Révision cd2a3cbf
Add rules for QEMU/libvirt guests
| REFERENCE.md | ||
|---|---|---|
| 59 | 59 |
* [`nftables::rules::out::tor`](#nftablesrulesouttor): manage out tor |
| 60 | 60 |
* [`nftables::rules::out::wireguard`](#nftablesrulesoutwireguard): manage out wireguard |
| 61 | 61 |
* [`nftables::rules::puppet`](#nftablesrulespuppet): manage in puppet |
| 62 |
* [`nftables::rules::qemu`](#nftablesrulesqemu): Bridged network configuration for qemu/libvirt |
|
| 62 | 63 |
* [`nftables::rules::samba`](#nftablesrulessamba): manage Samba, the suite to allow Windows file sharing on Linux resources. |
| 63 | 64 |
* [`nftables::rules::smtp`](#nftablesrulessmtp): manage in smtp |
| 64 | 65 |
* [`nftables::rules::smtp_submission`](#nftablesrulessmtp_submission): manage in smtp submission |
| ... | ... | |
| 791 | 792 |
|
| 792 | 793 |
Default value: `[8140]` |
| 793 | 794 |
|
| 795 |
### <a name="nftablesrulesqemu"></a>`nftables::rules::qemu` |
|
| 796 |
|
|
| 797 |
This class configures the typical firewall setup that libvirt |
|
| 798 |
creates. Depending on your requirements you can switch on and off |
|
| 799 |
several aspects, for instance if you don't do DHCP to your guests |
|
| 800 |
you can disable the rules that accept DHCP traffic on the host or if |
|
| 801 |
you don't want your guests to talk to hosts outside you can disable |
|
| 802 |
forwarding and/or masquerading for IPv4 traffic. |
|
| 803 |
|
|
| 804 |
#### Parameters |
|
| 805 |
|
|
| 806 |
The following parameters are available in the `nftables::rules::qemu` class: |
|
| 807 |
|
|
| 808 |
* [`interface`](#interface) |
|
| 809 |
* [`network_v4`](#network_v4) |
|
| 810 |
* [`network_v6`](#network_v6) |
|
| 811 |
* [`dns`](#dns) |
|
| 812 |
* [`dhcpv4`](#dhcpv4) |
|
| 813 |
* [`forward_traffic`](#forward_traffic) |
|
| 814 |
* [`internal_traffic`](#internal_traffic) |
|
| 815 |
* [`masquerade`](#masquerade) |
|
| 816 |
|
|
| 817 |
##### <a name="interface"></a>`interface` |
|
| 818 |
|
|
| 819 |
Data type: `String[1]` |
|
| 820 |
|
|
| 821 |
Interface name used by the bridge. |
|
| 822 |
|
|
| 823 |
Default value: `'virbr0'` |
|
| 824 |
|
|
| 825 |
##### <a name="network_v4"></a>`network_v4` |
|
| 826 |
|
|
| 827 |
Data type: `Stdlib::IP::Address::V4::CIDR` |
|
| 828 |
|
|
| 829 |
The IPv4 network prefix used in the virtual network. |
|
| 830 |
|
|
| 831 |
Default value: `'192.168.122.0/24'` |
|
| 832 |
|
|
| 833 |
##### <a name="network_v6"></a>`network_v6` |
|
| 834 |
|
|
| 835 |
Data type: `Optional[Stdlib::IP::Address::V6::CIDR]` |
|
| 836 |
|
|
| 837 |
The IPv6 network prefix used in the virtual network. |
|
| 838 |
|
|
| 839 |
Default value: ``undef`` |
|
| 840 |
|
|
| 841 |
##### <a name="dns"></a>`dns` |
|
| 842 |
|
|
| 843 |
Data type: `Boolean` |
|
| 844 |
|
|
| 845 |
Allow DNS traffic from the guests to the host. |
|
| 846 |
|
|
| 847 |
Default value: ``true`` |
|
| 848 |
|
|
| 849 |
##### <a name="dhcpv4"></a>`dhcpv4` |
|
| 850 |
|
|
| 851 |
Data type: `Boolean` |
|
| 852 |
|
|
| 853 |
Allow DHCPv4 traffic from the guests to the host. |
|
| 854 |
|
|
| 855 |
Default value: ``true`` |
|
| 856 |
|
|
| 857 |
##### <a name="forward_traffic"></a>`forward_traffic` |
|
| 858 |
|
|
| 859 |
Data type: `Boolean` |
|
| 860 |
|
|
| 861 |
Allow forwarded traffic (out all, in related/established) |
|
| 862 |
generated by the virtual network. |
|
| 863 |
|
|
| 864 |
Default value: ``true`` |
|
| 865 |
|
|
| 866 |
##### <a name="internal_traffic"></a>`internal_traffic` |
|
| 867 |
|
|
| 868 |
Data type: `Boolean` |
|
| 869 |
|
|
| 870 |
Allow guests in the virtual network to talk to each other. |
|
| 871 |
|
|
| 872 |
Default value: ``true`` |
|
| 873 |
|
|
| 874 |
##### <a name="masquerade"></a>`masquerade` |
|
| 875 |
|
|
| 876 |
Data type: `Boolean` |
|
| 877 |
|
|
| 878 |
Do NAT masquerade on all IPv4 traffic generated by guests |
|
| 879 |
to external networks. |
|
| 880 |
|
|
| 881 |
Default value: ``true`` |
|
| 882 |
|
|
| 794 | 883 |
### <a name="nftablesrulessamba"></a>`nftables::rules::samba` |
| 795 | 884 |
|
| 796 | 885 |
manage Samba, the suite to allow Windows file sharing on Linux resources. |
Formats disponibles : Unified diff