Ability to set base chains

[AlexSamad]

Rhel8

I would like to remove the drop invalid.
From previous experience - restarting (iptables) via services also cleared connection tracking which made every packet invalid

But I would still like more control of those base chains (INPUT/OUTPUT/FORWARD). Not sure how to do that with the current config

[nbarrientos]

Hi @AlexSamad

You can always set nftables::in_out_conntrack and nftables::fwd_conntrack to false and create the conntrack-related rules that you consider more appropriate for your use case using nftables::rule.

[AlexSamad]

Hi Yes , but for example when i select all_out to false you put in default rules. What you have is good for somebody who doesn't want to create a framework of their own. for example how to get rid of all of the default chains and where there connect.

…

On Sun, 23 May 2021 at 18:15, Nacho Barrientos ***@***.***> wrote: Hi @AlexSamad <https://github.com/AlexSamad> You can always set nftables::in_out_conntrack <https://github.com/voxpupuli/puppet-nftables/blob/master/REFERENCE.md#in_out_conntrack> and nftables::fwd_conntrack <https://github.com/voxpupuli/puppet-nftables/blob/master/REFERENCE.md#fwd_conntrack> to false and create the conntrack-related rules that you consider more appropriate for your use case using nftables::rule <https://github.com/voxpupuli/puppet-nftables/blob/master/REFERENCE.md#nftablesrule> . — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#95 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKBAYZPAXBF56UJSNVIV5TTPC2QVANCNFSM45LDPOQA> .

[nbarrientos]

If I understand correctly what you'd like to achieve, the module would have to be patched to put the statement that includes inet_filter behind a parameter. That should give you a clear canvas allowing you to define your own tables, chains and rules using the types provided by the module.

The default skeleton we're currently shipping is skinny enough to cover many use cases so we should probably continue with the same default. That said, I personally don't see any problem in allowing to optionally have an even more lightweight set of defaults.

I'll let the other devs comment though, perhaps I'm not understanding you correctly.

[AlexSamad]

Hi Exactly, or what i was thinking if you can pass in a resource to replace your epp file or a config resource. So right now you default to a file. if that can come from a config option even that would be all thats needed For example - the CT statements you link est/related with ct invalid drop I want est/related but not invalid drop. Plus I don't want the empty default chains - people might use them Any not a show stopper thinking for me I had to do a lot of work around to work with your skeleton for the tables. the other stuff is awesome. A

…

On Tue, 25 May 2021 at 07:30, Nacho Barrientos ***@***.***> wrote: If I understand correctly what you'd like to achieve, the module would have to be patched to put the statement that includes inet_filter <https://github.com/voxpupuli/puppet-nftables/blob/master/manifests/init.pp#L163> behind a parameter. That should give you a clear canvas allowing you to define your own tables, chains and rules using the types provided by the module. The default skeleton we're currently shipping is skinny enough to cover many use cases so we should probably continue with the same default. That said, I personally don't see any problem in allowing to optionally have an even more lightweight set of defaults. I'll let the other devs comment though, perhaps I'm not understanding you correctly. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#95 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKBAY5PASIZHGG7DYAKCHLTPLAQNANCNFSM45LDPOQA> .

[AlexSamad]

Hi
Another example I have a vendor app - just moved from rhel7 to rhel8 and it wants the tables/chains setup in a certain way - mimicking iptables - INPUT/FORWARD/OUTPUT etc.

Can't really do it with your module. I would really like to use your code for managing files and testing before implementing.
it would just be nice to not have any chains/tables setup.

Thanks

[nbarrientos]

Ok. Putting include inet_filter behind a parameter (default true) should cover your use case. Comments? @duritong @traylenator @keachi

[duritong]

As long as the default doesn't change, ok for me.

[AlexSamad]

Yeah think that works work. Maybe. Thinking .. have different defaults that can be set. So yours and maybe a default that makes it look like iptables. A

…

On Mon, 31 May 2021, 05:39 duritong, ***@***.***> wrote: As long as the default doesn't change, ok for me. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#95 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKBAY2ARTRPFKMLSRULWXTTQKIAXANCNFSM45LDPOQA> .