# Reference
+
<!-- DO NOT EDIT: This document was generated by Puppet Strings -->
## Table of Contents
-**Classes**
+### Classes
-_Public Classes_
+#### Public Classes
* [`ferm`](#ferm): This class manages ferm installation and rule generation on modern linux systems
-_Private Classes_
+#### Private Classes
* `ferm::config`: This class handles the configuration file. Avoid modifying private classes.
* `ferm::install`: This class handles the configuration file. Avoid modifying private classes.
* `ferm::service`: This class handles the configuration file. Avoid modifying private classes.
-**Defined types**
+### Defined types
* [`ferm::chain`](#fermchain): This defined resource manages ferm/iptables chains
* [`ferm::ipset`](#fermipset): a defined resource that can match for ipsets at the top of a chain. This is a per-chain resource. You cannot mix IPv4 and IPv6 sets.
* [`ferm::rule`](#fermrule): This defined resource manages a single rule in a specific chain
-**Data types**
+### Data types
* [`Ferm::Actions`](#fermactions): a list of allowed actions for a rule
* [`Ferm::Policies`](#fermpolicies): a list of allowed policies for a chain
+* [`Ferm::Port`](#fermport): ferm port-spec
* [`Ferm::Protocols`](#fermprotocols): a list of allowed protocolls to match
* [`Ferm::Tables`](#fermtables): a list of available tables
## Classes
-### ferm
+### `ferm`
This class manages ferm installation and rule generation on modern linux systems
Disable/Enable the management of the ferm daemon
-Default value: `false`
+Default value: ``false``
##### `manage_configfile`
Disable/Enable the management of the ferm default config
-Default value: `false`
+Default value: ``false``
##### `manage_initfile`
Disable/Enable the management of the ferm init script for RedHat-based OS
-Default value: `false`
+Default value: ``false``
##### `configfile`
Enable/Disable the generation of conntrack rules for the FORWARD chain
-Default value: `true`
+Default value: ``true``
##### `output_disable_conntrack`
Enable/Disable the generation of conntrack rules for the OUTPUT chain
-Default value: `true`
+Default value: ``true``
##### `input_disable_conntrack`
Enable/Disable the generation of conntrack rules for the INPUT chain
-Default value: `false`
+Default value: ``false``
##### `forward_policy`
Default policy for the FORWARD chain
-Default value: 'DROP'
+Default value: `'DROP'`
##### `output_policy`
Default policy for the OUTPUT chain
-Default value: 'ACCEPT'
+Default value: `'ACCEPT'`
##### `input_policy`
Default policy for the INPUT chain
-Default value: 'DROP'
+Default value: `'DROP'`
##### `input_drop_invalid_packets_with_conntrack`
Enable/Disable the `mod conntrack ctstate INVALID DROP` statement. Only works if `$disable_conntrack` is `false`. You can set this to false if your policy is DROP. This only effects the INPUT chain.
-Default value: `false`
+Default value: ``false``
##### `rules`
A hash that holds all data for ferm::rule
-Default value: {}
+Default value: `{}`
##### `chains`
A hash that holds all data for ferm::chain
-Default value: {}
+Default value: `{}`
##### `forward_log_dropped_packets`
Enable/Disable logging in the FORWARD chain of packets to the kernel log, if no explicit chain matched
-Default value: `false`
+Default value: ``false``
##### `output_log_dropped_packets`
Enable/Disable logging in the OUTPUT chain of packets to the kernel log, if no explicit chain matched
-Default value: `false`
+Default value: ``false``
##### `input_log_dropped_packets`
Enable/Disable logging in the INPUT chain of packets to the kernel log, if no explicit chain matched
-Default value: `false`
+Default value: ``false``
##### `ip_versions`
Set list of versions of ip we want ot use.
-Default value: ['ip','ip6']
+Default value: `['ip','ip6']`
##### `preserve_chains_in_tables`
Hash with table:chains[] to use ferm @preserve for (since ferm v2.4)
Example: {'nat' => ['PREROUTING', 'POSTROUTING']}
-Default value: {}
+Default value: `{}`
##### `install_method`
method used to install ferm
-Default value: 'package'
+Default value: `'package'`
##### `vcsrepo`
git repository where ferm sources are hosted
-Default value: 'https://github.com/MaxKellermann/ferm.git'
+Default value: `'https://github.com/MaxKellermann/ferm.git'`
##### `vcstag`
git tag used when install_method is vcsrepo
-Default value: 'v2.5.1'
+Default value: `'v2.5.1'`
## Defined types
-### ferm::chain
+### `ferm::chain`
This defined resource manages ferm/iptables chains
Disable/Enable usage of conntrack. By default, we enable conntrack only for the filter INPUT chain
-Default value: `true`
+Default value: ``true``
##### `drop_invalid_packets_with_conntrack`
Enable/Disable the `mod conntrack ctstate INVALID DROP` statement. Only works if `$disable_conntrack` is `false` in this chain. You can set this to false if your policy is DROP.
