nftables: add more rules

roles/nftables/defaults/main.yaml

@@ -36,35 +36,54 @@ nftables_builtin_sets:
     - flags interval
 
 nftables_input_builtin_rules:
+  '000 policy':
     - type filter hook input priority filter; policy drop;
+  '010 blackhole':
     - ip saddr @blackhole4 drop
     - ip6 saddr @blackhole6 drop
+  '020 related established':
     - ct state established,related accept
     - ct state invalid drop
+  '030 loopback':
     - iifname "lo" accept
+  '040 icmp':
     - icmpv6 type $REQUIRED_ICMPV6_TYPES accept
     - icmpv6 type echo-request accept
     - icmp type echo-request accept
+  '050 tcp accept':
     - tcp dport @tcp_input_accept accept
+  '060 udp accept':
     - udp dport @udp_input_accept accept
+  '999 traceroute':
     # this should be last because these ports could be allowed
     - udp dport $TRACEROUTE_UDP_PORTS reject
 
 nftables_forward_builtin_rules:
+  '000 policy':
     - type filter hook forward priority filter; policy drop;
+  '010 related established':
     - ct state { established, related } accept
 
 nftables_output_builtin_rules:
+  '000 policy':
     - type filter hook output priority filter; policy accept;
+  '010 blackhole':
     - ip daddr @blackhole4 drop
     - ip6 daddr @blackhole6 drop
+  '020 related established':
     - ct state { established, related } accept
 
-# nftables_sets:
+nftables_defines:
-#   {}
+  {} 
-#
+
-# nftables_input_rules:
+nftables_sets:
-#   []
+  {}
-#
+
-# nftables_output_rules:
+nftables_input_rules:
-#   []
+  {}
+
+nftables_forward_rules:
+  {}
+
+nftables_output_rules:
+  {}

roles/nftables/templates/nftables.conf.j2

@@ -1,7 +1,11 @@
+{% set combined_defines = [ nftables_builtin_defines, nftables_defines ] | combine %}
+{% set combined_sets = [ nftables_builtin_sets, nftables_sets ] | combine %}
+{% set combined_input_rules = [ nftables_input_builtin_rules, nftables_input_rules ] | combine %}
+{% set combined_forward_rules = [ nftables_forward_builtin_rules, nftables_forward_rules ] | combine %}
+{% set combined_output_rules = [ nftables_output_builtin_rules, nftables_output_rules ] | combine %}
 table inet filter {
-{% if nftables_builtin_defines is mapping %}
+{% for name, cfg in combined_defines.items() %}
-{%   for name, cfg in nftables_builtin_defines.items() %}
+{%   if cfg is string or cfg is number %}
-{%     if cfg is string %}
   define {{ name }} = {{ cfg }}
 {%  elif cfg is sequence %} 
   define {{ name }} = {
@@ -11,72 +15,39 @@ table inet filter {
   }
 {%   endif %}
 {% endfor %}
-{% endif %}
-{% if nftables_defines is mapping %}
-{%   for name, cfg in nftables_defines.items() %}
-  define {{ name }} = {
-{%     for elem in cfg %}
-    {{ elem }},
-{%     endfor %}
-  }
-{%   endfor %}
-{% endif %}
 
-{% if nftables_builtin_sets is mapping %}
+{% for name, cfg in combined_sets.items() %}
-{%   for name, cfg in nftables_builtin_sets.items() %}
   set {{ name }} { 
 {%   for elem in cfg %}
     {{ elem }}
 {%   endfor %}
   }
 {% endfor %}
-{% endif %}
-{% if nftables_sets is mapping %}
-{%   for name, cfg in nftables_sets.items() %}
-  set {{ name }} { 
-{%     for elem in cfg %}
-    {{ elem }}
-{%     endfor %}
-  }
-{%   endfor %}
-{% endif %}
 
   chain input {
-{% if nftables_input_builtin_rules is sequence %}
+{% for comment, rules in combined_input_rules.items() %}
-{%   for rule in nftables_input_builtin_rules %}
+    # {{ comment }}
+{%   for rule in rules %}
     {{ rule }}
 {%   endfor %}
-{% endif %}
-{% if nftables_input_rules is sequence %}
-{%   for rule in nftables_input_rules %}
-    {{ rule }}
 {% endfor %}
-{% endif %}
   }
 
   chain forward {
-{% if nftables_forward_builtin_rules is sequence %}
+{% for comment, rules in combined_forward_rules.items() %}
-{%   for rule in nftables_forward_builtin_rules %}
+    # {{ comment }}
+{%   for rule in rules %}
     {{ rule }}
 {%   endfor %}
-{% endif %}
-{% if nftables_forward_rules is sequence %}
-{%   for rule in nftables_forward_rules %}
-    {{ rule }}
 {% endfor %}
-{% endif %}
   }
 
   chain output {
-{% if nftables_output_builtin_rules is sequence %}
+{% for comment, rules in combined_output_rules.items() %}
-{%   for rule in nftables_output_builtin_rules %}
+    # {{ comment }}
+{%   for rule in rules %}
     {{ rule }}
 {%   endfor %}
-{% endif %}
-{% if nftables_output_rules is sequence %}
-{%   for rule in nftables_output_rules %}
-    {{ rule }}
 {% endfor %}
-{% endif %}
   }
 }