{"id":21129597,"url":"https://github.com/pimvh/nftables","last_synced_at":"2026-05-19T00:41:05.954Z","repository":{"id":151277684,"uuid":"505123892","full_name":"pimvh/nftables","owner":"pimvh","description":"Ansible role to configure nftables","archived":false,"fork":false,"pushed_at":"2024-05-20T18:51:04.000Z","size":106,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-21T06:09:45.422Z","etag":null,"topics":["ansible","firewall","molecule-tested","nftables","role"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pimvh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-19T13:53:15.000Z","updated_at":"2024-12-10T08:27:05.000Z","dependencies_parsed_at":"2024-03-02T15:26:00.971Z","dependency_job_id":"c57fd57e-3fd2-4bf0-831d-e359557f90c7","html_url":"https://github.com/pimvh/nftables","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pimvh%2Fnftables","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pimvh%2Fnftables/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pimvh%2Fnftables/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pimvh%2Fnftables/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pimvh","download_url":"https://codeload.github.com/pimvh/nftables/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243573491,"owners_count":20312883,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","firewall","molecule-tested","nftables","role"],"created_at":"2024-11-20T05:26:00.626Z","updated_at":"2026-05-19T00:41:05.900Z","avatar_url":"https://github.com/pimvh.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Molecule test](https://github.com/pimvh/nftables/actions/workflows/test.yaml/badge.svg)\n# Requirements\n\n1. Ansible installed:\n\n```\nsudo apt install python3\npython3 -m ensurepip --upgrade\npip3 install ansible\n```\n\n## Required variables\n\nReview the variables as shown in defaults.\n\nYou can add a firewall definition to the variables for your host (../host_vars/[host_name].yaml), group of hosts (../group_vars/[group_name].yaml) using the following structure (see molecule.default.vars/test.yaml for an example):\n\n```\n# this variable point to the rules that are pushed to the remote host\n# it is a dict of tables, with chain, with rules, see molecule/default/vars/test.yaml\nnftables_ruleset:\n  # keys of this become tables\n  # they must be:\n  # firewall family and name, e.g.\"\n  \"inet firewall\":\n\n    # description of the table\n    comment: \"firewall of device\"\n\n    chains:\n\n      # name of the respective chain\n      input:\n        # name of the variable from nftables_rules\n        # that you would like to put in this chain\n        - input_hook\n        - valid_connections\n        - ...\n\n  # another table with the same structure\n  # valid families are things like inet, inet6, netdev, and inet,\n  # see nftables docs for the full reference\n  \"inet foo\":\n\n# the potential rules are defined under `nftables_rules`\n# every rule has two attributes:\n# -\u003e def: the definition of the rules or set of rules in valid nftables syntax\n# -\u003e depends_on: optional list of dependencies of variables from nftables_variables\n# see molecule/default/vars/test.yaml for an example\n\nnftables_rules:\n  input_hook: \u003e\n    type filter hook input priority 0; policy drop;\n  valid_connections:\n    def: |\n        ct state established, related accept\n        ct state invalid drop\n\n  new_connections:\n    def: |\n        ct state new accept\n\n\n# these are the variable definition, which are included with depends_on\n# make sure the keys match\n# see molecule/default/vars/test.yaml for an example\nnftables_variables:\n\n  tcp_ports:\n    comment: tcp ports configuration\n    def: |\n      {% if nftables_open_tcp_ports_global %}define OPEN_TCP_PORTS = { {{ nftables_open_tcp_ports_global | join(\",\") }} }{% endif +%}\n      {% if nftables_open_tcp_ports_local %}define LOCAL_OPEN_TCP_PORTS = { {{ nftables_open_tcp_ports_local | join(\",\") }} }{% endif +%}\n      {% if nftables_open_tcp_ports_vpn %}define VPN_TCP_PORTS = { {{ nftables_open_tcp_ports_vpn | join(\",\") }} }{% endif +%}\n\n  ...\n\n```\n\nThe ansible playbook will validate whether the correct variables are passed to the role using an argument_spec.\n\n# Example playbook\n\nMinimal (assuming you passed variables elsewhere):\n\n```\nhosts:\n  - foo\nroles:\n  - pimvh.nftables\n\n```\n\n# TLDR - What will happen if I run this\n\n- validate whether rules/some other variables are defined\n- install nftables, and python interface\n- create required nftable tables\n- create dynamic tables as empty tables\n- create an empty blocklist\n- copy a nftables template to nftables directory\n- edit nftables service to point to our new main file\n- create script to reload firewall, which dumps tables outside of our control to files, and reloads the firewall after\n- when nftables_abuseip_api_key is defined, add a script to pull the blocklist using their api, and make that a systemd service\n- enable nftable service when requested\n- uninstall iptables when requested\n\n# Future Improvements\n\n- Simply structure of rules that needs to be passed\n- Improve argument_specs for `nftables_variables` and `nftables_ruleset`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpimvh%2Fnftables","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpimvh%2Fnftables","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpimvh%2Fnftables/lists"}