-Default value: `false`
+Default value: ``false``
##### `log_dropped_packets`
Enable/Disable logging of packets to the kernel log, if no explicit chain matched
-Default value: `false`
+Default value: ``false``
##### `policy`
Set the default policy for CHAIN (works only for builtin chains)
Allowed values: (ACCEPT|DROP) (see Ferm::Policies type)
-Default value: `undef`
+Default value: ``undef``
##### `chain`
Name of the chain that should be managed
Allowed values: String[1]
-Default value: $name
+Default value: `$name`
##### `table`
Select the target table (filter/raw/mangle/nat)
Allowed values: (filter|raw|mangle|nat) (see Ferm::Tables type)
-Default value: 'filter'
+Default value: `'filter'`
##### `ip_versions`
Set list of versions of ip we want ot use.
-Default value: $ferm::ip_versions
+Default value: `$ferm::ip_versions`
##### `content`
Data type: `Optional[String[1]]`
+custom string that will be written into th chain file
+Default value: ``undef``
-Default value: `undef`
-
-### ferm::ipset
+### `ferm::ipset`
a defined resource that can match for ipsets at the top of a chain. This is a per-chain resource. You cannot mix IPv4 and IPv6 sets.
* **See also**
-http://ferm.foo-projects.org/download/2.1/ferm.html#set
+ * http://ferm.foo-projects.org/download/2.1/ferm.html#set
#### Examples
name of the chain we want to apply those rules to. The name of the defined resource will be used as default value for this.
-Default value: $name
+Default value: `$name`
##### `table`
name of the table where we want to apply this. Defaults to `filter` because that's the most common usecase.
-Default value: 'filter'
+Default value: `'filter'`
##### `ip_version`
sadly, ip sets are version specific. You cannot mix IPv4 and IPv6 addresses. Because of this you need to provide the version.
-Default value: 'ip'
+Default value: `'ip'`
##### `prepend_to_chain`
By default, ipset rules are added to the top of the chain. Set this to false to append them to the end instead.
-Default value: `true`
+Default value: ``true``
-### ferm::rule
+### `ferm::rule`
This defined resource manages a single rule in a specific chain
A comment that will be added to the ferm config and to ip{,6}tables
-Default value: $name
+Default value: `$name`
##### `action`
Default value: undef
Allowed values: (RETURN|ACCEPT|DROP|REJECT|NOTRACK|LOG|MARK|DNAT|SNAT|MASQUERADE|REDIRECT|String[1])
-Default value: `undef`
+Default value: ``undef``
##### `policy`
Default value: undef
Allowed values: (RETURN|ACCEPT|DROP|REJECT|NOTRACK|LOG|MARK|DNAT|SNAT|MASQUERADE|REDIRECT|String[1])
-Default value: `undef`
+Default value: ``undef``
##### `dport`
-Data type: `Optional[Variant[Stdlib::Port,Array[Stdlib::Port]]]`
+Data type: `Optional[Ferm::Port]`
The destination port, can be a single port number as integer or an Array of integers (which will then use the multiport matcher)
-Default value: `undef`
+Default value: ``undef``
##### `sport`
-Data type: `Optional[Variant[Stdlib::Port,Array[Stdlib::Port]]]`
+Data type: `Optional[Ferm::Port]`
The source port, can be a single port number as integer or an Array of integers (which will then use the multiport matcher)
-Default value: `undef`
+Default value: ``undef``
##### `saddr`
The source address we want to match
-Default value: `undef`
+Default value: ``undef``
##### `daddr`
The destination address we want to match
-Default value: `undef`
+Default value: ``undef``
##### `proto_options`
Optional parameters that will be passed to the protocol (for example to match specific ICMP types)
-Default value: `undef`
+Default value: ``undef``
##### `interface`
an Optional interface where this rule should be applied
-Default value: `undef`
+Default value: ``undef``
##### `ensure`
Set the rule to present or absent
-Default value: 'present'
+Default value: `'present'`
##### `table`
Default value: filter
Allowed values: (filter|raw|mangle|nat) (see Ferm::Tables type)
-Default value: 'filter'
+Default value: `'filter'`
## Data types
-### Ferm::Actions
+### `Ferm::Actions`
As you can also *jump* to other chains, each chain-name is also a valid action/target
Alias of `Variant[Enum['RETURN', 'ACCEPT', 'DROP', 'REJECT', 'NOTRACK', 'LOG', 'MARK', 'DNAT', 'SNAT', 'MASQUERADE', 'REDIRECT'], String[1]]`
-### Ferm::Policies
+### `Ferm::Policies`
a list of allowed policies for a chain
Alias of `Enum['ACCEPT', 'DROP']`
-### Ferm::Protocols
+### `Ferm::Port`
+
+allowed variants:
+-----------------
++ single Integer port
++ Array of Integers (creates a multiport matcher)
++ ferm range port-spec (pair of colon-separated integer, assumes 0 if first is omitted)
+
+Alias of `Variant[Stdlib::Port, Array[Stdlib::Port], Pattern['^\d*:\d+$']]`
+
+### `Ferm::Protocols`
a list of allowed protocolls to match
Alias of `Variant[Enum['icmp', 'tcp', 'udp', 'udplite', 'icmpv6', 'esp', 'ah', 'sctp', 'mh', 'all'], Array[Enum['icmp', 'tcp', 'udp', 'udplite', 'icmpv6', 'esp', 'ah', 'sctp', 'mh', 'all']]]`
-### Ferm::Tables
+### `Ferm::Tables`
a list of available tables
projects / puppet-ferm.git / commitdiff