Révision c24d3118
Regenerate REFERENCE.md
| REFERENCE.md | ||
|---|---|---|
| 7 | 7 |
### Classes |
| 8 | 8 |
|
| 9 | 9 |
* [`nftables`](#nftables): Configure nftables |
| 10 |
* [`nftables::bridges`](#nftablesbridges): allow forwarding traffic on bridges |
|
| 11 |
* [`nftables::inet_filter`](#nftablesinet_filter): manage basic chains in table inet filter |
|
| 12 |
* [`nftables::inet_filter::fwd_conntrack`](#nftablesinet_filterfwd_conntrack): enable conntrack for fwd
|
|
| 13 |
* [`nftables::inet_filter::in_out_conntrack`](#nftablesinet_filterin_out_conntrack): manage input & output conntrack
|
|
| 14 |
* [`nftables::ip_nat`](#nftablesip_nat): manage basic chains in table ip nat |
|
| 15 |
* [`nftables::rules::activemq`](#nftablesrulesactivemq): Provides input rules for Apache ActiveMQ
|
|
| 16 |
* [`nftables::rules::afs3_callback`](#nftablesrulesafs3_callback): Open call back port for AFS clients
|
|
| 17 |
* [`nftables::rules::ceph`](#nftablesrulesceph): Ceph is a distributed object store and file system. Enable this to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS)
|
|
| 18 |
* [`nftables::rules::ceph_mon`](#nftablesrulesceph_mon): Ceph is a distributed object store and file system.
|
|
| 10 |
* [`nftables::bridges`](#nftables--bridges): allow forwarding traffic on bridges
|
|
| 11 |
* [`nftables::inet_filter`](#nftables--inet_filter): manage basic chains in table inet filter
|
|
| 12 |
* [`nftables::inet_filter::fwd_conntrack`](#nftables--inet_filter--fwd_conntrack): enable conntrack for fwd
|
|
| 13 |
* [`nftables::inet_filter::in_out_conntrack`](#nftables--inet_filter--in_out_conntrack): manage input & output conntrack
|
|
| 14 |
* [`nftables::ip_nat`](#nftables--ip_nat): manage basic chains in table ip nat
|
|
| 15 |
* [`nftables::rules::activemq`](#nftables--rules--activemq): Provides input rules for Apache ActiveMQ
|
|
| 16 |
* [`nftables::rules::afs3_callback`](#nftables--rules--afs3_callback): Open call back port for AFS clients
|
|
| 17 |
* [`nftables::rules::ceph`](#nftables--rules--ceph): Ceph is a distributed object store and file system. Enable this to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS)
|
|
| 18 |
* [`nftables::rules::ceph_mon`](#nftables--rules--ceph_mon): Ceph is a distributed object store and file system.
|
|
| 19 | 19 |
Enable this option to support Ceph's Monitor Daemon. |
| 20 |
* [`nftables::rules::dhcpv6_client`](#nftablesrulesdhcpv6_client): allow DHCPv6 requests in to a host
|
|
| 21 |
* [`nftables::rules::dns`](#nftablesrulesdns): manage in dns
|
|
| 22 |
* [`nftables::rules::docker_ce`](#nftablesrulesdocker_ce): Default firewall configuration for Docker-CE
|
|
| 23 |
* [`nftables::rules::http`](#nftablesruleshttp): manage in http
|
|
| 24 |
* [`nftables::rules::https`](#nftablesruleshttps): manage in https
|
|
| 25 |
* [`nftables::rules::icinga2`](#nftablesrulesicinga2): manage in icinga2
|
|
| 26 |
* [`nftables::rules::icmp`](#nftablesrulesicmp)
|
|
| 27 |
* [`nftables::rules::nfs`](#nftablesrulesnfs): manage in nfs4
|
|
| 28 |
* [`nftables::rules::nfs3`](#nftablesrulesnfs3): manage in nfs3
|
|
| 29 |
* [`nftables::rules::node_exporter`](#nftablesrulesnode_exporter): manage in node exporter
|
|
| 30 |
* [`nftables::rules::ospf`](#nftablesrulesospf): manage in ospf
|
|
| 31 |
* [`nftables::rules::ospf3`](#nftablesrulesospf3): manage in ospf3
|
|
| 32 |
* [`nftables::rules::out::all`](#nftablesrulesoutall): allow all outbound
|
|
| 33 |
* [`nftables::rules::out::ceph_client`](#nftablesrulesoutceph_client): Ceph is a distributed object store and file system.
|
|
| 20 |
* [`nftables::rules::dhcpv6_client`](#nftables--rules--dhcpv6_client): allow DHCPv6 requests in to a host
|
|
| 21 |
* [`nftables::rules::dns`](#nftables--rules--dns): manage in dns
|
|
| 22 |
* [`nftables::rules::docker_ce`](#nftables--rules--docker_ce): Default firewall configuration for Docker-CE
|
|
| 23 |
* [`nftables::rules::http`](#nftables--rules--http): manage in http
|
|
| 24 |
* [`nftables::rules::https`](#nftables--rules--https): manage in https
|
|
| 25 |
* [`nftables::rules::icinga2`](#nftables--rules--icinga2): manage in icinga2
|
|
| 26 |
* [`nftables::rules::icmp`](#nftables--rules--icmp)
|
|
| 27 |
* [`nftables::rules::nfs`](#nftables--rules--nfs): manage in nfs4
|
|
| 28 |
* [`nftables::rules::nfs3`](#nftables--rules--nfs3): manage in nfs3
|
|
| 29 |
* [`nftables::rules::node_exporter`](#nftables--rules--node_exporter): manage in node exporter
|
|
| 30 |
* [`nftables::rules::ospf`](#nftables--rules--ospf): manage in ospf
|
|
| 31 |
* [`nftables::rules::ospf3`](#nftables--rules--ospf3): manage in ospf3
|
|
| 32 |
* [`nftables::rules::out::all`](#nftables--rules--out--all): allow all outbound
|
|
| 33 |
* [`nftables::rules::out::ceph_client`](#nftables--rules--out--ceph_client): Ceph is a distributed object store and file system.
|
|
| 34 | 34 |
Enable this to be a client of Ceph's Monitor (MON), |
| 35 | 35 |
Object Storage Daemons (OSD), Metadata Server Daemons (MDS), |
| 36 | 36 |
and Manager Daemons (MGR). |
| 37 |
* [`nftables::rules::out::chrony`](#nftablesrulesoutchrony): manage out chrony
|
|
| 38 |
* [`nftables::rules::out::dhcp`](#nftablesrulesoutdhcp): manage out dhcp
|
|
| 39 |
* [`nftables::rules::out::dhcpv6_client`](#nftablesrulesoutdhcpv6_client): Allow DHCPv6 requests out of a host
|
|
| 40 |
* [`nftables::rules::out::dns`](#nftablesrulesoutdns): manage out dns
|
|
| 41 |
* [`nftables::rules::out::hkp`](#nftablesrulesouthkp): allow outgoing hkp connections to gpg keyservers
|
|
| 42 |
* [`nftables::rules::out::http`](#nftablesrulesouthttp): manage out http
|
|
| 43 |
* [`nftables::rules::out::https`](#nftablesrulesouthttps): manage out https
|
|
| 44 |
* [`nftables::rules::out::icmp`](#nftablesrulesouticmp): control outbound icmp packages
|
|
| 45 |
* [`nftables::rules::out::imap`](#nftablesrulesoutimap): allow outgoing imap
|
|
| 46 |
* [`nftables::rules::out::kerberos`](#nftablesrulesoutkerberos): allows outbound access for kerberos
|
|
| 47 |
* [`nftables::rules::out::mysql`](#nftablesrulesoutmysql): manage out mysql
|
|
| 48 |
* [`nftables::rules::out::nfs`](#nftablesrulesoutnfs): manage out nfs
|
|
| 49 |
* [`nftables::rules::out::nfs3`](#nftablesrulesoutnfs3): manage out nfs3
|
|
| 50 |
* [`nftables::rules::out::openafs_client`](#nftablesrulesoutopenafs_client): allows outbound access for afs clients
|
|
| 37 |
* [`nftables::rules::out::chrony`](#nftables--rules--out--chrony): manage out chrony
|
|
| 38 |
* [`nftables::rules::out::dhcp`](#nftables--rules--out--dhcp): manage out dhcp
|
|
| 39 |
* [`nftables::rules::out::dhcpv6_client`](#nftables--rules--out--dhcpv6_client): Allow DHCPv6 requests out of a host
|
|
| 40 |
* [`nftables::rules::out::dns`](#nftables--rules--out--dns): manage out dns
|
|
| 41 |
* [`nftables::rules::out::hkp`](#nftables--rules--out--hkp): allow outgoing hkp connections to gpg keyservers
|
|
| 42 |
* [`nftables::rules::out::http`](#nftables--rules--out--http): manage out http
|
|
| 43 |
* [`nftables::rules::out::https`](#nftables--rules--out--https): manage out https
|
|
| 44 |
* [`nftables::rules::out::icmp`](#nftables--rules--out--icmp): control outbound icmp packages
|
|
| 45 |
* [`nftables::rules::out::imap`](#nftables--rules--out--imap): allow outgoing imap
|
|
| 46 |
* [`nftables::rules::out::kerberos`](#nftables--rules--out--kerberos): allows outbound access for kerberos
|
|
| 47 |
* [`nftables::rules::out::mysql`](#nftables--rules--out--mysql): manage out mysql
|
|
| 48 |
* [`nftables::rules::out::nfs`](#nftables--rules--out--nfs): manage out nfs
|
|
| 49 |
* [`nftables::rules::out::nfs3`](#nftables--rules--out--nfs3): manage out nfs3
|
|
| 50 |
* [`nftables::rules::out::openafs_client`](#nftables--rules--out--openafs_client): allows outbound access for afs clients
|
|
| 51 | 51 |
7000 - afs3-fileserver |
| 52 | 52 |
7002 - afs3-ptserver |
| 53 | 53 |
7003 - vlserver |
| 54 |
* [`nftables::rules::out::ospf`](#nftablesrulesoutospf): manage out ospf
|
|
| 55 |
* [`nftables::rules::out::ospf3`](#nftablesrulesoutospf3): manage out ospf3
|
|
| 56 |
* [`nftables::rules::out::pop3`](#nftablesrulesoutpop3): allow outgoing pop3
|
|
| 57 |
* [`nftables::rules::out::postgres`](#nftablesrulesoutpostgres): manage out postgres
|
|
| 58 |
* [`nftables::rules::out::puppet`](#nftablesrulesoutpuppet): manage outgoing puppet
|
|
| 59 |
* [`nftables::rules::out::pxp_agent`](#nftablesrulesoutpxp_agent): manage outgoing pxp-agent
|
|
| 60 |
* [`nftables::rules::out::smtp`](#nftablesrulesoutsmtp): allow outgoing smtp
|
|
| 61 |
* [`nftables::rules::out::smtp_client`](#nftablesrulesoutsmtp_client): allow outgoing smtp client
|
|
| 62 |
* [`nftables::rules::out::ssh`](#nftablesrulesoutssh): manage out ssh
|
|
| 63 |
* [`nftables::rules::out::ssh::remove`](#nftablesrulesoutsshremove): disable outgoing ssh
|
|
| 64 |
* [`nftables::rules::out::tor`](#nftablesrulesouttor): manage out tor
|
|
| 65 |
* [`nftables::rules::out::whois`](#nftablesrulesoutwhois): allow clients to query remote whois server
|
|
| 66 |
* [`nftables::rules::out::wireguard`](#nftablesrulesoutwireguard): manage out wireguard
|
|
| 67 |
* [`nftables::rules::puppet`](#nftablesrulespuppet): manage in puppet
|
|
| 68 |
* [`nftables::rules::pxp_agent`](#nftablesrulespxp_agent): manage in pxp-agent
|
|
| 69 |
* [`nftables::rules::qemu`](#nftablesrulesqemu): Bridged network configuration for qemu/libvirt
|
|
| 70 |
* [`nftables::rules::samba`](#nftablesrulessamba): manage Samba, the suite to allow Windows file sharing on Linux resources.
