ansible.nftables/defaults/main.yml

108 lines
2.9 KiB
YAML
Raw Normal View History

2017-08-07 12:09:13 +02:00
---
# defaults file for nftables
# packages
2017-08-07 13:48:54 +02:00
nft_pkg_manage: true
nft_pkg_state: 'installed'
nft_old_pkg_list: 'iptables'
nft_old_pkg_state: 'absent'
nft_old_pkg_manage: true
2017-08-07 13:48:54 +02:00
2017-08-09 14:27:07 +02:00
# files
nft_conf_dir_path: '/etc/nftables.d'
2017-08-07 13:48:54 +02:00
nft_main_conf_path: '/etc/nftables.conf'
nft_main_conf_content: 'etc/nftables.conf.j2'
nft_input_conf_path: '{{ nft_conf_dir_path }}/filter-input.nft'
nft_input_conf_content: 'etc/nftables.d/filter-input.nft.j2'
nft_output_conf_path: '{{ nft_conf_dir_path }}/filter-output.nft'
nft_output_conf_content: 'etc/nftables.d/filter-output.nft.j2'
nft_define_conf_path: '{{ nft_conf_dir_path }}/defines.nft'
2017-08-08 12:11:58 +02:00
nft_define_conf_content: 'etc/nftables.d/defines.nft.j2'
nft_set_conf_path: '{{ nft_conf_dir_path }}/sets.nft'
nft_set_conf_content: 'etc/nftables.d/sets.nft.j2'
# rules
nft_global_default_rules:
005 state management:
- ct state established,related accept
- ct state invalid drop
nft_global_group_rules: {}
nft_global_host_rules: {}
2017-08-08 14:53:29 +02:00
2017-08-07 17:41:03 +02:00
nft_input_default_rules:
000 policy:
- type filter hook input priority 0; policy drop;
005 global:
2017-08-07 17:41:03 +02:00
- jump global
010 drop unwanted:
- ip daddr @blackhole counter drop
2017-08-09 11:05:00 +02:00
015 localhost:
- iif lo accept
200 input udp accepted:
- udp dport @input_udp_accept ct state new accept
210 input tcp accepted:
- tcp dport @input_tcp_accept ct state new accept
2017-08-07 17:41:03 +02:00
nft_input_group_rules: {}
nft_input_host_rules: {}
2017-08-08 15:35:05 +02:00
nft_output_default_rules:
000 policy:
- type filter hook output priority 0; policy drop;
2017-08-08 15:35:05 +02:00
005 global:
- jump global
2017-08-09 11:05:00 +02:00
015 localhost:
- oif lo accept
2017-08-09 16:04:54 +02:00
050 icmp:
- ip protocol icmp accept
200 output udp accepted:
- udp dport @output_udp_accept ct state new accept
210 output tcp accepted:
- tcp dport @output_tcp_accept ct state new accept
2017-08-08 15:35:05 +02:00
nft_output_group_rules: {}
nft_output_host_rules: {}
2017-08-08 12:11:58 +02:00
# define nft vars
nft_define_default:
broadcast and multicast:
desc: 'broadcast and multicast'
name: badcast_addr
value: '{ 255.255.255.255, 224.0.0.1, 224.0.0.251 }'
input tcp accepted:
name: input_tcp_accept
value: '{ ssh }'
input udp accepted:
name: input_udp_accept
value: 'none'
output tcp accepted:
name: output_tcp_accept
2017-08-11 13:46:50 +02:00
value: '{ http, https, hkp }'
output udp accepted:
name: output_udp_accept
value: '{ bootps, domain, ntp }'
2017-08-08 12:11:58 +02:00
nft_define_group: {}
nft_define_host: {}
2017-08-08 14:53:29 +02:00
# sets and maps
nft_set_default:
blackhole:
- type ipv4_addr;
- elements = $badcast_addr
input_tcp_accept:
- type inet_service; flags interval;
- elements = $input_tcp_accept
input_udp_accept:
- type inet_service; flags interval;
output_tcp_accept:
- type inet_service; flags interval;
- elements = $output_tcp_accept
output_udp_accept:
- type inet_service; flags interval;
- elements = $output_udp_accept
nft_set_group: {}
nft_set_host: {}
2017-08-08 12:11:58 +02:00
# service
nft_service_manage: true
nft_service_name: 'nftables'
2017-08-09 14:27:07 +02:00
nft_service_enabled: true