root / manifests / init.pp @ c8894978
Historique | Voir | Annoter | Télécharger (3,8 ko)
| 1 | 0ba57c66 | mh | # manage nftables |
|---|---|---|---|
| 2 | be0b08e1 | tr | class nftables ( |
| 3 | Boolean $in_ssh = true, |
||
| 4 | Boolean $out_ntp = true, |
||
| 5 | Boolean $out_dns = true, |
||
| 6 | cd664666 | tr | Boolean $out_http = true, |
| 7 | be0b08e1 | tr | Boolean $out_https = true, |
| 8 | ) {
|
||
| 9 | |||
| 10 | 0ba57c66 | mh | package{'nftables':
|
| 11 | ensure => installed, |
||
| 12 | } -> file_line{
|
||
| 13 | 'enable_nftables': |
||
| 14 | line => 'include "/etc/nftables/puppet.nft"', |
||
| 15 | path => '/etc/sysconfig/nftables.conf', |
||
| 16 | notify => Service['nftables'], |
||
| 17 | } -> file{
|
||
| 18 | default: |
||
| 19 | e140adff | tr | owner => 'root', |
| 20 | group => 'root', |
||
| 21 | mode => '0640'; |
||
| 22 | 0ba57c66 | mh | '/etc/nftables/puppet.nft': |
| 23 | 5acb554a | tr | ensure => file, |
| 24 | 0ba57c66 | mh | source => 'puppet:///modules/nftables/config/puppet.nft'; |
| 25 | '/etc/nftables/puppet': |
||
| 26 | ensure => directory, |
||
| 27 | 5acb554a | tr | mode => '0750', |
| 28 | 0ba57c66 | mh | purge => true, |
| 29 | force => true, |
||
| 30 | recurse => true; |
||
| 31 | } ~> service{'nftables':
|
||
| 32 | e140adff | tr | ensure => running, |
| 33 | enable => true, |
||
| 34 | 0ba57c66 | mh | } |
| 35 | |||
| 36 | nftables::config{
|
||
| 37 | 5df9303f | tr | 'inet-filter': |
| 38 | 0ba57c66 | mh | source => 'puppet:///modules/nftables/config/puppet-filter.nft'; |
| 39 | 5933ab8e | tr | 'ip-nat': |
| 40 | source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft'; |
||
| 41 | 0ba57c66 | mh | } |
| 42 | |||
| 43 | 8efbdf9a | tr | nftables::chain{
|
| 44 | 0ba57c66 | mh | [ |
| 45 | 8efbdf9a | tr | 'INPUT', |
| 46 | 'OUTPUT', |
||
| 47 | 'FORWARD', |
||
| 48 | 0ba57c66 | mh | ]:; |
| 49 | } |
||
| 50 | be0b08e1 | tr | |
| 51 | 8efbdf9a | tr | nftables::chain{
|
| 52 | 38a67c59 | tr | [ |
| 53 | 'PREROUTING', |
||
| 54 | 'POSTROUTING', |
||
| 55 | ]: |
||
| 56 | table => 'ip-nat'; |
||
| 57 | } |
||
| 58 | |||
| 59 | nftables::chain{
|
||
| 60 | 8efbdf9a | tr | 'default_in': |
| 61 | inject => '10-INPUT'; |
||
| 62 | 'default_out': |
||
| 63 | inject => '10-OUTPUT'; |
||
| 64 | 'default_fwd': |
||
| 65 | inject => '10-FORWARD'; |
||
| 66 | } |
||
| 67 | |||
| 68 | 38a67c59 | tr | # inet-filter-chain-INPUT |
| 69 | 8efbdf9a | tr | nftables::rule{
|
| 70 | 'INPUT-type': |
||
| 71 | order => '01', |
||
| 72 | content => 'type filter hook input priority 0'; |
||
| 73 | 'INPUT-policy': |
||
| 74 | order => '02', |
||
| 75 | content => 'policy drop'; |
||
| 76 | 'INPUT-lo': |
||
| 77 | order => '03', |
||
| 78 | content => 'iifname lo accept'; |
||
| 79 | 'INPUT-jump_global': |
||
| 80 | order => '04', |
||
| 81 | content => 'jump global'; |
||
| 82 | 'INPUT-log_rejected': |
||
| 83 | order => '98', |
||
