Puppet Class: nftables::ip_nat

Inherits:
nftables
Defined in:
manifests/ip_nat.pp

Overview

manage basic chains in table ip nat



2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'manifests/ip_nat.pp', line 2

class nftables::ip_nat inherits nftables {
  nftables::config {
    "ip-${nftables::nat_table_name}":
      prefix => '';
    "ip6-${nftables::nat_table_name}":
      prefix => '';
  }

  nftables::chain {
    [
      'PREROUTING',
      'POSTROUTING',
    ]:
      table => "ip-${nftables::nat_table_name}";
  }

  nftables::chain {
    [
      'PREROUTING6',
      'POSTROUTING6',
    ]:
      table => "ip6-${nftables::nat_table_name}";
  }

  # ip-nat-chain-PREROUTING
  nftables::rule {
    'PREROUTING-type':
      table   => "ip-${nftables::nat_table_name}",
      order   => '01',
      content => 'type nat hook prerouting priority -100';
    'PREROUTING-policy':
      table   => "ip-${nftables::nat_table_name}",
      order   => '02',
      content => 'policy accept';
    'PREROUTING6-type':
      table   => "ip6-${nftables::nat_table_name}",
      order   => '01',
      content => 'type nat hook prerouting priority -100';
    'PREROUTING6-policy':
      table   => "ip6-${nftables::nat_table_name}",
      order   => '02',
      content => 'policy accept';
  }

  # ip-nat-chain-POSTROUTING
  nftables::rule {
    'POSTROUTING-type':
      table   => "ip-${nftables::nat_table_name}",
      order   => '01',
      content => 'type nat hook postrouting priority 100';
    'POSTROUTING-policy':
      table   => "ip-${nftables::nat_table_name}",
      order   => '02',
      content => 'policy accept';
    'POSTROUTING6-type':
      table   => "ip6-${nftables::nat_table_name}",
      order   => '01',
      content => 'type nat hook postrouting priority 100';
    'POSTROUTING6-policy':
      table   => "ip6-${nftables::nat_table_name}",
      order   => '02',
      content => 'policy accept';
  }
}