35 ko)
| 1 | 0ba57c66 | mh | # manage nftables |
|---|---|---|---|
| 2 | be0b08e1 | tr | class nftables ( |
| 3 | Boolean $in_ssh = true, |
||
| 4 | Boolean $out_ntp = true, |
||
| 5 | Boolean $out_dns = true, |
||
| 6 | Boolean $out_https = true, |
||
| 7 | ) {
|
||
| 8 | |||
| 9 | 0ba57c66 | mh | package{'nftables':
|
| 10 | ensure => installed, |
||
| 11 | } -> file_line{
|
||
| 12 | 'enable_nftables': |
||
| 13 | line => 'include "/etc/nftables/puppet.nft"', |
||
| 14 | path => '/etc/sysconfig/nftables.conf', |
||
| 15 | notify => Service['nftables'], |
||
| 16 | } -> file{
|
||
| 17 | default: |
||
| 18 | owner => 'root', |
||
| 19 | group => 'root', |
||
| 20 | mode => '0640'; |
||
| 21 | '/etc/nftables/puppet.nft': |
||
| 22 | source => 'puppet:///modules/nftables/config/puppet.nft'; |
||
| 23 | '/etc/nftables/puppet': |
||
| 24 | ensure => directory, |
||
| 25 | purge => true, |
||
| 26 | force => true, |
||
| 27 | recurse => true; |
||
| 28 | } ~> service{'nftables':
|
||
| 29 | ensure => running, |
||
| 30 | enable => true, |
||
| 31 | } |
||
| 32 | |||
| 33 | nftables::config{
|
||
| 34 | 'filter': |
||
| 35 | source => 'puppet:///modules/nftables/config/puppet-filter.nft'; |
||
| 36 | 'nat': |
||
| 37 | source => 'puppet:///modules/nftables/config/puppet-nat.nft'; |
||
| 38 | } |
||
| 39 | |||
| 40 | nftables::filter::chain{
|
||
| 41 | [ |
||
| 42 | 'forward-default_fwd', |
||
| 43 | 'output-default_out', |
||
| 44 | 'input-default_in', |
||
| 45 | ]:; |
||
| 46 | } |
||
| 47 | be0b08e1 | tr | |
| 48 | # basic ingoing rules |
||
| 49 | if $in_ssh {
|
||
| 50 | include nftables::rules::ssh |
||
| 51 | } |
||
| 52 | |||
| 53 | 0ba57c66 | mh | # basic outgoing rules |
| 54 | be0b08e1 | tr | if $out_ntp {
|
| 55 | include nftables::rules::out::ntp |
||
| 56 | } |
||
| 57 | if $out_dns {
|
||
| 58 | include nftables::rules::out::dns |
||
| 59 | } |
||
| 60 | if $out_https {
|
||
| 61 | include nftables::rules::out::https |
||
| 62 | 0ba57c66 | mh | } |
| 63 | } |