|
|
| 71 |
* [`nftables::rules::smtp`](#nftablesrulessmtp): manage in smtp
|
|
| 72 |
* [`nftables::rules::smtp_submission`](#nftablesrulessmtp_submission): manage in smtp submission
|
|
| 73 |
* [`nftables::rules::smtps`](#nftablesrulessmtps): manage in smtps
|
|
| 74 |
* [`nftables::rules::ssh`](#nftablesrulesssh): manage in ssh
|
|
| 75 |
* [`nftables::rules::tor`](#nftablesrulestor): manage in tor
|
|
| 76 |
* [`nftables::rules::wireguard`](#nftablesruleswireguard): manage in wireguard
|
|
| 77 |
* [`nftables::services::dhcpv6_client`](#nftablesservicesdhcpv6_client): Allow in and outbound traffic for DHCPv6 server
|
|
| 78 |
* [`nftables::services::openafs_client`](#nftablesservicesopenafs_client): Open inbound and outbound ports for an AFS client
|
|
| 54 |
* [`nftables::rules::out::ospf`](#nftables--rules--out--ospf): manage out ospf
|
|
| 55 |
* [`nftables::rules::out::ospf3`](#nftables--rules--out--ospf3): manage out ospf3
|
|
| 56 |
* [`nftables::rules::out::pop3`](#nftables--rules--out--pop3): allow outgoing pop3
|
|
| 57 |
* [`nftables::rules::out::postgres`](#nftables--rules--out--postgres): manage out postgres
|
|
| 58 |
* [`nftables::rules::out::puppet`](#nftables--rules--out--puppet): manage outgoing puppet
|
|
| 59 |
* [`nftables::rules::out::pxp_agent`](#nftables--rules--out--pxp_agent): manage outgoing pxp-agent
|
|
| 60 |
* [`nftables::rules::out::smtp`](#nftables--rules--out--smtp): allow outgoing smtp
|
|
| 61 |
* [`nftables::rules::out::smtp_client`](#nftables--rules--out--smtp_client): allow outgoing smtp client
|
|
| 62 |
* [`nftables::rules::out::ssh`](#nftables--rules--out--ssh): manage out ssh
|
|
| 63 |
* [`nftables::rules::out::ssh::remove`](#nftables--rules--out--ssh--remove): disable outgoing ssh
|
|
| 64 |
* [`nftables::rules::out::tor`](#nftables--rules--out--tor): manage out tor
|
|
| 65 |
* [`nftables::rules::out::whois`](#nftables--rules--out--whois): allow clients to query remote whois server
|
|
| 66 |
* [`nftables::rules::out::wireguard`](#nftables--rules--out--wireguard): manage out wireguard
|
|
| 67 |
* [`nftables::rules::puppet`](#nftables--rules--puppet): manage in puppet
|
|
| 68 |
* [`nftables::rules::pxp_agent`](#nftables--rules--pxp_agent): manage in pxp-agent
|
|
| 69 |
* [`nftables::rules::qemu`](#nftables--rules--qemu): Bridged network configuration for qemu/libvirt
|
|
| 70 |
* [`nftables::rules::samba`](#nftables--rules--samba): manage Samba, the suite to allow Windows file sharing on Linux resources.
|
|
| 71 |
* [`nftables::rules::smtp`](#nftables--rules--smtp): manage in smtp
|
|
| 72 |
* [`nftables::rules::smtp_submission`](#nftables--rules--smtp_submission): manage in smtp submission
|
|
| 73 |
* [`nftables::rules::smtps`](#nftables--rules--smtps): manage in smtps
|
|
| 74 |
* [`nftables::rules::ssh`](#nftables--rules--ssh): manage in ssh
|
|
| 75 |
* [`nftables::rules::tor`](#nftables--rules--tor): manage in tor
|
|
| 76 |
* [`nftables::rules::wireguard`](#nftables--rules--wireguard): manage in wireguard
|
|
| 77 |
* [`nftables::services::dhcpv6_client`](#nftables--services--dhcpv6_client): Allow in and outbound traffic for DHCPv6 server
|
|
| 78 |
* [`nftables::services::openafs_client`](#nftables--services--openafs_client): Open inbound and outbound ports for an AFS client
|
|
| 79 | 79 |
|
| 80 | 80 |
### Defined types |
| 81 | 81 |
|
| 82 |
* [`nftables::chain`](#nftableschain): manage a chain |
|
| 83 |
* [`nftables::config`](#nftablesconfig): manage a config snippet |
|
| 84 |
* [`nftables::file`](#nftablesfile): Insert a file into the nftables configuration |
|
| 85 |
* [`nftables::rule`](#nftablesrule): Provides an interface to create a firewall rule |
|
| 86 |
* [`nftables::rules::dnat4`](#nftablesrulesdnat4): manage a ipv4 dnat rule
|
|
| 87 |
* [`nftables::rules::masquerade`](#nftablesrulesmasquerade): masquerade all outgoing traffic
|
|
| 88 |
* [`nftables::rules::snat4`](#nftablesrulessnat4): manage a ipv4 snat rule
|
|
| 89 |
* [`nftables::set`](#nftablesset): manage a named set |
|
| 90 |
* [`nftables::simplerule`](#nftablessimplerule): Provides a simplified interface to nftables::rule |
|
| 82 |
* [`nftables::chain`](#nftables--chain): manage a chain
|
|
| 83 |
* [`nftables::config`](#nftables--config): manage a config snippet
|
|
| 84 |
* [`nftables::file`](#nftables--file): Insert a file into the nftables configuration
|
|
| 85 |
* [`nftables::rule`](#nftables--rule): Provides an interface to create a firewall rule
|
|
| 86 |
* [`nftables::rules::dnat4`](#nftables--rules--dnat4): manage a ipv4 dnat rule
|
|
| 87 |
* [`nftables::rules::masquerade`](#nftables--rules--masquerade): masquerade all outgoing traffic
|
|
| 88 |
* [`nftables::rules::snat4`](#nftables--rules--snat4): manage a ipv4 snat rule
|
|
| 89 |
* [`nftables::set`](#nftables--set): manage a named set
|
|
| 90 |
* [`nftables::simplerule`](#nftables--simplerule): Provides a simplified interface to nftables::rule
|
|
| 91 | 91 |
|
| 92 | 92 |
### Data types |
| 93 | 93 |
|
| 94 |
* [`Nftables::Addr`](#nftablesaddr): Represents an address expression to be used within a rule.
|
|
| 95 |
* [`Nftables::Addr::Set`](#nftablesaddrset): Represents a set expression to be used within a rule.
|
|
| 96 |
* [`Nftables::Port`](#nftablesport): Represents a port expression to be used within a rule.
|
|
| 97 |
* [`Nftables::Port::Range`](#nftablesportrange): Represents a port range expression to be used within a rule.
|
|
| 98 |
* [`Nftables::RuleName`](#nftablesrulename): Represents a rule name to be used in a raw rule created via nftables::rule.
|
|
| 94 |
* [`Nftables::Addr`](#Nftables--Addr): Represents an address expression to be used within a rule.
|
|
| 95 |
* [`Nftables::Addr::Set`](#Nftables--Addr--Set): Represents a set expression to be used within a rule.
|
|
| 96 |
* [`Nftables::Port`](#Nftables--Port): Represents a port expression to be used within a rule.
|
|
| 97 |
* [`Nftables::Port::Range`](#Nftables--Port--Range): Represents a port range expression to be used within a rule.
|
|
| 98 |
* [`Nftables::RuleName`](#Nftables--RuleName): Represents a rule name to be used in a raw rule created via nftables::rule.
|
|
| 99 | 99 |
It's a dash separated string. The first component describes the chain to |
| 100 | 100 |
add the rule to, the second the rule name and the (optional) third a number. |
| 101 | 101 |
Ex: 'default_in-sshd', 'default_out-my_service-2'. |
| 102 |
* [`Nftables::SimpleRuleName`](#nftablessimplerulename): Represents a simple rule name to be used in a rule created via nftables::simplerule
|
|
| 102 |
* [`Nftables::SimpleRuleName`](#Nftables--SimpleRuleName): Represents a simple rule name to be used in a rule created via nftables::simplerule
|
|
| 103 | 103 |
|
| 104 | 104 |
## Classes |
| 105 | 105 |
|
| ... | ... | |
| 130 | 130 |
|
| 131 | 131 |
The following parameters are available in the `nftables` class: |
| 132 | 132 |
|
| 133 |
* [`out_all`](#out_all) |
|
| 134 |
* [`out_ntp`](#out_ntp) |
|
| 135 |
* [`out_http`](#out_http) |
|
| 136 |
* [`out_dns`](#out_dns) |
|
| 137 |
* [`out_https`](#out_https) |
|
| 138 |
* [`out_icmp`](#out_icmp) |
|
| 139 |
* [`in_ssh`](#in_ssh) |
|
| 140 |
* [`in_icmp`](#in_icmp) |
|
| 141 |
* [`inet_filter`](#inet_filter) |
|
| 142 |
* [`nat`](#nat) |
|
| 143 |
* [`nat_table_name`](#nat_table_name) |
|
| 144 |
* [`sets`](#sets) |
|
| 145 |
* [`log_prefix`](#log_prefix) |
|
| 146 |
* [`log_limit`](#log_limit) |
|
| 147 |
* [`reject_with`](#reject_with) |
|
| 148 |
* [`in_out_conntrack`](#in_out_conntrack) |
|
| 149 |
* [`fwd_conntrack`](#fwd_conntrack) |
|
| 150 |
* [`firewalld_enable`](#firewalld_enable) |
|
| 151 |
* [`noflush_tables`](#noflush_tables) |
|
| 152 |
* [`rules`](#rules) |
|
| 153 |
* [`configuration_path`](#configuration_path) |
|
| 154 |
* [`nft_path`](#nft_path) |
|
| 155 |
* [`echo`](#echo) |
|
| 156 |
* [`default_config_mode`](#default_config_mode) |
|
| 157 |
|
|
| 158 |
##### <a name="out_all"></a>`out_all` |
|
| 133 |
* [`out_all`](#-nftables--out_all)
|
|
| 134 |
* [`out_ntp`](#-nftables--out_ntp)
|
|
| 135 |
* [`out_http`](#-nftables--out_http)
|
|
| 136 |
* [`out_dns`](#-nftables--out_dns)
|
|
| 137 |
* [`out_https`](#-nftables--out_https)
|
|
| 138 |
* [`out_icmp`](#-nftables--out_icmp)
|
|
| 139 |
* [`in_ssh`](#-nftables--in_ssh)
|
|
| 140 |
* [`in_icmp`](#-nftables--in_icmp)
|
|
| 141 |
* [`inet_filter`](#-nftables--inet_filter)
|
|
| 142 |
* [`nat`](#-nftables--nat)
|
|
| 143 |
* [`nat_table_name`](#-nftables--nat_table_name)
|
|
| 144 |
* [`sets`](#-nftables--sets)
|
|
| 145 |
* [`log_prefix`](#-nftables--log_prefix)
