## Classes
-### `ferm`
+### <a name="ferm"></a>`ferm`
This class manages ferm installation and rule generation on modern linux systems
#### Parameters
-The following parameters are available in the `ferm` class.
-
-##### `manage_service`
+The following parameters are available in the `ferm` class:
+
+* [`manage_service`](#manage_service)
+* [`manage_configfile`](#manage_configfile)
+* [`configfile`](#configfile)
+* [`configdirectory`](#configdirectory)
+* [`forward_disable_conntrack`](#forward_disable_conntrack)
+* [`output_disable_conntrack`](#output_disable_conntrack)
+* [`input_disable_conntrack`](#input_disable_conntrack)
+* [`forward_policy`](#forward_policy)
+* [`output_policy`](#output_policy)
+* [`input_policy`](#input_policy)
+* [`input_drop_invalid_packets_with_conntrack`](#input_drop_invalid_packets_with_conntrack)
+* [`rules`](#rules)
+* [`chains`](#chains)
+* [`forward_log_dropped_packets`](#forward_log_dropped_packets)
+* [`output_log_dropped_packets`](#output_log_dropped_packets)
+* [`input_log_dropped_packets`](#input_log_dropped_packets)
+* [`ip_versions`](#ip_versions)
+* [`preserve_chains_in_tables`](#preserve_chains_in_tables)
+* [`install_method`](#install_method)
+* [`package_ensure`](#package_ensure)
+* [`vcsrepo`](#vcsrepo)
+* [`vcstag`](#vcstag)
+
+##### <a name="manage_service"></a>`manage_service`
Data type: `Boolean`
Default value: ``false``
-##### `manage_configfile`
+##### <a name="manage_configfile"></a>`manage_configfile`
Data type: `Boolean`
Default value: ``false``
-##### `configfile`
+##### <a name="configfile"></a>`configfile`
Data type: `Stdlib::Absolutepath`
Path to the config file
-##### `configdirectory`
+##### <a name="configdirectory"></a>`configdirectory`
Data type: `Stdlib::Absolutepath`
Path to the directory where the module stores ferm configuration files
-##### `forward_disable_conntrack`
+##### <a name="forward_disable_conntrack"></a>`forward_disable_conntrack`
Data type: `Boolean`
Default value: ``true``
-##### `output_disable_conntrack`
+##### <a name="output_disable_conntrack"></a>`output_disable_conntrack`
Data type: `Boolean`
Default value: ``true``
-##### `input_disable_conntrack`
+##### <a name="input_disable_conntrack"></a>`input_disable_conntrack`
Data type: `Boolean`
Default value: ``false``
-##### `forward_policy`
+##### <a name="forward_policy"></a>`forward_policy`
Data type: `Ferm::Policies`
Default value: `'DROP'`
-##### `output_policy`
+##### <a name="output_policy"></a>`output_policy`
Data type: `Ferm::Policies`
Default value: `'ACCEPT'`
-##### `input_policy`
+##### <a name="input_policy"></a>`input_policy`
Data type: `Ferm::Policies`
Default value: `'DROP'`
-##### `input_drop_invalid_packets_with_conntrack`
+##### <a name="input_drop_invalid_packets_with_conntrack"></a>`input_drop_invalid_packets_with_conntrack`
Data type: `Boolean`
Default value: ``false``
-##### `rules`
+##### <a name="rules"></a>`rules`
Data type: `Hash`
Default value: `{}`
-##### `chains`
+##### <a name="chains"></a>`chains`
Data type: `Hash`
Default value: `{}`
-##### `forward_log_dropped_packets`
+##### <a name="forward_log_dropped_packets"></a>`forward_log_dropped_packets`
Data type: `Boolean`
Default value: ``false``
-##### `output_log_dropped_packets`
+##### <a name="output_log_dropped_packets"></a>`output_log_dropped_packets`
Data type: `Boolean`
Default value: ``false``
-##### `input_log_dropped_packets`
