{"id":23727749,"url":"https://github.com/voxpupuli/puppet-nftables","last_synced_at":"2025-12-29T13:45:48.039Z","repository":{"id":40255383,"uuid":"303098662","full_name":"voxpupuli/puppet-nftables","owner":"voxpupuli","description":"Puppet Module to manage nftables firewall rules.","archived":false,"fork":false,"pushed_at":"2025-12-02T13:48:16.000Z","size":782,"stargazers_count":13,"open_issues_count":13,"forks_count":35,"subscribers_count":39,"default_branch":"master","last_synced_at":"2025-12-05T06:47:29.606Z","etag":null,"topics":["archlinux-puppet-module","centos-puppet-module","debian-puppet-module","firewall","hacktoberfest","linux-puppet-module","nftables","oraclelinux-puppet-module","puppet","redhat-puppet-module"],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/voxpupuli.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"vox-pupuli","github":"voxpupuli"}},"created_at":"2020-10-11T10:50:06.000Z","updated_at":"2025-12-02T13:48:19.000Z","dependencies_parsed_at":"2023-11-09T13:01:54.101Z","dependency_job_id":"5ee2c59c-453e-459f-a236-8b4dfa76fd0d","html_url":"https://github.com/voxpupuli/puppet-nftables","commit_stats":{"total_commits":412,"total_committers":36,"mean_commits":"11.444444444444445","dds":0.7839805825242718,"last_synced_commit":"02d6e88a43c02732259f32cdfd2ce3f31304547b"},"previous_names":[],"tags_count":28,"template":false,"template_full_name":null,"purl":"pkg:github/voxpupuli/puppet-nftables","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-nftables","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-nftables/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-nftables/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-nftables/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/voxpupuli","download_url":"https://codeload.github.com/voxpupuli/puppet-nftables/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-nftables/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27670528,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-11T02:00:11.302Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["archlinux-puppet-module","centos-puppet-module","debian-puppet-module","firewall","hacktoberfest","linux-puppet-module","nftables","oraclelinux-puppet-module","puppet","redhat-puppet-module"],"created_at":"2024-12-31T01:29:57.786Z","updated_at":"2025-12-11T21:38:50.407Z","avatar_url":"https://github.com/voxpupuli.png","language":"Ruby","funding_links":["https://opencollective.com/vox-pupuli","https://github.com/sponsors/voxpupuli"],"categories":[],"sub_categories":[],"readme":"# nftables puppet module\n\n[![Puppet Forge](https://img.shields.io/puppetforge/v/puppet/nftables.svg)](https://forge.puppetlabs.com/puppet/nftables)\n[![Puppet Forge - downloads](https://img.shields.io/puppetforge/dt/puppet/nftables.svg)](https://forge.puppetlabs.com/puppet/nftables)\n[![puppetmodule.info docs](http://www.puppetmodule.info/images/badge.png)](http://www.puppetmodule.info/m/puppet-nftables)\n[![Apache-2.0 License](https://img.shields.io/github/license/voxpupuli/puppet-nftables.svg)](LICENSE)\n\nThis module manages an opinionated nftables configuration.\n\nBy default it sets up a firewall that drops every connection, except\noutbound ICMP, DNS, NTP, HTTP, and HTTPS, and inbound ICMP and SSH\ntraffic:\n\n```puppet\ninclude nftables\n```\n\nThis can be overridden using parameters, for example, this allows all\noutbound traffic:\n\n```puppet\nclass { 'nftables':\n  out_all =\u003e true,\n}\n```\n\nThere are also pre-built rules for specific services, for example this\nwill allow a web server to serve traffic over HTTPS:\n\n```puppet\ninclude nftables\ninclude nftables::rules::https\n```\n\nNote that the module conflicts with the `firewalld` system and will\nstop it in Puppet runs.\n\n## Configuration\n\nThe main configuration file loaded by the nftables service\nwill be `files/config/puppet.nft`, all other files created\nby that module go into `files/config/puppet` and will also\nbe purged if not managed anymore.\n\nThe main configuration file includes dedicated files for\nthe filter and NAT tables, as well as processes any\n`custom-*.nft` files before hand.\n\nThe filter and NAT tables both have all the master chains\n(`INPUT`, `OUTPUT`, `FORWARD` in case of filter and `PREROUTING`\nand `POSTROUTING` in case of NAT) configured, to which you\ncan hook in your own chains that can contain specific\nrules.\n\nAll filter masterchains drop by default.\nBy default we have a set of `default_MASTERCHAIN` chains\nconfigured to which you can easily add your custom rules.\n\nFor specific needs you can add your own chain.