|
|
| 146 |
* [`log_limit`](#-nftables--log_limit)
|
|
| 147 |
* [`reject_with`](#-nftables--reject_with)
|
|
| 148 |
* [`in_out_conntrack`](#-nftables--in_out_conntrack)
|
|
| 149 |
* [`fwd_conntrack`](#-nftables--fwd_conntrack)
|
|
| 150 |
* [`firewalld_enable`](#-nftables--firewalld_enable)
|
|
| 151 |
* [`noflush_tables`](#-nftables--noflush_tables)
|
|
| 152 |
* [`rules`](#-nftables--rules)
|
|
| 153 |
* [`configuration_path`](#-nftables--configuration_path)
|
|
| 154 |
* [`nft_path`](#-nftables--nft_path)
|
|
| 155 |
* [`echo`](#-nftables--echo)
|
|
| 156 |
* [`default_config_mode`](#-nftables--default_config_mode)
|
|
| 157 |
|
|
| 158 |
##### <a name="-nftables--out_all"></a>`out_all`
|
|
| 159 | 159 |
|
| 160 | 160 |
Data type: `Boolean` |
| 161 | 161 |
|
| ... | ... | |
| 163 | 163 |
out parameters `out_ntp`, `out_dns`, ... will be assuemed |
| 164 | 164 |
false. |
| 165 | 165 |
|
| 166 |
Default value: ``false``
|
|
| 166 |
Default value: `false`
|
|
| 167 | 167 |
|
| 168 |
##### <a name="out_ntp"></a>`out_ntp` |
|
| 168 |
##### <a name="-nftables--out_ntp"></a>`out_ntp`
|
|
| 169 | 169 |
|
| 170 | 170 |
Data type: `Boolean` |
| 171 | 171 |
|
| 172 | 172 |
Allow outbound to ntp servers. |
| 173 | 173 |
|
| 174 |
Default value: ``true``
|
|
| 174 |
Default value: `true`
|
|
| 175 | 175 |
|
| 176 |
##### <a name="out_http"></a>`out_http` |
|
| 176 |
##### <a name="-nftables--out_http"></a>`out_http`
|
|
| 177 | 177 |
|
| 178 | 178 |
Data type: `Boolean` |
| 179 | 179 |
|
| 180 | 180 |
Allow outbound to http servers. |
| 181 | 181 |
|
| 182 |
Default value: ``true``
|
|
| 182 |
Default value: `true`
|
|
| 183 | 183 |
|
| 184 |
##### <a name="out_dns"></a>`out_dns` |
|
| 184 |
##### <a name="-nftables--out_dns"></a>`out_dns`
|
|
| 185 | 185 |
|
| 186 | 186 |
Data type: `Boolean` |
| 187 | 187 |
|
| 188 | 188 |
Allow outbound to dns servers. |
| 189 | 189 |
|
| 190 |
Default value: ``true``
|
|
| 190 |
Default value: `true`
|
|
| 191 | 191 |
|
| 192 |
##### <a name="out_https"></a>`out_https` |
|
| 192 |
##### <a name="-nftables--out_https"></a>`out_https`
|
|
| 193 | 193 |
|
| 194 | 194 |
Data type: `Boolean` |
| 195 | 195 |
|
| 196 | 196 |
Allow outbound to https servers. |
| 197 | 197 |
|
| 198 |
Default value: ``true``
|
|
| 198 |
Default value: `true`
|
|
| 199 | 199 |
|
| 200 |
##### <a name="out_icmp"></a>`out_icmp` |
|
| 200 |
##### <a name="-nftables--out_icmp"></a>`out_icmp`
|
|
| 201 | 201 |
|
| 202 | 202 |
Data type: `Boolean` |
| 203 | 203 |
|
| 204 | 204 |
Allow outbound ICMPv4/v6 traffic. |
| 205 | 205 |
|
| 206 |
Default value: ``true``
|
|
| 206 |
Default value: `true`
|
|
| 207 | 207 |
|
| 208 |
##### <a name="in_ssh"></a>`in_ssh` |
|
| 208 |
##### <a name="-nftables--in_ssh"></a>`in_ssh`
|
|
| 209 | 209 |
|
| 210 | 210 |
Data type: `Boolean` |
| 211 | 211 |
|
| 212 | 212 |
Allow inbound to ssh servers. |
| 213 | 213 |
|
| 214 |
Default value: ``true``
|
|
| 214 |
Default value: `true`
|
|
| 215 | 215 |
|
| 216 |
##### <a name="in_icmp"></a>`in_icmp` |
|
| 216 |
##### <a name="-nftables--in_icmp"></a>`in_icmp`
|
|
| 217 | 217 |
|
| 218 | 218 |
Data type: `Boolean` |
| 219 | 219 |
|
| 220 | 220 |
Allow inbound ICMPv4/v6 traffic. |
| 221 | 221 |
|
| 222 |
Default value: ``true``
|
|
| 222 |
Default value: `true`
|
|
| 223 | 223 |
|
| 224 |
##### <a name="inet_filter"></a>`inet_filter` |
|
| 224 |
##### <a name="-nftables--inet_filter"></a>`inet_filter`
|
|
| 225 | 225 |
|
| 226 | 226 |
Data type: `Boolean` |
| 227 | 227 |
|
| 228 | 228 |
Add default tables, chains and rules to process traffic. |
| 229 | 229 |
|
| 230 |
Default value: ``true``
|
|
| 230 |
Default value: `true`
|
|
| 231 | 231 |
|
| 232 |
##### <a name="nat"></a>`nat` |
|
| 232 |
##### <a name="-nftables--nat"></a>`nat`
|
|
| 233 | 233 |
|
| 234 | 234 |
Data type: `Boolean` |
| 235 | 235 |
|
| 236 | 236 |
Add default tables and chains to process NAT traffic. |
| 237 | 237 |
|
| 238 |
Default value: ``true``
|
|
| 238 |
Default value: `true`
|
|
| 239 | 239 |
|
| 240 |
##### <a name="nat_table_name"></a>`nat_table_name` |
|
| 240 |
##### <a name="-nftables--nat_table_name"></a>`nat_table_name`
|
|
| 241 | 241 |
|
| 242 | 242 |
Data type: `String[1]` |
| 243 | 243 |
|
| ... | ... | |
| 245 | 245 |
|
| 246 | 246 |
Default value: `'nat'` |
| 247 | 247 |
|
| 248 |
##### <a name="sets"></a>`sets` |
|
| 248 |
##### <a name="-nftables--sets"></a>`sets`
|
|
| 249 | 249 |
|
| 250 | 250 |
Data type: `Hash` |
| 251 | 251 |
|
| ... | ... | |
| 253 | 253 |
|
| 254 | 254 |
Default value: `{}`
|
| 255 | 255 |
|
| 256 |
##### <a name="log_prefix"></a>`log_prefix` |
|
| 256 |
##### <a name="-nftables--log_prefix"></a>`log_prefix`
|
|
| 257 | 257 |
|
| 258 | 258 |
Data type: `String` |
| 259 | 259 |
|
| ... | ... | |
| 264 | 264 |
|
| 265 | 265 |
Default value: `'[nftables] %<chain>s %<comment>s'` |
| 266 | 266 |
|
| 267 |
##### <a name="log_limit"></a>`log_limit` |
|
| 267 |
##### <a name="-nftables--log_limit"></a>`log_limit`
|
|
| 268 | 268 |
|
| 269 | 269 |
Data type: `Variant[Boolean[false], String]` |
| 270 | 270 |
|
| ... | ... | |
| 274 | 274 |
|
| 275 | 275 |
Default value: `'3/minute burst 5 packets'` |
| 276 | 276 |
|
| 277 |
##### <a name="reject_with"></a>`reject_with` |
|
| 277 |
##### <a name="-nftables--reject_with"></a>`reject_with`
|
|
| 278 | 278 |
|
| 279 | 279 |
Data type: `Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]]` |
| 280 | 280 |
|
| ... | ... | |
| 285 | 285 |
|
| 286 | 286 |
Default value: `'icmpx type port-unreachable'` |
| 287 | 287 |
|
| 288 |
##### <a name="in_out_conntrack"></a>`in_out_conntrack` |
|
| 288 |
##### <a name="-nftables--in_out_conntrack"></a>`in_out_conntrack`
|
|
| 289 | 289 |
|
| 290 | 290 |
Data type: `Boolean` |
| 291 | 291 |
|
| 292 | 292 |
Adds INPUT and OUTPUT rules to allow traffic that's part of an |
| 293 | 293 |
established connection and also to drop invalid packets. |
| 294 | 294 |
|
| 295 |
Default value: ``true``
|
|
| 295 |
Default value: `true`
|
|
| 296 | 296 |
|
| 297 |
##### <a name="fwd_conntrack"></a>`fwd_conntrack` |
|
| 297 |
##### <a name="-nftables--fwd_conntrack"></a>`fwd_conntrack`
|
|
| 298 | 298 |
|
| 299 | 299 |
Data type: `Boolean` |
| 300 | 300 |
|
| 301 | 301 |
Adds FORWARD rules to allow traffic that's part of an |
| 302 | 302 |
established connection and also to drop invalid packets. |
| 303 | 303 |
|
| 304 |
Default value: ``false``
|
|
| 304 |
Default value: `false`
|
|
| 305 | 305 |
|
| 306 |
##### <a name="firewalld_enable"></a>`firewalld_enable` |
|
| 306 |
##### <a name="-nftables--firewalld_enable"></a>`firewalld_enable`
|
|
| 307 | 307 |
|
| 308 | 308 |
Data type: `Variant[Boolean[false], Enum['mask']]` |
| 309 | 309 |
|
| ... | ... | |
| 313 | 313 |
|
| 314 | 314 |
Default value: `'mask'` |
| 315 | 315 |
|
| 316 |
##### <a name="noflush_tables"></a>`noflush_tables` |
|
| 316 |
##### <a name="-nftables--noflush_tables"></a>`noflush_tables`
|
|
| 317 | 317 |
|
| 318 | 318 |
Data type: `Optional[Array[Pattern[/^(ip|ip6|inet|arp|bridge|netdev)-[-a-zA-Z0-9_]+$/],1]]` |
| 319 | 319 |
|
| 320 | 320 |
If specified only other existings tables will be flushed. |
| 321 | 321 |
If left unset all tables will be flushed via a `flush ruleset` |
| 322 | 322 |
|
| 323 |
Default value: ``undef``
|
|
| 323 |
Default value: `undef`
|
|
| 324 | 324 |
|
| 325 |
##### <a name="rules"></a>`rules` |
|
| 325 |
##### <a name="-nftables--rules"></a>`rules`
|
|
| 326 | 326 |
|
| 327 | 327 |
Data type: `Hash` |
| 328 | 328 |
|
| ... | ... | |
| 330 | 330 |
|
| 331 | 331 |
Default value: `{}`
|
| 332 | 332 |
|
| 333 |
##### <a name="configuration_path"></a>`configuration_path` |
|
| 333 |
##### <a name="-nftables--configuration_path"></a>`configuration_path`
|
|
| 334 | 334 |
|
| 335 | 335 |
Data type: `Stdlib::Unixpath` |
| 336 | 336 |
|
| 337 | 337 |
The absolute path to the principal nftables configuration file. The default |
| 338 | 338 |
varies depending on the system, and is set in the module's data. |
| 339 | 339 |
|
| 340 |
##### <a name="nft_path"></a>`nft_path` |
|
| 340 |
##### <a name="-nftables--nft_path"></a>`nft_path`
|
|
| 341 | 341 |
|
| 342 | 342 |
Data type: `Stdlib::Unixpath` |
| 343 | 343 |
|
| 344 | 344 |
Path to the nft binary |
| 345 | 345 |
|
| 346 |
##### <a name="echo"></a>`echo` |
|
| 346 |
##### <a name="-nftables--echo"></a>`echo`
|
|
| 347 | 347 |
|
| 348 | 348 |
Data type: `Stdlib::Unixpath` |
| 349 | 349 |
|
| 350 | 350 |
Path to the echo binary |
| 351 | 351 |
|
| 352 |
##### <a name="default_config_mode"></a>`default_config_mode` |
|
| 352 |
