Infrastructure/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(roles/security): added redirect rules to nftables template

Browse Source
This commit is contained in:
ITQ
2026-07-21 00:29:54 +03:00
parent 607a3c353c
commit 4036c8b221
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/security/templates/nftables.conf.j2
+6
View File
@@ -198,12 +198,14 @@ table inet ansible_filter {
{% if dnat_rules | length > 0 %} {% if dnat_rules | length > 0 %}
# Accept forwarded traffic for DNAT destinations (needed if forward policy != accept) # Accept forwarded traffic for DNAT destinations (needed if forward policy != accept)
{% for rule in dnat_rules %} {% for rule in dnat_rules %}
{% if rule.redirect is not defined %}
{% set proto = rule.proto | default('tcp') %} {% set proto = rule.proto | default('tcp') %}
{% set comment = ' comment "DNAT fwd: ' + rule.comment + '"' if rule.comment is defined else '' %} {% set comment = ' comment "DNAT fwd: ' + rule.comment + '"' if rule.comment is defined else '' %}
{% set dest_parts = rule.dest.split(':') %} {% set dest_parts = rule.dest.split(':') %}
{% set dest_ip = dest_parts[0] %} {% set dest_ip = dest_parts[0] %}
{% set dest_port = dest_parts[1] if dest_parts | length > 1 else rule.port | string %} {% set dest_port = dest_parts[1] if dest_parts | length > 1 else rule.port | string %}
ip daddr {{ dest_ip }} {{ proto }} dport {{ dest_port }} accept{{ comment }} ip daddr {{ dest_ip }} {{ proto }} dport {{ dest_port }} accept{{ comment }}
{% endif %}
{% endfor %} {% endfor %}
{% endif %} {% endif %}
@@ -247,7 +249,11 @@ table ip ansible_nat {
{% set _ = dnat_match.append('ip saddr ' + rule.source) %} {% set _ = dnat_match.append('ip saddr ' + rule.source) %}
{% endif %} {% endif %}
{% set _ = dnat_match.append(proto + ' dport ' + rule.port | string) %} {% set _ = dnat_match.append(proto + ' dport ' + rule.port | string) %}
{% if rule.redirect is defined %}
{{ dnat_match | join(' ') }} redirect to :{{ rule.redirect }}{{ comment }}
{% else %}
{{ dnat_match | join(' ') }} dnat to {{ rule.dest }}{{ comment }} {{ dnat_match | join(' ') }} dnat to {{ rule.dest }}{{ comment }}
{% endif %}
{% endfor %} {% endfor %}
} }