- - -

Defined Type: ferm::chain

Defined in:: - manifests/chain.pp -

- -

Overview

defined resource which creates all rules for one chain

- -

Parameters:

- - policy - - - (Ferm::Policies) - - - - — -
Set the default policy for a CHAIN
-
- -
- - disable_conntrack - - - (Boolean) - - - - — -
disable/enable usage of conntrack
-
- -
- - chain - - - (Ferm::Chains) - - - (defaults to: $name) - - - — -
name of the chain that should be managed
-
- -

- - -

- - - - - -

-
-
-5
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27

# File 'manifests/chain.pp', line 5
-
-define ferm::chain (
-  Ferm::Policies $policy,
-  Boolean $disable_conntrack,
-  Ferm::Chains $chain = $name,
-) {
-
-  # concat resource for the chain
-  $filename = downcase($chain)
-  concat{"/etc/ferm.d/chains/${chain}.conf":
-    ensure  => 'present',
-  }
-
-  concat::fragment{"${chain}-policy":
-    target  => "/etc/ferm.d/chains/${chain}.conf",
-    content => epp(
-      "${module_name}/ferm_chain_header.conf.epp", {
-        'policy'            => $policy,
-        'disable_conntrack' => $disable_conntrack,
-      }
-    ),
-    order   => '01',
-  }
-}

- - - -

- - -

Defined Type: ferm::rule

Defined in:: - manifests/rule.pp -

- -

Overview

- -

Parameters:

- - chain - - - (Ferm::Chains) - - - -
- - policy - - - (Ferm::Policies) - - - -
- - proto - - - (Ferm::Protocols) - - - -
- - comment - - - (String) - - - (defaults to: $name) - - -
- - dport - - - (Optional[Variant[Integer,String]]) - - - (defaults to: undef) - - -
- - sport - - - (Optional[Variant[Integer,String]]) - - - (defaults to: undef) - - -
- - saddr - - - (Optional[String]) - - - (defaults to: undef) - - -
- - daddr - - - (Optional[String]) - - - (defaults to: undef) - - -
- - ensure - - - (Enum['absent','present']) - - - (defaults to: 'present') - - -

- - -

- - - - - -

-
-
-1
-2
-3
-4
-5
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39

# File 'manifests/rule.pp', line 1
-
-define ferm::rule (
-  Ferm::Chains $chain,
-  Ferm::Policies $policy,
-  Ferm::Protocols $proto,
-  String $comment = $name,
-  Optional[Variant[Integer,String]] $dport = undef,
-  Optional[Variant[Integer,String]] $sport = undef,
-  Optional[String] $saddr = undef,
-  Optional[String] $daddr = undef,
-  Enum['absent','present'] $ensure = 'present',
-){
-  $proto_real = "proto ${proto}"
-
-  $dport_real = $dport ? {
-    undef   => '',
-    default => "dport ${dport}",
-  }
-  $sport_real = $sport ? {
-    undef   => '',
-    default => "sport ${sport}",
-  }
-  $saddr_real = $saddr ? {
-    undef   => '',
-    default => "saddr @ipfilter(${saddr})",
-  }
-  $daddr_real = $daddr ? {
-    undef =>  '',
-    default => "daddr @ipfilter(${daddr})"
-  }
-  $comment_real = "mod comment comment '${comment}'"
-
-  $rule = squeeze("${comment_real} ${proto_real} ${dport_real} ${sport_real} ${daddr_real} ${saddr_real} ${policy};", ' ')
-  if $ensure == 'present' {
-    concat::fragment{"${chain}-${name}":
-      target  => "/etc/ferm.d/chains/${chain}.conf",
-      content => "${rule}\n",
-    }
-  }
-}

- - - -