##### <a name="-nftables--default_config_mode"></a>`default_config_mode`
|
|
| 353 | 353 |
|
| 354 | 354 |
Data type: `Stdlib::Filemode` |
| 355 | 355 |
|
| 356 | 356 |
The default file & dir mode for configuration files and directories. The |
| 357 | 357 |
default varies depending on the system, and is set in the module's data. |
| 358 | 358 |
|
| 359 |
### <a name="nftablesbridges"></a>`nftables::bridges` |
|
| 359 |
### <a name="nftables--bridges"></a>`nftables::bridges`
|
|
| 360 | 360 |
|
| 361 | 361 |
allow forwarding traffic on bridges |
| 362 | 362 |
|
| ... | ... | |
| 364 | 364 |
|
| 365 | 365 |
The following parameters are available in the `nftables::bridges` class: |
| 366 | 366 |
|
| 367 |
* [`ensure`](#ensure) |
|
| 368 |
* [`bridgenames`](#bridgenames) |
|
| 367 |
* [`ensure`](#-nftables--bridges--ensure)
|
|
| 368 |
* [`bridgenames`](#-nftables--bridges--bridgenames)
|
|
| 369 | 369 |
|
| 370 |
##### <a name="ensure"></a>`ensure` |
|
| 370 |
##### <a name="-nftables--bridges--ensure"></a>`ensure`
|
|
| 371 | 371 |
|
| 372 | 372 |
Data type: `Enum['present','absent']` |
| 373 | 373 |
|
| ... | ... | |
| 375 | 375 |
|
| 376 | 376 |
Default value: `'present'` |
| 377 | 377 |
|
| 378 |
##### <a name="bridgenames"></a>`bridgenames` |
|
| 378 |
##### <a name="-nftables--bridges--bridgenames"></a>`bridgenames`
|
|
| 379 | 379 |
|
| 380 | 380 |
Data type: `Regexp` |
| 381 | 381 |
|
| ... | ... | |
| 383 | 383 |
|
| 384 | 384 |
Default value: `/^br.+/` |
| 385 | 385 |
|
| 386 |
### <a name="nftablesinet_filter"></a>`nftables::inet_filter` |
|
| 386 |
### <a name="nftables--inet_filter"></a>`nftables::inet_filter`
|
|
| 387 | 387 |
|
| 388 | 388 |
manage basic chains in table inet filter |
| 389 | 389 |
|
| 390 |
### <a name="nftablesinet_filterfwd_conntrack"></a>`nftables::inet_filter::fwd_conntrack`
|
|
| 390 |
### <a name="nftables--inet_filter--fwd_conntrack"></a>`nftables::inet_filter::fwd_conntrack`
|
|
| 391 | 391 |
|
| 392 | 392 |
enable conntrack for fwd |
| 393 | 393 |
|
| 394 |
### <a name="nftablesinet_filterin_out_conntrack"></a>`nftables::inet_filter::in_out_conntrack`
|
|
| 394 |
### <a name="nftables--inet_filter--in_out_conntrack"></a>`nftables::inet_filter::in_out_conntrack`
|
|
| 395 | 395 |
|
| 396 | 396 |
manage input & output conntrack |
| 397 | 397 |
|
| 398 |
### <a name="nftablesip_nat"></a>`nftables::ip_nat` |
|
| 398 |
### <a name="nftables--ip_nat"></a>`nftables::ip_nat`
|
|
| 399 | 399 |
|
| 400 | 400 |
manage basic chains in table ip nat |
| 401 | 401 |
|
| 402 |
### <a name="nftablesrulesactivemq"></a>`nftables::rules::activemq`
|
|
| 402 |
### <a name="nftables--rules--activemq"></a>`nftables::rules::activemq`
|
|
| 403 | 403 |
|
| 404 | 404 |
Provides input rules for Apache ActiveMQ |
| 405 | 405 |
|
| ... | ... | |
| 407 | 407 |
|
| 408 | 408 |
The following parameters are available in the `nftables::rules::activemq` class: |
| 409 | 409 |
|
| 410 |
* [`tcp`](#tcp) |
|
| 411 |
* [`udp`](#udp) |
|
| 412 |
* [`port`](#port) |
|
| 410 |
* [`tcp`](#-nftables--rules--activemq--tcp)
|
|
| 411 |
* [`udp`](#-nftables--rules--activemq--udp)
|
|
| 412 |
* [`port`](#-nftables--rules--activemq--port)
|
|
| 413 | 413 |
|
| 414 |
##### <a name="tcp"></a>`tcp` |
|
| 414 |
##### <a name="-nftables--rules--activemq--tcp"></a>`tcp`
|
|
| 415 | 415 |
|
| 416 | 416 |
Data type: `Boolean` |
| 417 | 417 |
|
| 418 | 418 |
Create the rule for TCP traffic. |
| 419 | 419 |
|
| 420 |
Default value: ``true``
|
|
| 420 |
Default value: `true`
|
|
| 421 | 421 |
|
| 422 |
##### <a name="udp"></a>`udp` |
|
| 422 |
##### <a name="-nftables--rules--activemq--udp"></a>`udp`
|
|
| 423 | 423 |
|
| 424 | 424 |
Data type: `Boolean` |
| 425 | 425 |
|
| 426 | 426 |
Create the rule for UDP traffic. |
| 427 | 427 |
|
| 428 |
Default value: ``true``
|
|
| 428 |
Default value: `true`
|
|
| 429 | 429 |
|
| 430 |
##### <a name="port"></a>`port` |
|
| 430 |
##### <a name="-nftables--rules--activemq--port"></a>`port`
|
|
| 431 | 431 |
|
| 432 | 432 |
Data type: `Stdlib::Port` |
| 433 | 433 |
|
| ... | ... | |
| 435 | 435 |
|
| 436 | 436 |
Default value: `61616` |
| 437 | 437 |
|
| 438 |
### <a name="nftablesrulesafs3_callback"></a>`nftables::rules::afs3_callback`
|
|
| 438 |
### <a name="nftables--rules--afs3_callback"></a>`nftables::rules::afs3_callback`
|
|
| 439 | 439 |
|
| 440 | 440 |
Open call back port for AFS clients |
| 441 | 441 |
|
| ... | ... | |
| 453 | 453 |
|
| 454 | 454 |
The following parameters are available in the `nftables::rules::afs3_callback` class: |
| 455 | 455 |
|
| 456 |
* [`saddr`](#saddr) |
|
| 456 |
* [`saddr`](#-nftables--rules--afs3_callback--saddr)
|
|
| 457 | 457 |
|
| 458 |
##### <a name="saddr"></a>`saddr` |
|
| 458 |
##### <a name="-nftables--rules--afs3_callback--saddr"></a>`saddr`
|
|
| 459 | 459 |
|
| 460 | 460 |
Data type: `Array[Stdlib::IP::Address::V4,1]` |
| 461 | 461 |
|
| ... | ... | |
| 463 | 463 |
|
| 464 | 464 |
Default value: `['0.0.0.0/0']` |
| 465 | 465 |
|
| 466 |
### <a name="nftablesrulesceph"></a>`nftables::rules::ceph`
|
|
| 466 |
### <a name="nftables--rules--ceph"></a>`nftables::rules::ceph`
|
|
| 467 | 467 |
|
| 468 | 468 |
Ceph is a distributed object store and file system. |
| 469 | 469 |
Enable this to support Ceph's Object Storage Daemons (OSD), |
| 470 | 470 |
Metadata Server Daemons (MDS), or Manager Daemons (MGR). |
| 471 | 471 |
|
| 472 |
### <a name="nftablesrulesceph_mon"></a>`nftables::rules::ceph_mon`
|
|
| 472 |
### <a name="nftables--rules--ceph_mon"></a>`nftables::rules::ceph_mon`
|
|
| 473 | 473 |
|
| 474 | 474 |
Ceph is a distributed object store and file system. |
| 475 | 475 |
Enable this option to support Ceph's Monitor Daemon. |
| ... | ... | |
| 478 | 478 |
|
| 479 | 479 |
The following parameters are available in the `nftables::rules::ceph_mon` class: |
| 480 | 480 |
|
| 481 |
* [`ports`](#ports) |
|
| 481 |
* [`ports`](#-nftables--rules--ceph_mon--ports)
|
|
| 482 | 482 |
|
| 483 |
##### <a name="ports"></a>`ports` |
|
| 483 |
##### <a name="-nftables--rules--ceph_mon--ports"></a>`ports`
|
|
| 484 | 484 |
|
| 485 | 485 |
Data type: `Array[Stdlib::Port,1]` |
| 486 | 486 |
|
| ... | ... | |
| 488 | 488 |
|
| 489 | 489 |
Default value: `[3300, 6789]` |
| 490 | 490 |
|
| 491 |
### <a name="nftablesrulesdhcpv6_client"></a>`nftables::rules::dhcpv6_client`
|
|
| 491 |
### <a name="nftables--rules--dhcpv6_client"></a>`nftables::rules::dhcpv6_client`
|
|
| 492 | 492 |
|
| 493 | 493 |
allow DHCPv6 requests in to a host |
| 494 | 494 |
|
| 495 |
### <a name="nftablesrulesdns"></a>`nftables::rules::dns`
|
|
| 495 |
### <a name="nftables--rules--dns"></a>`nftables::rules::dns`
|
|
| 496 | 496 |
|
| 497 | 497 |
manage in dns |
| 498 | 498 |
|
| ... | ... | |
| 500 | 500 |
|
| 501 | 501 |
The following parameters are available in the `nftables::rules::dns` class: |
| 502 | 502 |
|
| 503 |
* [`ports`](#ports) |
|
| 503 |
* [`ports`](#-nftables--rules--dns--ports)
|
|
| 504 | 504 |
|
| 505 |
##### <a name="ports"></a>`ports` |
|
| 505 |
##### <a name="-nftables--rules--dns--ports"></a>`ports`
|
|
| 506 | 506 |
|
| 507 | 507 |
Data type: `Array[Stdlib::Port,1]` |
| 508 | 508 |
|
| ... | ... | |
| 510 | 510 |
|
| 511 | 511 |
Default value: `[53]` |
| 512 | 512 |
|
| 513 |
### <a name="nftablesrulesdocker_ce"></a>`nftables::rules::docker_ce`
|
|
| 513 |
### <a name="nftables--rules--docker_ce"></a>`nftables::rules::docker_ce`
|
|
| 514 | 514 |
|
| 515 | 515 |
The configuration distributed in this class represents the default firewall |
| 516 | 516 |
configuration done by docker-ce when the iptables integration is enabled. |
| ... | ... | |
| 524 | 524 |
|
| 525 | 525 |
The following parameters are available in the `nftables::rules::docker_ce` class: |
| 526 | 526 |
|
| 527 |
* [`docker_interface`](#docker_interface) |
|
| 528 |
* [`docker_prefix`](#docker_prefix) |
|
| 529 |
* [`manage_docker_chains`](#manage_docker_chains) |
|
| 530 |
* [`manage_base_chains`](#manage_base_chains) |
|
| 527 |
* [`docker_interface`](#-nftables--rules--docker_ce--docker_interface)
|
|
| 528 |
* [`docker_prefix`](#-nftables--rules--docker_ce--docker_prefix)
|
|
| 529 |
* [`manage_docker_chains`](#-nftables--rules--docker_ce--manage_docker_chains)
|
|
| 530 |
* [`manage_base_chains`](#-nftables--rules--docker_ce--manage_base_chains)
|
|
| 531 | 531 |
|
| 532 |
##### <a name="docker_interface"></a>`docker_interface` |
|
| 532 |
##### <a name="-nftables--rules--docker_ce--docker_interface"></a>`docker_interface`
|
|
| 533 | 533 |
|
| 534 | 534 |
Data type: `String[1]` |
| 535 | 535 |
|
| ... | ... | |
