Puppet module for ferm https://cgit.fluxo.info/puppet-ferm/atom?h=master 2021-02-16T12:11:59+00:00 2021-02-16T12:11:59+00:00 Kilian Engelhardt kilian.engelhardt@godaddy.com 2021-02-03T20:32:57+00:00 urn:sha1:c8f0e0424490cb5d06785266ac9b4214200a7070 > The specified protocol can be one of tcp, udp, udplite, icmp, icmpv6,esp, > ah, sctp, mh or the special keyword "all", or it can be a numeric value, > representing one of these protocols or a different one. source: https://ipset.netfilter.org/iptables.man.html Also see [0] for Assigned Internet Protocol Numbers. -- [0] https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml 2020-10-06T20:41:45+00:00 Tim Meusel tim@bastelfreak.de 2020-10-06T20:41:45+00:00 urn:sha1:75ab2f7d7ec834976debd66b9874da81a82328e3 2020-06-30T16:05:47+00:00 Thore Bödecker me@foxxx0.de 2020-06-25T15:07:07+00:00 urn:sha1:856eca997158141e084b9e8c2002d7491a4720a1 - implement validations for port ranges - add test cases for these scenarios 2019-09-11T14:01:32+00:00 Thore Bödecker me@foxxx0.de 2019-09-11T14:01:32+00:00 urn:sha1:3d868fb81532d717fd625638781e4663a834260c This enables defining ferm::rule with multiple protocols at once, because using 'all' for $proto does not allow using $dport/$sport. 2019-09-11T11:20:35+00:00 Thore Bödecker me@foxxx0.de 2019-09-03T09:56:58+00:00 urn:sha1:882a45498ddefdfc83ff5b19da723fd0be3acdec Previously it was neither possible to properly define custom chains nor to define rules in tables other than the default filter table. For various legitimate reasons it can be required to define rules in the raw, nat or mangle tables, e.g. to use NOTRACK or to configure DNAT/SNAT/MASQUERADE. Additionally it might come in handy to define custom chains to group certain rules and allow a more efficient evaluation for incoming packets by not cramming all rules into the filter/INPUT chain so that (worst-case) all packets need to traverse and evaluate all rules. I have tried to maintain backwards compatibility and to not change default filenames/paths so that it won't result in leftover obsolete unmaged files from previous versions of this module. In order to improve the naming schema the rule $policy has been renamed to $action, however both parameters are available and optional now, with some sanity checks that require at most one of them and issueing a warning() for users of the now deprecated $policy parameter. All previous tests have been adapted to the changes, a long with an additional set of tests for the new feature. Fixes #61 2019-09-01T10:08:54+00:00 Tim Meusel tim@bastelfreak.de 2019-08-31T18:28:27+00:00 urn:sha1:fc5f400d931c7beafeade383210e92d852a645ff 2019-08-31T17:20:44+00:00 Tim Meusel tim@bastelfreak.de 2019-08-31T17:20:44+00:00 urn:sha1:d932153d5d19a0f20f0eec695f6964cfe509b291 2019-08-31T17:20:04+00:00 Tim Meusel tim@bastelfreak.de 2019-08-31T17:20:04+00:00 urn:sha1:803b802b3fd9c8bb2dbe7ad3cc675ad080946bb1 2019-03-13T15:28:39+00:00 Kilian Engelhardt kilian.engelhardt@gmail.com 2019-03-13T15:28:39+00:00 urn:sha1:76c8ed54ec63b657a1354ce7707c870acd1483de 2018-03-15T16:06:08+00:00 Tim Meusel tim@bastelfreak.de 2017-09-18T13:23:36+00:00 urn:sha1:2d355a4c1baadc761d6b12645d0274da8866f722