Convert puppet_nft systemd drop-in unit file to template
WIP: Start adding support for Debian
Auto fill simple table configuration
Remove duplicate flush on reload
When nftables was reloaded a flush was being done both in the systemdreload call and in the nft script itself.
New parameter noflush_tables to selectivly skip flush
Introduces a new structured fact nftables
```yamlnftables: tables: - inet-filter - ip-nat - ip6-nat - inet-f2b-table```
By default the nft script will continue to contain `nft flush ruleset`...
Allow disabling default NAT tables and chains
Reload rules atomically
Background: The unit file for nftables on CentOS 8 contains:
```ExecStart=/sbin/nft -f /etc/sysconfig/nftables.confExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'ExecStop=/sbin/nft flush ruleset```...
Move ICMP stuff to separate classes
Move ct rules from global to INPUT and OUTPUT
Use concat for table conf generation
This way other components of the module will be able to add extra stuffto the table definitions like sets.
Voir les révisions
Formats disponibles : Atom