| 537 | 537 |
|
| 538 | 538 |
Default value: `'docker0'` |
| 539 | 539 |
|
| 540 |
##### <a name="docker_prefix"></a>`docker_prefix` |
|
| 540 |
##### <a name="-nftables--rules--docker_ce--docker_prefix"></a>`docker_prefix`
|
|
| 541 | 541 |
|
| 542 | 542 |
Data type: `Stdlib::IP::Address::V4::CIDR` |
| 543 | 543 |
|
| ... | ... | |
| 545 | 545 |
|
| 546 | 546 |
Default value: `'172.17.0.0/16'` |
| 547 | 547 |
|
| 548 |
##### <a name="manage_docker_chains"></a>`manage_docker_chains` |
|
| 548 |
##### <a name="-nftables--rules--docker_ce--manage_docker_chains"></a>`manage_docker_chains`
|
|
| 549 | 549 |
|
| 550 | 550 |
Data type: `Boolean` |
| 551 | 551 |
|
| 552 | 552 |
Flag to control whether the class should create the docker related chains. |
| 553 | 553 |
|
| 554 |
Default value: ``true``
|
|
| 554 |
Default value: `true`
|
|
| 555 | 555 |
|
| 556 |
##### <a name="manage_base_chains"></a>`manage_base_chains` |
|
| 556 |
##### <a name="-nftables--rules--docker_ce--manage_base_chains"></a>`manage_base_chains`
|
|
| 557 | 557 |
|
| 558 | 558 |
Data type: `Boolean` |
| 559 | 559 |
|
| 560 | 560 |
Flag to control whether the class should create the base common chains. |
| 561 | 561 |
|
| 562 |
Default value: ``true``
|
|
| 562 |
Default value: `true`
|
|
| 563 | 563 |
|
| 564 |
### <a name="nftablesruleshttp"></a>`nftables::rules::http`
|
|
| 564 |
### <a name="nftables--rules--http"></a>`nftables::rules::http`
|
|
| 565 | 565 |
|
| 566 | 566 |
manage in http |
| 567 | 567 |
|
| 568 |
### <a name="nftablesruleshttps"></a>`nftables::rules::https`
|
|
| 568 |
### <a name="nftables--rules--https"></a>`nftables::rules::https`
|
|
| 569 | 569 |
|
| 570 | 570 |
manage in https |
| 571 | 571 |
|
| 572 |
### <a name="nftablesrulesicinga2"></a>`nftables::rules::icinga2`
|
|
| 572 |
### <a name="nftables--rules--icinga2"></a>`nftables::rules::icinga2`
|
|
| 573 | 573 |
|
| 574 | 574 |
manage in icinga2 |
| 575 | 575 |
|
| ... | ... | |
| 577 | 577 |
|
| 578 | 578 |
The following parameters are available in the `nftables::rules::icinga2` class: |
| 579 | 579 |
|
| 580 |
* [`ports`](#ports) |
|
| 580 |
* [`ports`](#-nftables--rules--icinga2--ports)
|
|
| 581 | 581 |
|
| 582 |
##### <a name="ports"></a>`ports` |
|
| 582 |
##### <a name="-nftables--rules--icinga2--ports"></a>`ports`
|
|
| 583 | 583 |
|
| 584 | 584 |
Data type: `Array[Stdlib::Port,1]` |
| 585 | 585 |
|
| ... | ... | |
| 587 | 587 |
|
| 588 | 588 |
Default value: `[5665]` |
| 589 | 589 |
|
| 590 |
### <a name="nftablesrulesicmp"></a>`nftables::rules::icmp`
|
|
| 590 |
### <a name="nftables--rules--icmp"></a>`nftables::rules::icmp`
|
|
| 591 | 591 |
|
| 592 | 592 |
The nftables::rules::icmp class. |
| 593 | 593 |
|
| ... | ... | |
| 595 | 595 |
|
| 596 | 596 |
The following parameters are available in the `nftables::rules::icmp` class: |
| 597 | 597 |
|
| 598 |
* [`v4_types`](#v4_types) |
|
| 599 |
* [`v6_types`](#v6_types) |
|
| 600 |
* [`order`](#order) |
|
| 598 |
* [`v4_types`](#-nftables--rules--icmp--v4_types)
|
|
| 599 |
* [`v6_types`](#-nftables--rules--icmp--v6_types)
|
|
| 600 |
* [`order`](#-nftables--rules--icmp--order)
|
|
| 601 | 601 |
|
| 602 |
##### <a name="v4_types"></a>`v4_types` |
|
| 602 |
##### <a name="-nftables--rules--icmp--v4_types"></a>`v4_types`
|
|
| 603 | 603 |
|
| 604 | 604 |
Data type: `Optional[Array[String]]` |
| 605 | 605 |
|
| 606 | 606 |
|
| 607 | 607 |
|
| 608 |
Default value: ``undef``
|
|
| 608 |
Default value: `undef`
|
|
| 609 | 609 |
|
| 610 |
##### <a name="v6_types"></a>`v6_types` |
|
| 610 |
##### <a name="-nftables--rules--icmp--v6_types"></a>`v6_types`
|
|
| 611 | 611 |
|
| 612 | 612 |
Data type: `Optional[Array[String]]` |
| 613 | 613 |
|
| 614 | 614 |
|
| 615 | 615 |
|
| 616 |
Default value: ``undef``
|
|
| 616 |
Default value: `undef`
|
|
| 617 | 617 |
|
| 618 |
##### <a name="order"></a>`order` |
|
| 618 |
##### <a name="-nftables--rules--icmp--order"></a>`order`
|
|
| 619 | 619 |
|
| 620 | 620 |
Data type: `String` |
| 621 | 621 |
|
| ... | ... | |
| 623 | 623 |
|
| 624 | 624 |
Default value: `'10'` |
| 625 | 625 |
|
| 626 |
### <a name="nftablesrulesnfs"></a>`nftables::rules::nfs`
|
|
| 626 |
### <a name="nftables--rules--nfs"></a>`nftables::rules::nfs`
|
|
| 627 | 627 |
|
| 628 | 628 |
manage in nfs4 |
| 629 | 629 |
|
| 630 |
### <a name="nftablesrulesnfs3"></a>`nftables::rules::nfs3`
|
|
| 630 |
### <a name="nftables--rules--nfs3"></a>`nftables::rules::nfs3`
|
|
| 631 | 631 |
|
| 632 | 632 |
manage in nfs3 |
| 633 | 633 |
|
| 634 |
### <a name="nftablesrulesnode_exporter"></a>`nftables::rules::node_exporter`
|
|
| 634 |
### <a name="nftables--rules--node_exporter"></a>`nftables::rules::node_exporter`
|
|
| 635 | 635 |
|
| 636 | 636 |
manage in node exporter |
| 637 | 637 |
|
| ... | ... | |
| 639 | 639 |
|
| 640 | 640 |
The following parameters are available in the `nftables::rules::node_exporter` class: |
| 641 | 641 |
|
| 642 |
* [`prometheus_server`](#prometheus_server) |
|
| 643 |
* [`port`](#port) |
|
| 642 |
* [`prometheus_server`](#-nftables--rules--node_exporter--prometheus_server)
|
|
| 643 |
* [`port`](#-nftables--rules--node_exporter--port)
|
|
| 644 | 644 |
|
| 645 |
##### <a name="prometheus_server"></a>`prometheus_server` |
|
| 645 |
##### <a name="-nftables--rules--node_exporter--prometheus_server"></a>`prometheus_server`
|
|
| 646 | 646 |
|
| 647 | 647 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
| 648 | 648 |
|
| 649 | 649 |
Specify server name |
| 650 | 650 |
|
| 651 |
Default value: ``undef``
|
|
| 651 |
Default value: `undef`
|
|
| 652 | 652 |
|
| 653 |
##### <a name="port"></a>`port` |
|
| 653 |
##### <a name="-nftables--rules--node_exporter--port"></a>`port`
|
|
| 654 | 654 |
|
| 655 | 655 |
Data type: `Stdlib::Port` |
| 656 | 656 |
|
| ... | ... | |
| 658 | 658 |
|
| 659 | 659 |
Default value: `9100` |
| 660 | 660 |
|
| 661 |
### <a name="nftablesrulesospf"></a>`nftables::rules::ospf`
|
|
| 661 |
### <a name="nftables--rules--ospf"></a>`nftables::rules::ospf`
|
|
| 662 | 662 |
|
| 663 | 663 |
manage in ospf |
| 664 | 664 |
|
| 665 |
### <a name="nftablesrulesospf3"></a>`nftables::rules::ospf3`
|
|
| 665 |
### <a name="nftables--rules--ospf3"></a>`nftables::rules::ospf3`
|
|
| 666 | 666 |
|
| 667 | 667 |
manage in ospf3 |
| 668 | 668 |
|
| 669 |
### <a name="nftablesrulesoutall"></a>`nftables::rules::out::all`
|
|
| 669 |
### <a name="nftables--rules--out--all"></a>`nftables::rules::out::all`
|
|
| 670 | 670 |
|
| 671 | 671 |
allow all outbound |
| 672 | 672 |
|
| 673 |
### <a name="nftablesrulesoutceph_client"></a>`nftables::rules::out::ceph_client`
|
|
| 673 |
### <a name="nftables--rules--out--ceph_client"></a>`nftables::rules::out::ceph_client`
|
|
| 674 | 674 |
|
| 675 | 675 |
Ceph is a distributed object store and file system. |
| 676 | 676 |
Enable this to be a client of Ceph's Monitor (MON), |
| ... | ... | |
| 681 | 681 |
|
| 682 | 682 |
The following parameters are available in the `nftables::rules::out::ceph_client` class: |
| 683 | 683 |
|
| 684 |
* [`ports`](#ports) |
|
| 684 |
* [`ports`](#-nftables--rules--out--ceph_client--ports)
|
|
| 685 | 685 |
|
| 686 |
##### <a name="ports"></a>`ports` |
|
| 686 |
##### <a name="-nftables--rules--out--ceph_client--ports"></a>`ports`
|
|
| 687 | 687 |
|
| 688 | 688 |
Data type: `Array[Stdlib::Port,1]` |
| 689 | 689 |
|
| ... | ... | |
| 691 | 691 |
|
| 692 | 692 |
Default value: `[3300, 6789]` |
| 693 | 693 |
|
| 694 |
### <a name="nftablesrulesoutchrony"></a>`nftables::rules::out::chrony`
|
|
| 694 |
### <a name="nftables--rules--out--chrony"></a>`nftables::rules::out::chrony`
|
|
| 695 | 695 |
|
| 696 | 696 |
manage out chrony |
| 697 | 697 |
|
| ... | ... | |
| 699 | 699 |
|
| 700 | 700 |
The following parameters are available in the `nftables::rules::out::chrony` class: |
| 701 | 701 |
|
| 702 |
* [`servers`](#servers) |
|
| 702 |
* [`servers`](#-nftables--rules--out--chrony--servers)
|
|
| 703 | 703 |
|
| 704 |
##### <a name="servers"></a>`servers` |
|
| 704 |
##### <a name="-nftables--rules--out--chrony--servers"></a>`servers`
|
|
| 705 | 705 |
|
| 706 | 706 |
Data type: `Array[Stdlib::IP::Address]` |
| 707 | 707 |
|
| ... | ... | |
| 709 | 709 |
|
| 710 | 710 |
Default value: `[]` |
| 711 | 711 |
|
| 712 |
### <a name="nftablesrulesoutdhcp"></a>`nftables::rules::out::dhcp`
|
|
| 712 |
### <a name="nftables--rules--out--dhcp"></a>`nftables::rules::out::dhcp`
|
|
| 713 | 713 |
|
| 714 | 714 |
manage out dhcp |
| 715 | 715 |
|
| 716 |
### <a name="nftablesrulesoutdhcpv6_client"></a>`nftables::rules::out::dhcpv6_client`
|
|
| 716 |
