diff options
Diffstat (limited to 'roles/network')
-rw-r--r-- | roles/network/nftables/base/defaults/main.yml | 11 | ||||
-rw-r--r-- | roles/network/nftables/base/tasks/main.yml | 12 |
2 files changed, 23 insertions, 0 deletions
diff --git a/roles/network/nftables/base/defaults/main.yml b/roles/network/nftables/base/defaults/main.yml new file mode 100644 index 00000000..95ec9073 --- /dev/null +++ b/roles/network/nftables/base/defaults/main.yml @@ -0,0 +1,11 @@ +--- +nftables_base_rules: {} + +# nftables_base_rules: +# example: | +# table inet global { +# chain input { +# type filter hook input priority filter; policy drop; +# ct state vmap { established: accept, related: accept, invalid: drop } +# } +# } diff --git a/roles/network/nftables/base/tasks/main.yml b/roles/network/nftables/base/tasks/main.yml index 46c7d0b5..3f268681 100644 --- a/roles/network/nftables/base/tasks/main.yml +++ b/roles/network/nftables/base/tasks/main.yml @@ -8,6 +8,18 @@ path: /etc/nftables.d state: directory +- name: generate rules files + loop: "{{ nftables_base_rules | dict2items }}" + loop_control: + label: "{{ item.key }}" + copy: + content: | + # Ansible managed + + {{ item.value }} + dest: "/etc/nftables.d/{{ item.key }}.nft" + notify: reload nftables + - name: generate base nft script copy: content: | |