feat: Merge rules and tables in one file

This commit is contained in:
pulsar89.5 2023-12-28 17:39:20 +01:00
parent 35d31eb752
commit 1ff5380152
6 changed files with 71 additions and 68 deletions

View File

@ -33,10 +33,8 @@
group: root group: root
mode: u=rw,g=,o= mode: u=rw,g=,o=
src: "{{ role_path }}/templates/rules.conf.j2" src: "{{ role_path }}/templates/rules.conf.j2"
dest: "/srv/nftables/rules_{{ item.filename }}.conf" dest: "/srv/nftables/rules.conf"
loop: "{{ nftables_rules }}" when: nftables_rules | length > 0
loop_control:
label: "{{ item.filename }}"
become: true become: true
notify: Redémarrer nftables.service notify: Redémarrer nftables.service
@ -45,10 +43,8 @@
owner: root owner: root
group: root group: root
mode: u=rw,g=,o= mode: u=rw,g=,o=
src: "{{ role_path }}/templates/tables.conf.j2" src: tables.conf.j2
dest: "/srv/nftables/tables_{{ item.filename }}.conf" dest: /srv/nftables/tables.conf
loop: "{{ nftables_tables }}" when: nftables_tables | length > 0
loop_control:
label: "{{ item.filename }}"
become: true become: true
notify: Redémarrer nftables.service notify: Redémarrer nftables.service

View File

@ -12,6 +12,9 @@
owner: root owner: root
group: root group: root
mode: u=rwx,g=rx,o=rx mode: u=rwx,g=rx,o=rx
state: directory state: "{{ item }}"
path: /srv/nftables path: /srv/nftables
become: true become: true
loop:
- absent
- directory

View File

@ -16,8 +16,8 @@ table inet filter {
# accept neighbour discovery otherwise IPv6 connectivity breaks. # accept neighbour discovery otherwise IPv6 connectivity breaks.
ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert} accept ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert} accept
# include specifics rules # include specific rules
include "/srv/nftables/rules_*.conf" include "/srv/nftables/rules.conf"
# count and drop any other traffic # count and drop any other traffic
counter drop counter drop

View File

@ -1,5 +1,6 @@
# {{ ansible_managed }} # {{ ansible_managed }}
{% for item in nftables_rules %}
{% for rule in item.rules %} # {{ item.comment }}
{{ rule }} {{ item.rules | join('\n') }}
{% endfor %} {% endfor %}

55
templates/table.conf.j2 Normal file
View File

@ -0,0 +1,55 @@
{% if
item.ipv4_rules.prerouting | length > 0
or
item.ipv4_rules.postrouting | length > 0
%}
table ip {{ item.name }} {
{% if item.ipv4_rules.prerouting | length > 0 %}
chain prerouting {
type nat hook prerouting priority 0;
{% for rule in item.ipv4_rules.prerouting %}
{{ rule }}
{% endfor %}
}
{% endif %}
{% if item.ipv4_rules.postrouting | length > 0 %}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
{% for rule in item.ipv4_rules.postrouting %}
{{ rule }}
{% endfor %}
}
{% endif %}
}
{% endif %}
{% if
item.ipv6_rules.prerouting | length > 0
or
item.ipv6_rules.postrouting | length > 0
%}
table ip6 {{ item.name }} {
{% if item.ipv6_rules.prerouting | length > 0 %}
chain prerouting {
type nat hook prerouting priority 0;
{% for rule in item.ipv6_rules.prerouting %}
{{ rule }}
{% endfor %}
}
{% endif %}
{% if item.ipv6_rules.postrouting | length > 0 %}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
{% for rule in item.ipv6_rules.postrouting %}
{{ rule }}
{% endfor %}
}
{% endif %}
}
{% endif %}

View File

@ -1,57 +1,5 @@
# {{ ansible_managed }} # {{ ansible_managed }}
{% for item in nftables_tables %}
{% if {% include "table.conf.j2" %}
item.ipv4_rules.prerouting | length > 0
or
item.ipv4_rules.postrouting | length > 0
%}
table ip {{ item.filename }} {
{% if item.ipv4_rules.prerouting | length > 0 %}
chain prerouting {
type nat hook prerouting priority 0;
{% for rule in item.ipv4_rules.prerouting %}
{{ rule }}
{% endfor %} {% endfor %}
}
{% endif %}
{% if item.ipv4_rules.postrouting | length > 0 %}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
{% for rule in item.ipv4_rules.postrouting %}
{{ rule }}
{% endfor %}
}
{% endif %}
}
{% endif %}
{% if
item.ipv6_rules.prerouting | length > 0
or
item.ipv6_rules.postrouting | length > 0
%}
table ip6 {{ item.filename }} {
{% if item.ipv6_rules.prerouting | length > 0 %}
chain prerouting {
type nat hook prerouting priority 0;
{% for rule in item.ipv6_rules.prerouting %}
{{ rule }}
{% endfor %}
}
{% endif %}
{% if item.ipv6_rules.postrouting | length > 0 %}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
{% for rule in item.ipv6_rules.postrouting %}
{{ rule }}
{% endfor %}
}
{% endif %}
}
{% endif %}