ansible.nftables/templates/etc/nftables.conf.j2

47 lines
1.3 KiB
Plaintext
Raw Normal View History

#jinja2: lstrip_blocks: "True", trim_blocks: "True"
2017-08-07 13:48:54 +02:00
#!/usr/sbin/nft -f
# {{ ansible_managed }}
{% set globalmerged = nft_global_default_rules.copy() %}
{% set _ = globalmerged.update(nft_global_rules) %}
{% set _ = globalmerged.update(nft_global_group_rules) %}
{% if merged_groups and hostvars[inventory_hostname]['nft_combined_rules'].nft_global_group_rules is defined%}
{% set _ = globalmerged.update(hostvars[inventory_hostname]['nft_combined_rules'].nft_global_group_rules) %}
{% endif %}
{% set _ = globalmerged.update(nft_global_host_rules) %}
2017-08-07 13:48:54 +02:00
# clean
flush ruleset
include "{{ nft_define_conf_path }}"
2017-08-08 12:11:58 +02:00
table inet filter {
chain global {
{% for group, rules in globalmerged|dictsort %}
# {{ group }}
{% if not rules %}
# (none)
{% endif %}
{% for rule in rules %}
{{ rule }}
{% endfor %}
{% endfor %}
}
include "{{ nft_set_conf_path }}"
2017-08-07 17:37:41 +02:00
include "{{ nft_input_conf_path }}"
2017-08-08 15:35:05 +02:00
include "{{ nft_output_conf_path }}"
2017-08-07 13:48:54 +02:00
}
{% if nft__nat_table_manage %}
# Additionnal table for Network Address Translation (NAT)
table ip nat {
2019-04-16 18:57:31 +02:00
include "{{ nft_set_conf_path }}"
include "{{ nft__nat_prerouting_conf_path }}"
include "{{ nft__nat_postrouting_conf_path }}"
}
{% endif %}
{% if nft__custom_content|d() %}
# Custom content from ipr-cnrs.nftables
{{ nft__custom_content }}
{% endif %}