https://github.com/pimvh/nftables
Ansible role to configure nftables
https://github.com/pimvh/nftables
ansible firewall molecule-tested nftables role
Last synced: about 2 months ago
JSON representation
Ansible role to configure nftables
- Host: GitHub
- URL: https://github.com/pimvh/nftables
- Owner: pimvh
- License: gpl-3.0
- Created: 2022-06-19T13:53:15.000Z (about 4 years ago)
- Default Branch: main
- Last Pushed: 2024-05-20T18:51:04.000Z (about 2 years ago)
- Last Synced: 2025-01-21T06:09:45.422Z (over 1 year ago)
- Topics: ansible, firewall, molecule-tested, nftables, role
- Language: Python
- Homepage:
- Size: 104 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Requirements
1. Ansible installed:
```
sudo apt install python3
python3 -m ensurepip --upgrade
pip3 install ansible
```
## Required variables
Review the variables as shown in defaults.
You can add a firewall definition to the variables for your host (../host_vars/[host_name].yaml), group of hosts (../group_vars/[group_name].yaml) using the following structure (see molecule.default.vars/test.yaml for an example):
```
# this variable point to the rules that are pushed to the remote host
# it is a dict of tables, with chain, with rules, see molecule/default/vars/test.yaml
nftables_ruleset:
# keys of this become tables
# they must be:
# firewall family and name, e.g."
"inet firewall":
# description of the table
comment: "firewall of device"
chains:
# name of the respective chain
input:
# name of the variable from nftables_rules
# that you would like to put in this chain
- input_hook
- valid_connections
- ...
# another table with the same structure
# valid families are things like inet, inet6, netdev, and inet,
# see nftables docs for the full reference
"inet foo":
# the potential rules are defined under `nftables_rules`
# every rule has two attributes:
# -> def: the definition of the rules or set of rules in valid nftables syntax
# -> depends_on: optional list of dependencies of variables from nftables_variables
# see molecule/default/vars/test.yaml for an example
nftables_rules:
input_hook: >
type filter hook input priority 0; policy drop;
valid_connections:
def: |
ct state established, related accept
ct state invalid drop
new_connections:
def: |
ct state new accept
# these are the variable definition, which are included with depends_on
# make sure the keys match
# see molecule/default/vars/test.yaml for an example
nftables_variables:
tcp_ports:
comment: tcp ports configuration
def: |
{% if nftables_open_tcp_ports_global %}define OPEN_TCP_PORTS = { {{ nftables_open_tcp_ports_global | join(",") }} }{% endif +%}
{% if nftables_open_tcp_ports_local %}define LOCAL_OPEN_TCP_PORTS = { {{ nftables_open_tcp_ports_local | join(",") }} }{% endif +%}
{% if nftables_open_tcp_ports_vpn %}define VPN_TCP_PORTS = { {{ nftables_open_tcp_ports_vpn | join(",") }} }{% endif +%}
...
```
The ansible playbook will validate whether the correct variables are passed to the role using an argument_spec.
# Example playbook
Minimal (assuming you passed variables elsewhere):
```
hosts:
- foo
roles:
- pimvh.nftables
```
# TLDR - What will happen if I run this
- validate whether rules/some other variables are defined
- install nftables, and python interface
- create required nftable tables
- create dynamic tables as empty tables
- create an empty blocklist
- copy a nftables template to nftables directory
- edit nftables service to point to our new main file
- create script to reload firewall, which dumps tables outside of our control to files, and reloads the firewall after
- when nftables_abuseip_api_key is defined, add a script to pull the blocklist using their api, and make that a systemd service
- enable nftable service when requested
- uninstall iptables when requested
# Future Improvements
- Simply structure of rules that needs to be passed
- Improve argument_specs for `nftables_variables` and `nftables_ruleset`