Each type of rules dictionaries will be merged and rules will be applied in the alphabetical order of the keys (the reason to use 000 to 999 as prefix). So:
* **nft_*_default_rules**: Define default rules for all nodes. You can define it in `group_vars/all`.
* **nft_*_group_rules**: Can add rules and override those defined by **nft_*_default_rules**. You can define it in `group_vars/webservers`.
* **nft_*_host_rules**: Can add rules and override those define by **nft_*_default_rules** and **nft_*_group_rules**. You can define it in `host_vars/www.local.domain`.
`defaults/main.yml`:
``` yml
# rules
nft_global_default_rules:
000 state management:
- ct state established,related accept
- ct state invalid drop
nft_global_group_rules: {}
nft_global_host_rules: {}
```
Those default will generate the following configuration:
```
#!/usr/sbin/nft -f
# Ansible managed
# clean
flush ruleset
table inet firewall {
chain global {
# 000 state management
ct state established,related accept
ct state invalid drop
}
chain input {
type filter hook input priority 0;
jump global
}
chain output {
type filter hook output priority 0;
jump global
}
}
```
And you get the same result by displaying the ruleset on the host: `$ nft list ruleset`:
```
table inet firewall {
chain global {
ct state established,related accept
ct state invalid drop
}
chain input {
type filter hook input priority 0; policy accept;
jump global
}
chain output {
type filter hook output priority 0; policy accept;
This source code comes from our [Gogs instance][nftables source] and the [Github repo][nftables github] exist just to be able to send the role to Ansible Galaxy…
But feel free to send issue/PR here :)
Thanks to this [hook][gogs to github hook], Github automatically got updates from our [Gogs instance][nftables source] :)
## License
[WTFPL][wtfpl website]
## Author Information
Jérémy Gardais
* Source: [on IPR's Gogs][nftables source]
* [IPR][ipr website] (Institut de Physique de Rennes)
[gogs to github hook]: https://stackoverflow.com/a/21998477