### <a name="nftables--rules--out--dhcpv6_client"></a>`nftables::rules::out::dhcpv6_client`
|
|
| 717 | 717 |
|
| 718 | 718 |
Allow DHCPv6 requests out of a host |
| 719 | 719 |
|
| 720 |
### <a name="nftablesrulesoutdns"></a>`nftables::rules::out::dns`
|
|
| 720 |
### <a name="nftables--rules--out--dns"></a>`nftables::rules::out::dns`
|
|
| 721 | 721 |
|
| 722 | 722 |
manage out dns |
| 723 | 723 |
|
| ... | ... | |
| 725 | 725 |
|
| 726 | 726 |
The following parameters are available in the `nftables::rules::out::dns` class: |
| 727 | 727 |
|
| 728 |
* [`dns_server`](#dns_server) |
|
| 728 |
* [`dns_server`](#-nftables--rules--out--dns--dns_server)
|
|
| 729 | 729 |
|
| 730 |
##### <a name="dns_server"></a>`dns_server` |
|
| 730 |
##### <a name="-nftables--rules--out--dns--dns_server"></a>`dns_server`
|
|
| 731 | 731 |
|
| 732 | 732 |
Data type: `Optional[Variant[String,Array[String,1]]]` |
| 733 | 733 |
|
| 734 | 734 |
specify dns_server name |
| 735 | 735 |
|
| 736 |
Default value: ``undef``
|
|
| 736 |
Default value: `undef`
|
|
| 737 | 737 |
|
| 738 |
### <a name="nftablesrulesouthkp"></a>`nftables::rules::out::hkp`
|
|
| 738 |
### <a name="nftables--rules--out--hkp"></a>`nftables::rules::out::hkp`
|
|
| 739 | 739 |
|
| 740 | 740 |
allow outgoing hkp connections to gpg keyservers |
| 741 | 741 |
|
| 742 |
### <a name="nftablesrulesouthttp"></a>`nftables::rules::out::http`
|
|
| 742 |
### <a name="nftables--rules--out--http"></a>`nftables::rules::out::http`
|
|
| 743 | 743 |
|
| 744 | 744 |
manage out http |
| 745 | 745 |
|
| 746 |
### <a name="nftablesrulesouthttps"></a>`nftables::rules::out::https`
|
|
| 746 |
### <a name="nftables--rules--out--https"></a>`nftables::rules::out::https`
|
|
| 747 | 747 |
|
| 748 | 748 |
manage out https |
| 749 | 749 |
|
| 750 |
### <a name="nftablesrulesouticmp"></a>`nftables::rules::out::icmp`
|
|
| 750 |
### <a name="nftables--rules--out--icmp"></a>`nftables::rules::out::icmp`
|
|
| 751 | 751 |
|
| 752 | 752 |
control outbound icmp packages |
| 753 | 753 |
|
| ... | ... | |
| 755 | 755 |
|
| 756 | 756 |
The following parameters are available in the `nftables::rules::out::icmp` class: |
| 757 | 757 |
|
| 758 |
* [`v4_types`](#v4_types) |
|
| 759 |
* [`v6_types`](#v6_types) |
|
| 760 |
* [`order`](#order) |
|
| 758 |
* [`v4_types`](#-nftables--rules--out--icmp--v4_types)
|
|
| 759 |
* [`v6_types`](#-nftables--rules--out--icmp--v6_types)
|
|
| 760 |
* [`order`](#-nftables--rules--out--icmp--order)
|
|
| 761 | 761 |
|
| 762 |
##### <a name="v4_types"></a>`v4_types` |
|
| 762 |
##### <a name="-nftables--rules--out--icmp--v4_types"></a>`v4_types`
|
|
| 763 | 763 |
|
| 764 | 764 |
Data type: `Optional[Array[String]]` |
| 765 | 765 |
|
| 766 | 766 |
|
| 767 | 767 |
|
| 768 |
Default value: ``undef``
|
|
| 768 |
Default value: `undef`
|
|
| 769 | 769 |
|
| 770 |
##### <a name="v6_types"></a>`v6_types` |
|
| 770 |
##### <a name="-nftables--rules--out--icmp--v6_types"></a>`v6_types`
|
|
| 771 | 771 |
|
| 772 | 772 |
Data type: `Optional[Array[String]]` |
| 773 | 773 |
|
| 774 | 774 |
|
| 775 | 775 |
|
| 776 |
Default value: ``undef``
|
|
| 776 |
Default value: `undef`
|
|
| 777 | 777 |
|
| 778 |
##### <a name="order"></a>`order` |
|
| 778 |
##### <a name="-nftables--rules--out--icmp--order"></a>`order`
|
|
| 779 | 779 |
|
| 780 | 780 |
Data type: `String` |
| 781 | 781 |
|
| ... | ... | |
| 783 | 783 |
|
| 784 | 784 |
Default value: `'10'` |
| 785 | 785 |
|
| 786 |
### <a name="nftablesrulesoutimap"></a>`nftables::rules::out::imap`
|
|
| 786 |
### <a name="nftables--rules--out--imap"></a>`nftables::rules::out::imap`
|
|
| 787 | 787 |
|
| 788 | 788 |
allow outgoing imap |
| 789 | 789 |
|
| 790 |
### <a name="nftablesrulesoutkerberos"></a>`nftables::rules::out::kerberos`
|
|
| 790 |
### <a name="nftables--rules--out--kerberos"></a>`nftables::rules::out::kerberos`
|
|
| 791 | 791 |
|
| 792 | 792 |
allows outbound access for kerberos |
| 793 | 793 |
|
| 794 |
### <a name="nftablesrulesoutmysql"></a>`nftables::rules::out::mysql`
|
|
| 794 |
### <a name="nftables--rules--out--mysql"></a>`nftables::rules::out::mysql`
|
|
| 795 | 795 |
|
| 796 | 796 |
manage out mysql |
| 797 | 797 |
|
| 798 |
### <a name="nftablesrulesoutnfs"></a>`nftables::rules::out::nfs`
|
|
| 798 |
### <a name="nftables--rules--out--nfs"></a>`nftables::rules::out::nfs`
|
|
| 799 | 799 |
|
| 800 | 800 |
manage out nfs |
| 801 | 801 |
|
| 802 |
### <a name="nftablesrulesoutnfs3"></a>`nftables::rules::out::nfs3`
|
|
| 802 |
### <a name="nftables--rules--out--nfs3"></a>`nftables::rules::out::nfs3`
|
|
| 803 | 803 |
|
| 804 | 804 |
manage out nfs3 |
| 805 | 805 |
|
| 806 |
### <a name="nftablesrulesoutopenafs_client"></a>`nftables::rules::out::openafs_client`
|
|
| 806 |
### <a name="nftables--rules--out--openafs_client"></a>`nftables::rules::out::openafs_client`
|
|
| 807 | 807 |
|
| 808 | 808 |
allows outbound access for afs clients |
| 809 | 809 |
7000 - afs3-fileserver |
| ... | ... | |
| 818 | 818 |
|
| 819 | 819 |
The following parameters are available in the `nftables::rules::out::openafs_client` class: |
| 820 | 820 |
|
| 821 |
* [`ports`](#ports) |
|
| 821 |
* [`ports`](#-nftables--rules--out--openafs_client--ports)
|
|
| 822 | 822 |
|
| 823 |
##### <a name="ports"></a>`ports` |
|
| 823 |
##### <a name="-nftables--rules--out--openafs_client--ports"></a>`ports`
|
|
| 824 | 824 |
|
| 825 | 825 |
Data type: `Array[Stdlib::Port,1]` |
| 826 | 826 |
|
| ... | ... | |
| 828 | 828 |
|
| 829 | 829 |
Default value: `[7000, 7002, 7003]` |
| 830 | 830 |
|
| 831 |
### <a name="nftablesrulesoutospf"></a>`nftables::rules::out::ospf`
|
|
| 831 |
### <a name="nftables--rules--out--ospf"></a>`nftables::rules::out::ospf`
|
|
| 832 | 832 |
|
| 833 | 833 |
manage out ospf |
| 834 | 834 |
|
| 835 |
### <a name="nftablesrulesoutospf3"></a>`nftables::rules::out::ospf3`
|
|
| 835 |
### <a name="nftables--rules--out--ospf3"></a>`nftables::rules::out::ospf3`
|
|
| 836 | 836 |
|
| 837 | 837 |
manage out ospf3 |
| 838 | 838 |
|
| 839 |
### <a name="nftablesrulesoutpop3"></a>`nftables::rules::out::pop3`
|
|
| 839 |
### <a name="nftables--rules--out--pop3"></a>`nftables::rules::out::pop3`
|
|
| 840 | 840 |
|
| 841 | 841 |
allow outgoing pop3 |
| 842 | 842 |
|
| 843 |
### <a name="nftablesrulesoutpostgres"></a>`nftables::rules::out::postgres`
|
|
| 843 |
### <a name="nftables--rules--out--postgres"></a>`nftables::rules::out::postgres`
|
|
| 844 | 844 |
|
| 845 | 845 |
manage out postgres |
| 846 | 846 |
|
| 847 |
### <a name="nftablesrulesoutpuppet"></a>`nftables::rules::out::puppet`
|
|
| 847 |
### <a name="nftables--rules--out--puppet"></a>`nftables::rules::out::puppet`
|
|
| 848 | 848 |
|
| 849 | 849 |
manage outgoing puppet |
| 850 | 850 |
|
| ... | ... | |
| 852 | 852 |
|
| 853 | 853 |
The following parameters are available in the `nftables::rules::out::puppet` class: |
| 854 | 854 |
|
| 855 |
* [`puppetserver`](#puppetserver) |
|
| 856 |
* [`puppetserver_port`](#puppetserver_port) |
|
| 855 |
* [`puppetserver`](#-nftables--rules--out--puppet--puppetserver)
|
|
| 856 |
* [`puppetserver_port`](#-nftables--rules--out--puppet--puppetserver_port)
|
|
| 857 | 857 |
|
| 858 |
##### <a name="puppetserver"></a>`puppetserver` |
|
| 858 |
##### <a name="-nftables--rules--out--puppet--puppetserver"></a>`puppetserver`
|
|
| 859 | 859 |
|
| 860 | 860 |
Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]` |
| 861 | 861 |
|
| 862 | 862 |
puppetserver hostname |
| 863 | 863 |
|
| 864 |
##### <a name="puppetserver_port"></a>`puppetserver_port` |
|
| 864 |
##### <a name="-nftables--rules--out--puppet--puppetserver_port"></a>`puppetserver_port`
|
|
| 865 | 865 |
|
| 866 | 866 |
Data type: `Stdlib::Port` |
| 867 | 867 |
|
| ... | ... | |
| 869 | 869 |
|
| 870 | 870 |
Default value: `8140` |
| 871 | 871 |
|
| 872 |
### <a name="nftablesrulesoutpxp_agent"></a>`nftables::rules::out::pxp_agent`
|
|
| 872 |
### <a name="nftables--rules--out--pxp_agent"></a>`nftables::rules::out::pxp_agent`
|
|
| 873 | 873 |
|
| 874 | 874 |
manage outgoing pxp-agent |
| 875 | 875 |
|
| ... | ... | |
| 881 | 881 |
|
| 882 | 882 |
The following parameters are available in the `nftables::rules::out::pxp_agent` class: |
| 883 | 883 |
|
| 884 |
* [`broker`](#broker) |
|
| 885 |
* [`broker_port`](#broker_port) |
|
| 884 |
* [`broker`](#-nftables--rules--out--pxp_agent--broker)
|
|
| 885 |
* [`broker_port`](#-nftables--rules--out--pxp_agent--broker_port)
|
|
| 886 | 886 |
|
| 887 |
##### <a name="broker"></a>`broker` |
|
| 887 |
##### <a name="-nftables--rules--out--pxp_agent--broker"></a>`broker`
|
