the-nine-worlds/ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

More generic interface list in nftables

Browse Source
This commit is contained in:
Wojciech Kozlowski 2023-04-08 09:43:55 +02:00
parent e91babde35
commit 29d2e3b9c4
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
system/base/nftables/defaults/main.yml
View File

@ -1,3 +1,4 @@
--- ---
system_base_interfaces_iifname: []
system_base_additional_tcp_ports: [] system_base_additional_tcp_ports: []
system_base_udp_ports: [] system_base_udp_ports: []

6
system/base/nftables/templates/nftables.conf.j2
View File

@ -10,9 +10,11 @@ table inet filter {
# Accept any localhost traffic. # Accept any localhost traffic.
iif lo accept; iif lo accept;
# Accept any libvirt traffic. {% if system_base_interfaces_iifname %}
iifname virbr0 accept; # Accept any traffic on these interfaces.
iifname { {{ system_base_interfaces_iifname | join(", ") }} } accept;
{% endif %}
# Accept traffic originated from us. # Accept traffic originated from us.
ct state established,related accept; ct state established,related accept;