47 lines
1.3 KiB
Django/Jinja
Executable File
47 lines
1.3 KiB
Django/Jinja
Executable File
#jinja2: lstrip_blocks: "True", trim_blocks: "True"
|
|
#!/usr/sbin/nft -f
|
|
# {{ ansible_managed }}
|
|
{% set globalmerged = nft_global_default_rules.copy() %}
|
|
{% set _ = globalmerged.update(nft_global_rules) %}
|
|
{% set _ = globalmerged.update(nft_global_group_rules) %}
|
|
{% if nft_merged_groups and hostvars[inventory_hostname]['nft_combined_rules'].nft_global_group_rules is defined%}
|
|
{% set _ = globalmerged.update(hostvars[inventory_hostname]['nft_combined_rules'].nft_global_group_rules) %}
|
|
{% endif %}
|
|
{% set _ = globalmerged.update(nft_global_host_rules) %}
|
|
|
|
# clean
|
|
flush ruleset
|
|
|
|
include "{{ nft_define_conf_path }}"
|
|
|
|
table inet filter {
|
|
chain global {
|
|
{% for group, rules in globalmerged|dictsort %}
|
|
# {{ group }}
|
|
{% if not rules %}
|
|
# (none)
|
|
{% endif %}
|
|
{% for rule in rules %}
|
|
{{ rule }}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
}
|
|
include "{{ nft_set_conf_path }}"
|
|
include "{{ nft_input_conf_path }}"
|
|
include "{{ nft_output_conf_path }}"
|
|
}
|
|
|
|
{% if nft__nat_table_manage %}
|
|
# Additionnal table for Network Address Translation (NAT)
|
|
table ip nat {
|
|
include "{{ nft_set_conf_path }}"
|
|
include "{{ nft__nat_prerouting_conf_path }}"
|
|
include "{{ nft__nat_postrouting_conf_path }}"
|
|
}
|
|
{% endif %}
|
|
|
|
{% if nft__custom_content|d() %}
|
|
# Custom content from ipr-cnrs.nftables
|
|
{{ nft__custom_content }}
|
|
{% endif %}
|