\n\nThere is a global chain, that defines the default behavior\nfor all masterchains. This chain is empty by default.\n\n`INPUT` and `OUTPUT` to the loopback device is allowed by\ndefault, though you could restrict it later.\n\nOn the other hand, if you don't want any of the default tables, chains\nand rules created by the module, you can set `nftables::inet_filter`\nand/or `nftables::nat` to `false` and build your whole nftables\nconfiguration from scratch by using the building blocks provided by\nthis module. Look at `nftables::inet_filter` for inspiration.\n\n## Rules Validation\n\nInitially puppet deploys all configuration to\n`/etc/nftables/puppet-preflight/` and\n`/etc/nftables/puppet-preflight.nft`. This is validated with\n`nft -c -I /etc/nftables/puppet-preflight/ -f /etc/nftables/puppet-preflight.nft`.\nIf and only if successful the configuration will be copied to\nthe real locations before the service is reloaded.\n\n## Un-managed rules\n\nBy default, rules added manually by the administrator to the in-memory\nruleset will be left untouched. However,\n`nftables::purge_unmanaged_rules` can be set to `true` to revert this\nbehaviour and force a reload of the ruleset during the Puppet run if\nnon-managed changes are detected.\n\n## Basic types\n\n### nftables::config\n\nManages a raw file in `/etc/nftables/puppet/${name}.nft`\n\nUse this for any custom table files.\n\n### nftables::chain\n\nPrepares a chain file as a `concat` file to which you will\nbe able to add dedicated rules through `nftables::rule`.\n\nThe name must be unique for all chains. The inject\nparameter can be used to directly add a jump to a\nmasterchain. inject must follow the pattern\n`ORDER-MASTERCHAIN`, where order references a 2-digit\nnumber which defines the rule order (by default use e.g. 20)\nand masterchain references the chain to hook in the new\nchain. It's possible to specify the in-interface name and\nout-interface name for the inject rule.\n\n### nftables::rule\n\nA simple way to add rules to any chain. The name must be:\n`CHAIN_NAME-rulename`, where CHAIN_NAME refers to your\nchain and an arbitrary name for your rule.\nThe rule will be a `concat::fragment` to the chain\n`CHAIN_NAME`.\n\nYou can define the order by using the `order` param.\n\nBefore defining your own rule, take a look to the list of ready-to-use rules\navailable in the\n[REFERENCE](https://github.com/voxpupuli/puppet-nftables/blob/master/REFERENCE.md),\nsomebody might have encapsulated a rule definition for you already.\n\n### nftables::set\n\nAdds a named set to a given table. It allows composing the\nset using individual parameters but also takes raw input\nvia the content and source parameters.\n\n### nftables::simplerule\n\nAllows expressing firewall rules without having to use nftables's language by\nadding an abstraction layer a-la-Firewall. It's rather limited how far you can\ngo so if you need rather complex rules or you can speak nftables it's\nrecommended to use `nftables::rule` directly.\n\n## Facts\n\nOne structured fact `nftables` is available\n\n```\n{\n  tables =\u003e [\n    \"bridge-filter\",\n    \"bridge-nat\",\n    \"inet-firewalld\",\n    \"ip-firewalld\",\n    \"ip6-firewalld\"\n  ],\n  version =\u003e \"0.9.3\"\n}\n```\n\n* `nftables.version` is the version of the nft command from `nft --version`.\n* `nftables.tables` is the list of tables installed on the machine from `nft list tables`.\n\n## Editor goodies\n\nIf you're using Emacs there are some snippets for\n[Yasnippet](https://github.com/joaotavora/yasnippet) available\n[here](https://github.com/nbarrientos/dotfiles/tree/master/.emacs.d/snippets/puppet-mode)\nthat could make your life easier when using the module. This is third\nparty configuration that's only included here for reference so changes\nin the interfaces exposed by this module are not guaranteed to be\nautomatically applied there.\n\n## Development\n\nThis module relies on CI testing. To ensure the tests and documentation is complete.\n\nThe following steps are a blueprint for the necessary work to add a new rule to the module:\n\n1. add a new class for the new rule (there are enough examples)\n2. document class and parameters\n3. Add a spec test for the new rule to `spec/classes/rules`\n4. add the rule to `spec/acceptance/all_rules_spec.rb`\n5. update the reference with `bundle exec rake strings:generate:reference`\n6. commit, push and open a PR\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-nftables","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvoxpupuli%2Fpuppet-nftables","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-nftables/lists"}