Generate Nat table rules files

defaults/main.yml

@@ -337,6 +337,105 @@ nft_output_conf_path: '{{ nft_conf_dir_path }}/filter-output.nft'
 nft_output_conf_content: 'etc/nftables.d/filter-output.nft.j2'
                                                                    # ]]]
                                                                    # ]]]
+# ip nat table rules [[[
+# ---------------------------
+#
+# All these rules will be set up in an ip table in order to perform some
+# Network Address Translation (NAT).
+
+# .. envvar:: nft__nat_table_manage [[[
+#
+# If the nat table should be managed ? Possible options are :
+#
+# ``False``
+#   Default. The nat table is not managed and rules will not be added.
+#
+# ``True``
+#   Add the pre and postrouting rules that follow.
+nft__nat_table_manage: False
+                                                                   # ]]]
+# .. envvar:: nft__nat_default_prerouting_rules [[[
+#
+# List of prerouting rules to configure for all hosts inherited from this role.
+nft__nat_default_prerouting_rules:
+  000 policy:
+    - type nat hook prerouting priority 0;
+                                                                   # ]]]
+# .. envvar:: nft__nat_prerouting_rules [[[
+#
+# List of prerouting rules to configure for all hosts in the Ansible inventory.
+nft__nat_prerouting_rules: {}
+                                                                   # ]]]
+# .. envvar:: nft__nat_group_prerouting_rules [[[
+#
+# List of prerouting rules to configure for hosts in specific
+# Ansible inventory group.
+nft__nat_group_prerouting_rules: {}
+                                                                   # ]]]
+# .. envvar:: nft__nat_host_prerouting_rules [[[
+#
+# List of prerouting rules to configure for specific hosts
+# in the Ansible inventory.
+nft__nat_host_prerouting_rules: {}
+                                                                   # ]]]
+# .. envvar:: nft__nat_prerouting_conf_path [[[
+#
+# Path to the prerouting rules file for the nat table to include in the main
+# configuration file in order to use the previous defined lists.
+#
+# Should include the '{{ nft_conf_dir_path }}' var or be an absolut path.
+nft__nat_prerouting_conf_path: '{{ nft_conf_dir_path }}/nat-prerouting.nft'
+                                                                   # ]]]
+# .. envvar:: nft__nat_prerouting_conf_content [[[
+#
+# Template used to provide the previous prerouting rules file.
+#
+# Must be a relative path from default/ directory of this role or from your
+# Ansible inventory directory.
+nft__nat_prerouting_conf_content: 'etc/nftables.d/nat-prerouting.nft.j2'
+                                                                   # ]]]
+
+# .. envvar:: nft__nat_default_postrouting_rules [[[
+#
+# List of postrouting rules to configure for all hosts inherited from this role.
+nft__nat_default_postrouting_rules:
+  000 policy:
+    - type nat hook postrouting priority 100;
+                                                                   # ]]]
+# .. envvar:: nft__nat_postrouting_rules [[[
+#
+# List of postrouting rules to configure for all hosts in the Ansible inventory.
+nft__nat_postrouting_rules: {}
+                                                                   # ]]]
+# .. envvar:: nft__nat_group_postrouting_rules [[[
+#
+# List of postrouting rules to configure for hosts in specific
+# Ansible inventory group.
+nft__nat_group_postrouting_rules: {}
+                                                                   # ]]]
+# .. envvar:: nft__nat_host_postrouting_rules [[[
+#
+# List of postrouting rules to configure for specific hosts
+# in the Ansible inventory.
+nft__nat_host_postrouting_rules: {}
+                                                                   # ]]]
+# .. envvar:: nft__nat_postrouting_conf_path [[[
+#
+# Path to the postrouting rules file for the nat table to include in the main
+# configuration file in order to use the previous defined lists.
+#
+# Should include the '{{ nft_conf_dir_path }}' var or be an absolut path.
+nft__nat_postrouting_conf_path: '{{ nft_conf_dir_path }}/nat-postrouting.nft'
+                                                                   # ]]]
+# .. envvar:: nft__nat_postrouting_conf_content [[[
+#
+# Template used to provide the previous postrouting rules file.
+#
+# Must be a relative path from default/ directory of this role or from your
+# Ansible inventory directory.
+nft__nat_postrouting_conf_content: 'etc/nftables.d/nat-postrouting.nft.j2'
+                                                                   # ]]]
+                                                                   # ]]]
 # Service management [[[
 # ----------------------
 

tasks/main.yml

@@ -96,6 +96,31 @@
   notify: ['Restart nftables service']
   when: nft_enabled|bool
 
+# Nat table content [[[1
+- name: Nat table - generate prerouting rules file
+  template:
+    src: "{{ nft__nat_prerouting_conf_content }}"
+    dest: "{{ nft__nat_prerouting_conf_path }}"
+    owner: root
+    group: root
+    mode: 0755
+    backup: yes
+  notify: ['Restart nftables service']
+  when: (nft_enabled|bool and
+         nft__nat_table_manage|bool)
+
+- name: Nat table - generate postrouting rules file
+  template:
+    src: "{{ nft__nat_postrouting_conf_content }}"
+    dest: "{{ nft__nat_postrouting_conf_path }}"
+    owner: root
+    group: root
+    mode: 0755
+    backup: yes
+  notify: ['Restart nftables service']
+  when: (nft_enabled|bool and
+         nft__nat_table_manage|bool)
+
 # Manage service [[[1
 - name: Install Debian systemd service unit
   template:

templates/etc/nftables.d/nat-postrouting.nft.j2

@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+{% set postroutingmerged = nft__nat_default_postrouting_rules.copy() %}
+{% set _ = postroutingmerged.update(nft__nat_postrouting_rules) %}
+{% set _ = postroutingmerged.update(nft__nat_group_postrouting_rules) %}
+{% set _ = postroutingmerged.update(nft__nat_host_postrouting_rules) %}
+
+chain postrouting {
+{% for group, rules in postroutingmerged|dictsort  %}
+	# {{ group }}
+{% if not rules %}
+	# (none)
+{% endif %}
+{% for rule in rules %}
+	{{ rule }}
+{% endfor %}
+{% endfor %}
+}

templates/etc/nftables.d/nat-prerouting.nft.j2

@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+{% set preroutingmerged = nft__nat_default_prerouting_rules.copy() %}
+{% set _ = preroutingmerged.update(nft__nat_prerouting_rules) %}
+{% set _ = preroutingmerged.update(nft__nat_group_prerouting_rules) %}
+{% set _ = preroutingmerged.update(nft__nat_host_prerouting_rules) %}
+
+chain prerouting {
+{% for group, rules in preroutingmerged|dictsort  %}
+	# {{ group }}
+{% if not rules %}
+	# (none)
+{% endif %}
+{% for rule in rules %}
+	{{ rule }}
+{% endfor %}
+{% endfor %}
+}