|
| 888 | 888 |
|
| 889 | 889 |
Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]` |
| 890 | 890 |
|
| 891 | 891 |
PXP broker IP(s) |
| 892 | 892 |
|
| 893 |
##### <a name="broker_port"></a>`broker_port` |
|
| 893 |
##### <a name="-nftables--rules--out--pxp_agent--broker_port"></a>`broker_port`
|
|
| 894 | 894 |
|
| 895 | 895 |
Data type: `Stdlib::Port` |
| 896 | 896 |
|
| ... | ... | |
| 898 | 898 |
|
| 899 | 899 |
Default value: `8142` |
| 900 | 900 |
|
| 901 |
### <a name="nftablesrulesoutsmtp"></a>`nftables::rules::out::smtp`
|
|
| 901 |
### <a name="nftables--rules--out--smtp"></a>`nftables::rules::out::smtp`
|
|
| 902 | 902 |
|
| 903 | 903 |
allow outgoing smtp |
| 904 | 904 |
|
| 905 |
### <a name="nftablesrulesoutsmtp_client"></a>`nftables::rules::out::smtp_client`
|
|
| 905 |
### <a name="nftables--rules--out--smtp_client"></a>`nftables::rules::out::smtp_client`
|
|
| 906 | 906 |
|
| 907 | 907 |
allow outgoing smtp client |
| 908 | 908 |
|
| 909 |
### <a name="nftablesrulesoutssh"></a>`nftables::rules::out::ssh`
|
|
| 909 |
### <a name="nftables--rules--out--ssh"></a>`nftables::rules::out::ssh`
|
|
| 910 | 910 |
|
| 911 | 911 |
manage out ssh |
| 912 | 912 |
|
| 913 |
### <a name="nftablesrulesoutsshremove"></a>`nftables::rules::out::ssh::remove`
|
|
| 913 |
### <a name="nftables--rules--out--ssh--remove"></a>`nftables::rules::out::ssh::remove`
|
|
| 914 | 914 |
|
| 915 | 915 |
disable outgoing ssh |
| 916 | 916 |
|
| 917 |
### <a name="nftablesrulesouttor"></a>`nftables::rules::out::tor`
|
|
| 917 |
### <a name="nftables--rules--out--tor"></a>`nftables::rules::out::tor`
|
|
| 918 | 918 |
|
| 919 | 919 |
manage out tor |
| 920 | 920 |
|
| 921 |
### <a name="nftablesrulesoutwhois"></a>`nftables::rules::out::whois`
|
|
| 921 |
### <a name="nftables--rules--out--whois"></a>`nftables::rules::out::whois`
|
|
| 922 | 922 |
|
| 923 | 923 |
allow clients to query remote whois server |
| 924 | 924 |
|
| 925 |
### <a name="nftablesrulesoutwireguard"></a>`nftables::rules::out::wireguard`
|
|
| 925 |
### <a name="nftables--rules--out--wireguard"></a>`nftables::rules::out::wireguard`
|
|
| 926 | 926 |
|
| 927 | 927 |
manage out wireguard |
| 928 | 928 |
|
| ... | ... | |
| 930 | 930 |
|
| 931 | 931 |
The following parameters are available in the `nftables::rules::out::wireguard` class: |
| 932 | 932 |
|
| 933 |
* [`ports`](#ports) |
|
| 933 |
* [`ports`](#-nftables--rules--out--wireguard--ports)
|
|
| 934 | 934 |
|
| 935 |
##### <a name="ports"></a>`ports` |
|
| 935 |
##### <a name="-nftables--rules--out--wireguard--ports"></a>`ports`
|
|
| 936 | 936 |
|
| 937 | 937 |
Data type: `Array[Integer,1]` |
| 938 | 938 |
|
| ... | ... | |
| 940 | 940 |
|
| 941 | 941 |
Default value: `[51820]` |
| 942 | 942 |
|
| 943 |
### <a name="nftablesrulespuppet"></a>`nftables::rules::puppet`
|
|
| 943 |
### <a name="nftables--rules--puppet"></a>`nftables::rules::puppet`
|
|
| 944 | 944 |
|
| 945 | 945 |
manage in puppet |
| 946 | 946 |
|
| ... | ... | |
| 948 | 948 |
|
| 949 | 949 |
The following parameters are available in the `nftables::rules::puppet` class: |
| 950 | 950 |
|
| 951 |
* [`ports`](#ports) |
|
| 951 |
* [`ports`](#-nftables--rules--puppet--ports)
|
|
| 952 | 952 |
|
| 953 |
##### <a name="ports"></a>`ports` |
|
| 953 |
##### <a name="-nftables--rules--puppet--ports"></a>`ports`
|
|
| 954 | 954 |
|
| 955 | 955 |
Data type: `Array[Integer,1]` |
| 956 | 956 |
|
| ... | ... | |
| 958 | 958 |
|
| 959 | 959 |
Default value: `[8140]` |
| 960 | 960 |
|
| 961 |
### <a name="nftablesrulespxp_agent"></a>`nftables::rules::pxp_agent`
|
|
| 961 |
### <a name="nftables--rules--pxp_agent"></a>`nftables::rules::pxp_agent`
|
|
| 962 | 962 |
|
| 963 | 963 |
manage in pxp-agent |
| 964 | 964 |
|
| ... | ... | |
| 966 | 966 |
|
| 967 | 967 |
The following parameters are available in the `nftables::rules::pxp_agent` class: |
| 968 | 968 |
|
| 969 |
* [`ports`](#ports) |
|
| 969 |
* [`ports`](#-nftables--rules--pxp_agent--ports)
|
|
| 970 | 970 |
|
| 971 |
##### <a name="ports"></a>`ports` |
|
| 971 |
##### <a name="-nftables--rules--pxp_agent--ports"></a>`ports`
|
|
| 972 | 972 |
|
| 973 | 973 |
Data type: `Array[Stdlib::Port,1]` |
| 974 | 974 |
|
| ... | ... | |
| 976 | 976 |
|
| 977 | 977 |
Default value: `[8142]` |
| 978 | 978 |
|
| 979 |
### <a name="nftablesrulesqemu"></a>`nftables::rules::qemu`
|
|
| 979 |
### <a name="nftables--rules--qemu"></a>`nftables::rules::qemu`
|
|
| 980 | 980 |
|
| 981 | 981 |
This class configures the typical firewall setup that libvirt |
| 982 | 982 |
creates. Depending on your requirements you can switch on and off |
| ... | ... | |
| 989 | 989 |
|
| 990 | 990 |
The following parameters are available in the `nftables::rules::qemu` class: |
| 991 | 991 |
|
| 992 |
* [`interface`](#interface) |
|
| 993 |
* [`network_v4`](#network_v4) |
|
| 994 |
* [`network_v6`](#network_v6) |
|
| 995 |
* [`dns`](#dns) |
|
| 996 |
* [`dhcpv4`](#dhcpv4) |
|
| 997 |
* [`forward_traffic`](#forward_traffic) |
|
| 998 |
* [`internal_traffic`](#internal_traffic) |
|
| 999 |
* [`masquerade`](#masquerade) |
|
| 992 |
* [`interface`](#-nftables--rules--qemu--interface)
|
|
| 993 |
* [`network_v4`](#-nftables--rules--qemu--network_v4)
|
|
| 994 |
* [`network_v6`](#-nftables--rules--qemu--network_v6)
|
|
| 995 |
* [`dns`](#-nftables--rules--qemu--dns)
|
|
| 996 |
* [`dhcpv4`](#-nftables--rules--qemu--dhcpv4)
|
|
| 997 |
* [`forward_traffic`](#-nftables--rules--qemu--forward_traffic)
|
|
| 998 |
* [`internal_traffic`](#-nftables--rules--qemu--internal_traffic)
|
|
| 999 |
* [`masquerade`](#-nftables--rules--qemu--masquerade)
|
|
| 1000 | 1000 |
|
| 1001 |
##### <a name="interface"></a>`interface` |
|
| 1001 |
##### <a name="-nftables--rules--qemu--interface"></a>`interface`
|
|
| 1002 | 1002 |
|
| 1003 | 1003 |
Data type: `String[1]` |
| 1004 | 1004 |
|
| ... | ... | |
| 1006 | 1006 |
|
| 1007 | 1007 |
Default value: `'virbr0'` |
| 1008 | 1008 |
|
| 1009 |
##### <a name="network_v4"></a>`network_v4` |
|
| 1009 |
##### <a name="-nftables--rules--qemu--network_v4"></a>`network_v4`
|
|
| 1010 | 1010 |
|
| 1011 | 1011 |
Data type: `Stdlib::IP::Address::V4::CIDR` |
| 1012 | 1012 |
|
| ... | ... | |
| 1014 | 1014 |
|
| 1015 | 1015 |
Default value: `'192.168.122.0/24'` |
| 1016 | 1016 |
|
| 1017 |
##### <a name="network_v6"></a>`network_v6` |
|
| 1017 |
##### <a name="-nftables--rules--qemu--network_v6"></a>`network_v6`
|
|
| 1018 | 1018 |
|
| 1019 | 1019 |
Data type: `Optional[Stdlib::IP::Address::V6::CIDR]` |
| 1020 | 1020 |
|
| 1021 | 1021 |
The IPv6 network prefix used in the virtual network. |
| 1022 | 1022 |
|
| 1023 |
Default value: ``undef``
|
|
| 1023 |
Default value: `undef`
|
|
| 1024 | 1024 |
|
| 1025 |
##### <a name="dns"></a>`dns` |
|
| 1025 |
##### <a name="-nftables--rules--qemu--dns"></a>`dns`
|
|
| 1026 | 1026 |
|
| 1027 | 1027 |
Data type: `Boolean` |
| 1028 | 1028 |
|
| 1029 | 1029 |
Allow DNS traffic from the guests to the host. |
| 1030 | 1030 |
|
| 1031 |
Default value: ``true``
|
|
| 1031 |
Default value: `true`
|
|
| 1032 | 1032 |
|
| 1033 |
##### <a name="dhcpv4"></a>`dhcpv4` |
|
| 1033 |
##### <a name="-nftables--rules--qemu--dhcpv4"></a>`dhcpv4`
|
|
| 1034 | 1034 |
|
| 1035 | 1035 |
Data type: `Boolean` |
| 1036 | 1036 |
|
| 1037 | 1037 |
Allow DHCPv4 traffic from the guests to the host. |
| 1038 | 1038 |
|
| 1039 |
Default value: ``true``
|
|
| 1039 |
Default value: `true`
|
|
| 1040 | 1040 |
|
| 1041 |
##### <a name="forward_traffic"></a>`forward_traffic` |
|
| 1041 |
##### <a name="-nftables--rules--qemu--forward_traffic"></a>`forward_traffic`
|
|
| 1042 | 1042 |
|
| 1043 | 1043 |
Data type: `Boolean` |
| 1044 | 1044 |
|
| 1045 | 1045 |
Allow forwarded traffic (out all, in related/established) |
| 1046 | 1046 |
generated by the virtual network. |
| 1047 | 1047 |
|
| 1048 |
Default value: ``true``
|
|
| 1048 |
Default value: `true`
|
|
| 1049 | 1049 |
|
| 1050 |
##### <a name="internal_traffic"></a>`internal_traffic` |
|
| 1050 |
##### <a name="-nftables--rules--qemu--internal_traffic"></a>`internal_traffic`
|
|
| 1051 | 1051 |
|
| 1052 | 1052 |
Data type: `Boolean` |
| 1053 | 1053 |
|
| 1054 | 1054 |
Allow guests in the virtual network to talk to each other. |
| 1055 | 1055 |
|
| 1056 |
Default value: ``true``
|
|
| 1056 |
Default value: `true`
|
|
| 1057 | 1057 |
|
| 1058 |
##### <a name="masquerade"></a>`masquerade` |
|
| 1058 |
##### <a name="-nftables--rules--qemu--masquerade"></a>`masquerade`
|
|
| 1059 | 1059 |
|
| 1060 | 1060 |
Data type: `Boolean` |
| 1061 | 1061 |
|
| 1062 | 1062 |