| 84 | content => 'log prefix "[nftables] INPUT Rejected: " flags all counter reject with icmpx type port-unreachable'; |
||
| 85 | } |
||
| 86 | |||
| 87 | 38a67c59 | tr | # inet-filter-chain-OUTPUT |
| 88 | 8efbdf9a | tr | nftables::rule{
|
| 89 | 'OUTPUT-type': |
||
| 90 | order => '01', |
||
| 91 | content => 'type filter hook output priority 0'; |
||
| 92 | 'OUTPUT-policy': |
||
| 93 | order => '02', |
||
| 94 | content => 'policy drop'; |
||
| 95 | 'OUTPUT-lo': |
||
| 96 | order => '03', |
||
| 97 | content => 'oifname lo accept'; |
||
| 98 | 'OUTPUT-jump_global': |
||
| 99 | order => '04', |
||
| 100 | content => 'jump global'; |
||
| 101 | 'OUTPUT-log_rejected': |
||
| 102 | order => '98', |
||
| 103 | content => 'log prefix "[nftables] OUTPUT Rejected: " flags all counter reject with icmpx type port-unreachable'; |
||
| 104 | } |
||
| 105 | |||
| 106 | 38a67c59 | tr | # inet-filter-chain-FORWARD |
| 107 | 8efbdf9a | tr | nftables::rule{
|
| 108 | 'FORWARD-type': |
||
| 109 | order => '01', |
||
| 110 | content => 'type filter hook forward priority 0'; |
||
| 111 | 'FORWARD-policy': |
||
| 112 | order => '02', |
||
| 113 | content => 'policy drop'; |
||
| 114 | 'FORWARD-jump_global': |
||
| 115 | order => '03', |
||
| 116 | content => 'jump global'; |
||
| 117 | 'FORWARD-log_rejected': |
||
| 118 | order => '98', |
||
| 119 | content => 'log prefix "[nftables] FORWARD Rejected: " flags all counter reject with icmpx type port-unreachable'; |
||
| 120 | } |
||
| 121 | |||
| 122 | 38a67c59 | tr | # ip-nat-chain-PREROUTING |
| 123 | nftables::rule{
|
||
| 124 | c8894978 | tr | default: |
| 125 | table => 'ip-nat'; |
||
| 126 | 38a67c59 | tr | 'PREROUTING-type': |
| 127 | order => '01', |
||
| 128 | content => 'type nat hook prerouting priority -100'; |
||
| 129 | 'PREROUTING-policy': |
||
| 130 | order => '02', |
||
| 131 | content => 'policy accept'; |
||
| 132 | } |
||
| 133 | |||
| 134 | # ip-nat-chain-POSTROUTING |
||
| 135 | nftables::rule{
|
||
| 136 | c8894978 | tr | default: |
| 137 | table => 'ip-nat'; |
||
| 138 | 38a67c59 | tr | 'POSTROUTING-type': |
| 139 | order => '01', |
||
| 140 | content => 'type nat hook postrouting priority 100'; |
||
| 141 | 'POSTROUTING-policy': |
||
| 142 | order => '02', |
||
| 143 | content => 'policy accept'; |
||
| 144 | } |
||
| 145 | |||
| 146 | be0b08e1 | tr | # basic ingoing rules |
| 147 | if $in_ssh {
|
||
| 148 | include nftables::rules::ssh |
||
| 149 | } |
||
| 150 | |||
| 151 | 0ba57c66 | mh | # basic outgoing rules |
| 152 | be0b08e1 | tr | if $out_ntp {
|
| 153 | 188e569f | tr | include nftables::rules::out::chrony |
| 154 | be0b08e1 | tr | } |
| 155 | if $out_dns {
|
||
| 156 | include nftables::rules::out::dns |
||
| 157 | } |
||
| 158 | cd664666 | tr | if $out_http {
|
| 159 | include nftables::rules::out::http |
||
| 160 | } |
||
| 161 | be0b08e1 | tr | if $out_https {
|
| 162 | include nftables::rules::out::https |
||
| 163 | 0ba57c66 | mh | } |
| 164 | } |