root / manifests / init.pp @ cd664666
Historique | Voir | Annoter | Télécharger (1,44 ko)
| 1 | 0ba57c66 | mh | # manage nftables |
|---|---|---|---|
| 2 | be0b08e1 | tr | class nftables ( |
| 3 | Boolean $in_ssh = true, |
||
| 4 | Boolean $out_ntp = true, |
||
| 5 | Boolean $out_dns = true, |
||
| 6 | cd664666 | tr | Boolean $out_http = true, |
| 7 | be0b08e1 | tr | Boolean $out_https = true, |
| 8 | ) {
|
||
| 9 | |||
| 10 | 0ba57c66 | mh | package{'nftables':
|
| 11 | ensure => installed, |
||
| 12 | } -> file_line{
|
||
| 13 | 'enable_nftables': |
||
| 14 | line => 'include "/etc/nftables/puppet.nft"', |
||
| 15 | path => '/etc/sysconfig/nftables.conf', |
||
| 16 | notify => Service['nftables'], |
||
| 17 | } -> file{
|
||
| 18 | default: |
||
| 19 | owner => 'root', |
||
| 20 | group => 'root', |
||
| 21 | mode => '0640'; |
||
| 22 | '/etc/nftables/puppet.nft': |
||
| 23 | source => 'puppet:///modules/nftables/config/puppet.nft'; |
||
| 24 | '/etc/nftables/puppet': |
||
| 25 | ensure => directory, |
||
| 26 | purge => true, |
||
| 27 | force => true, |
||
| 28 | recurse => true; |
||
| 29 | } ~> service{'nftables':
|
||
| 30 | ensure => running, |
||
| 31 | enable => true, |
||
| 32 | } |
||
| 33 | |||
| 34 | nftables::config{
|
||
| 35 | 'filter': |
||
| 36 | source => 'puppet:///modules/nftables/config/puppet-filter.nft'; |
||
| 37 | 'nat': |
||
| 38 | source => 'puppet:///modules/nftables/config/puppet-nat.nft'; |
||
| 39 | } |
||
| 40 | |||
| 41 | nftables::filter::chain{
|
||
| 42 | [ |
||
| 43 | 'forward-default_fwd', |
||
| 44 | 'output-default_out', |
||
| 45 | 'input-default_in', |
||
| 46 | ]:; |
||
| 47 | } |
||
| 48 | be0b08e1 | tr | |
| 49 | # basic ingoing rules |
||
| 50 | if $in_ssh {
|
||
| 51 | include nftables::rules::ssh |
||
| 52 | } |
||
| 53 | |||
| 54 | 0ba57c66 | mh | # basic outgoing rules |
| 55 | be0b08e1 | tr | if $out_ntp {
|
| 56 | include nftables::rules::out::ntp |
||
| 57 | } |
||
| 58 | if $out_dns {
|
||
| 59 | include nftables::rules::out::dns |
||
| 60 | } |
||
| 61 | cd664666 | tr | if $out_http {
|
| 62 | include nftables::rules::out::http |
||
| 63 | } |
||
| 64 | be0b08e1 | tr | if $out_https {
|
| 65 | include nftables::rules::out::https |
||
| 66 | 0ba57c66 | mh | } |
| 67 | } |