Do NAT masquerade on all IPv4 traffic generated by guests |
| 1063 | 1063 |
to external networks. |
| 1064 | 1064 |
|
| 1065 |
Default value: ``true``
|
|
| 1065 |
Default value: `true`
|
|
| 1066 | 1066 |
|
| 1067 |
### <a name="nftablesrulessamba"></a>`nftables::rules::samba`
|
|
| 1067 |
### <a name="nftables--rules--samba"></a>`nftables::rules::samba`
|
|
| 1068 | 1068 |
|
| 1069 | 1069 |
manage Samba, the suite to allow Windows file sharing on Linux resources. |
| 1070 | 1070 |
|
| ... | ... | |
| 1072 | 1072 |
|
| 1073 | 1073 |
The following parameters are available in the `nftables::rules::samba` class: |
| 1074 | 1074 |
|
| 1075 |
* [`ctdb`](#ctdb) |
|
| 1075 |
* [`ctdb`](#-nftables--rules--samba--ctdb)
|
|
| 1076 | 1076 |
|
| 1077 |
##### <a name="ctdb"></a>`ctdb` |
|
| 1077 |
##### <a name="-nftables--rules--samba--ctdb"></a>`ctdb`
|
|
| 1078 | 1078 |
|
| 1079 | 1079 |
Data type: `Boolean` |
| 1080 | 1080 |
|
| 1081 | 1081 |
Enable ctdb-driven clustered Samba setups. |
| 1082 | 1082 |
|
| 1083 |
Default value: ``false``
|
|
| 1083 |
Default value: `false`
|
|
| 1084 | 1084 |
|
| 1085 |
### <a name="nftablesrulessmtp"></a>`nftables::rules::smtp`
|
|
| 1085 |
### <a name="nftables--rules--smtp"></a>`nftables::rules::smtp`
|
|
| 1086 | 1086 |
|
| 1087 | 1087 |
manage in smtp |
| 1088 | 1088 |
|
| 1089 |
### <a name="nftablesrulessmtp_submission"></a>`nftables::rules::smtp_submission`
|
|
| 1089 |
### <a name="nftables--rules--smtp_submission"></a>`nftables::rules::smtp_submission`
|
|
| 1090 | 1090 |
|
| 1091 | 1091 |
manage in smtp submission |
| 1092 | 1092 |
|
| 1093 |
### <a name="nftablesrulessmtps"></a>`nftables::rules::smtps`
|
|
| 1093 |
### <a name="nftables--rules--smtps"></a>`nftables::rules::smtps`
|
|
| 1094 | 1094 |
|
| 1095 | 1095 |
manage in smtps |
| 1096 | 1096 |
|
| 1097 |
### <a name="nftablesrulesssh"></a>`nftables::rules::ssh`
|
|
| 1097 |
### <a name="nftables--rules--ssh"></a>`nftables::rules::ssh`
|
|
| 1098 | 1098 |
|
| 1099 | 1099 |
manage in ssh |
| 1100 | 1100 |
|
| ... | ... | |
| 1102 | 1102 |
|
| 1103 | 1103 |
The following parameters are available in the `nftables::rules::ssh` class: |
| 1104 | 1104 |
|
| 1105 |
* [`ports`](#ports) |
|
| 1105 |
* [`ports`](#-nftables--rules--ssh--ports)
|
|
| 1106 | 1106 |
|
| 1107 |
##### <a name="ports"></a>`ports` |
|
| 1107 |
##### <a name="-nftables--rules--ssh--ports"></a>`ports`
|
|
| 1108 | 1108 |
|
| 1109 | 1109 |
Data type: `Array[Stdlib::Port,1]` |
| 1110 | 1110 |
|
| ... | ... | |
| 1112 | 1112 |
|
| 1113 | 1113 |
Default value: `[22]` |
| 1114 | 1114 |
|
| 1115 |
### <a name="nftablesrulestor"></a>`nftables::rules::tor`
|
|
| 1115 |
### <a name="nftables--rules--tor"></a>`nftables::rules::tor`
|
|
| 1116 | 1116 |
|
| 1117 | 1117 |
manage in tor |
| 1118 | 1118 |
|
| ... | ... | |
| 1120 | 1120 |
|
| 1121 | 1121 |
The following parameters are available in the `nftables::rules::tor` class: |
| 1122 | 1122 |
|
| 1123 |
* [`ports`](#ports) |
|
| 1123 |
* [`ports`](#-nftables--rules--tor--ports)
|
|
| 1124 | 1124 |
|
| 1125 |
##### <a name="ports"></a>`ports` |
|
| 1125 |
##### <a name="-nftables--rules--tor--ports"></a>`ports`
|
|
| 1126 | 1126 |
|
| 1127 | 1127 |
Data type: `Array[Stdlib::Port,1]` |
| 1128 | 1128 |
|
| ... | ... | |
| 1130 | 1130 |
|
| 1131 | 1131 |
Default value: `[9001]` |
| 1132 | 1132 |
|
| 1133 |
### <a name="nftablesruleswireguard"></a>`nftables::rules::wireguard`
|
|
| 1133 |
### <a name="nftables--rules--wireguard"></a>`nftables::rules::wireguard`
|
|
| 1134 | 1134 |
|
| 1135 | 1135 |
manage in wireguard |
| 1136 | 1136 |
|
| ... | ... | |
| 1138 | 1138 |
|
| 1139 | 1139 |
The following parameters are available in the `nftables::rules::wireguard` class: |
| 1140 | 1140 |
|
| 1141 |
* [`ports`](#ports) |
|
| 1141 |
* [`ports`](#-nftables--rules--wireguard--ports)
|
|
| 1142 | 1142 |
|
| 1143 |
##### <a name="ports"></a>`ports` |
|
| 1143 |
##### <a name="-nftables--rules--wireguard--ports"></a>`ports`
|
|
| 1144 | 1144 |
|
| 1145 | 1145 |
Data type: `Array[Stdlib::Port,1]` |
| 1146 | 1146 |
|
| ... | ... | |
| 1148 | 1148 |
|
| 1149 | 1149 |
Default value: `[51820]` |
| 1150 | 1150 |
|
| 1151 |
### <a name="nftablesservicesdhcpv6_client"></a>`nftables::services::dhcpv6_client`
|
|
| 1151 |
### <a name="nftables--services--dhcpv6_client"></a>`nftables::services::dhcpv6_client`
|
|
| 1152 | 1152 |
|
| 1153 | 1153 |
Allow in and outbound traffic for DHCPv6 server |
| 1154 | 1154 |
|
| 1155 |
### <a name="nftablesservicesopenafs_client"></a>`nftables::services::openafs_client`
|
|
| 1155 |
### <a name="nftables--services--openafs_client"></a>`nftables::services::openafs_client`
|
|
| 1156 | 1156 |
|
| 1157 | 1157 |
Open inbound and outbound ports for an AFS client |
| 1158 | 1158 |
|
| 1159 | 1159 |
## Defined types |
| 1160 | 1160 |
|
| 1161 |
### <a name="nftableschain"></a>`nftables::chain` |
|
| 1161 |
### <a name="nftables--chain"></a>`nftables::chain`
|
|
| 1162 | 1162 |
|
| 1163 | 1163 |
manage a chain |
| 1164 | 1164 |
|
| ... | ... | |
| 1166 | 1166 |
|
| 1167 | 1167 |
The following parameters are available in the `nftables::chain` defined type: |
| 1168 | 1168 |
|
| 1169 |
* [`table`](#table) |
|
| 1170 |
* [`chain`](#chain) |
|
| 1171 |
* [`inject`](#inject) |
|
| 1172 |
* [`inject_iif`](#inject_iif) |
|
| 1173 |
* [`inject_oif`](#inject_oif) |
|
| 1169 |
* [`table`](#-nftables--chain--table)
|
|
| 1170 |
* [`chain`](#-nftables--chain--chain)
|
|
| 1171 |
* [`inject`](#-nftables--chain--inject)
|
|
| 1172 |
* [`inject_iif`](#-nftables--chain--inject_iif)
|
|
| 1173 |
* [`inject_oif`](#-nftables--chain--inject_oif)
|
|
| 1174 | 1174 |
|
| 1175 |
##### <a name="table"></a>`table` |
|
| 1175 |
##### <a name="-nftables--chain--table"></a>`table`
|
|
| 1176 | 1176 |
|
| 1177 | 1177 |
Data type: `Pattern[/^(ip|ip6|inet|netdev|bridge)-[a-zA-Z0-9_]+$/]` |
| 1178 | 1178 |
|
| ... | ... | |
| 1180 | 1180 |
|
| 1181 | 1181 |
Default value: `'inet-filter'` |
| 1182 | 1182 |
|
| 1183 |
##### <a name="chain"></a>`chain` |
|
| 1183 |
##### <a name="-nftables--chain--chain"></a>`chain`
|
|
| 1184 | 1184 |
|
| 1185 | 1185 |
Data type: `Pattern[/^[a-zA-Z0-9_]+$/]` |
| 1186 | 1186 |
|
| ... | ... | |
| 1188 | 1188 |
|
| 1189 | 1189 |
Default value: `$title` |
| 1190 | 1190 |
|
| 1191 |
##### <a name="inject"></a>`inject` |
|
| 1191 |
##### <a name="-nftables--chain--inject"></a>`inject`
|
|
| 1192 | 1192 |
|
| 1193 | 1193 |
Data type: `Optional[Pattern[/^\d\d-[a-zA-Z0-9_]+$/]]` |
| 1194 | 1194 |
|
| 1195 | 1195 |
|
| 1196 | 1196 |
|
| 1197 |
Default value: ``undef``
|
|
| 1197 |
Default value: `undef`
|
|
| 1198 | 1198 |
|
| 1199 |
##### <a name="inject_iif"></a>`inject_iif` |
|
| 1199 |
##### <a name="-nftables--chain--inject_iif"></a>`inject_iif`
|
|
| 1200 | 1200 |
|
| 1201 | 1201 |
Data type: `Optional[String]` |
| 1202 | 1202 |
|
| 1203 | 1203 |
|
| 1204 | 1204 |
|
| 1205 |
Default value: ``undef``
|
|
| 1205 |
Default value: `undef`
|
|
| 1206 | 1206 |
|
| 1207 |
##### <a name="inject_oif"></a>`inject_oif` |
|
| 1207 |
##### <a name="-nftables--chain--inject_oif"></a>`inject_oif`
|
|
| 1208 | 1208 |
|
| 1209 | 1209 |
Data type: `Optional[String]` |
| 1210 | 1210 |
|
| 1211 | 1211 |
|
| 1212 | 1212 |
|
| 1213 |
Default value: ``undef``
|
|
| 1213 |
Default value: `undef`
|
|
| 1214 | 1214 |
|
| 1215 |
### <a name="nftablesconfig"></a>`nftables::config` |
|
| 1215 |
### <a name="nftables--config"></a>`nftables::config`
|
|
| 1216 | 1216 |
|
| 1217 | 1217 |
manage a config snippet |
| 1218 | 1218 |
|
| ... | ... | |
| 1220 | 1220 |
|
| 1221 | 1221 |
The following parameters are available in the `nftables::config` defined type: |
| 1222 | 1222 |
|
| 1223 |
* [`tablespec`](#tablespec) |
|
| 1224 |
* [`content`](#content) |
|
| 1225 |
* [`source`](#source) |
|
| 1226 |
* [`prefix`](#prefix) |
|
| 1223 |
* [`tablespec`](#-nftables--config--tablespec)
|
|
| 1224 |
* [`content`](#-nftables--config--content)
|
|
| 1225 |
* [`source`](#-nftables--config--source)
|
|
| 1226 |
* [`prefix`](#-nftables--config--prefix)
|
|
| 1227 | 1227 |
|
| 1228 |
##### <a name="tablespec"></a>`tablespec` |
|
| 1228 |
##### <a name="-nftables--config--tablespec"></a>`tablespec`
|
|
| 1229 | 1229 |
|
| 1230 | 1230 |
Data type: `Pattern[/^\w+-\w+$/]` |
| 1231 | 1231 |
|
| ... | ... | |
| 1233 | 1233 |
|
| 1234 | 1234 |
Default value: `$title` |
| 1235 | 1235 |
|
| 1236 |
##### <a name="content"></a>`content` |
|
| 1236 |
##### <a name="-nftables--config--content"></a>`content`
|
|
| 1237 | 1237 |
|
| 1238 | 1238 |
Data type: `Optional[String]` |
Formats disponibles : Unified diff