+##### <a name="input_log_dropped_packets"></a>`input_log_dropped_packets`
Data type: `Boolean`
Default value: ``false``
-##### `ip_versions`
+##### <a name="ip_versions"></a>`ip_versions`
Data type: `Array[Enum['ip','ip6']]`
Default value: `['ip','ip6']`
-##### `preserve_chains_in_tables`
+##### <a name="preserve_chains_in_tables"></a>`preserve_chains_in_tables`
Data type: `Hash[String[1],Array[String[1]]]`
Default value: `{}`
-##### `install_method`
+##### <a name="install_method"></a>`install_method`
Data type: `Enum['package','vcsrepo']`
Default value: `'package'`
-##### `vcsrepo`
+##### <a name="package_ensure"></a>`package_ensure`
+
+Data type: `Enum['installed', 'latest', 'absent']`
+
+sets the ensure parameter for the package resource
+
+Default value: `'latest'`
+
+##### <a name="vcsrepo"></a>`vcsrepo`
Data type: `Stdlib::HTTPSUrl`
Default value: `'https://github.com/MaxKellermann/ferm.git'`
-##### `vcstag`
+##### <a name="vcstag"></a>`vcstag`
Data type: `String[1]`
## Defined types
-### `ferm::chain`
+### <a name="fermchain"></a>`ferm::chain`
This defined resource manages ferm/iptables chains
#### Parameters
-The following parameters are available in the `ferm::chain` defined type.
+The following parameters are available in the `ferm::chain` defined type:
+
+* [`disable_conntrack`](#disable_conntrack)
+* [`drop_invalid_packets_with_conntrack`](#drop_invalid_packets_with_conntrack)
+* [`log_dropped_packets`](#log_dropped_packets)
+* [`policy`](#policy)
+* [`chain`](#chain)
+* [`table`](#table)
+* [`ip_versions`](#ip_versions)
+* [`content`](#content)
-##### `disable_conntrack`
+##### <a name="disable_conntrack"></a>`disable_conntrack`
Data type: `Boolean`
Default value: ``true``
-##### `drop_invalid_packets_with_conntrack`
+##### <a name="drop_invalid_packets_with_conntrack"></a>`drop_invalid_packets_with_conntrack`
Data type: `Boolean`
Default value: ``false``
-##### `log_dropped_packets`
+##### <a name="log_dropped_packets"></a>`log_dropped_packets`
Data type: `Boolean`
Default value: ``false``
-##### `policy`
+##### <a name="policy"></a>`policy`
Data type: `Optional[Ferm::Policies]`
Default value: ``undef``
-##### `chain`
+##### <a name="chain"></a>`chain`
Data type: `String[1]`
Default value: `$name`
-##### `table`
+##### <a name="table"></a>`table`
Data type: `Ferm::Tables`
Default value: `'filter'`
-##### `ip_versions`
+##### <a name="ip_versions"></a>`ip_versions`
Data type: `Array[Enum['ip', 'ip6']]`
Default value: `$ferm::ip_versions`
-##### `content`
+##### <a name="content"></a>`content`
Data type: `Optional[String[1]]`
Default value: ``undef``
-### `ferm::ipset`
+### <a name="fermipset"></a>`ferm::ipset`
a defined resource that can match for ipsets at the top of a chain. This is a per-chain resource. You cannot mix IPv4 and IPv6 sets.
#### Parameters
-The following parameters are available in the `ferm::ipset` defined type.
+The following parameters are available in the `ferm::ipset` defined type:
-##### `sets`
+* [`sets`](#sets)
+* [`chain`](#chain)
+* [`table`](#table)
+* [`ip_version`](#ip_version)
+* [`prepend_to_chain`](#prepend_to_chain)
+
+##### <a name="sets"></a>`sets`
Data type: `Hash[String[1], Ferm::Actions]`
A hash with multiple sets. For each hash you can provide an action like `DROP` or `ACCEPT`.
-##### `chain`
+##### <a name="chain"></a>`chain`
Data type: `String[1]`
Default value: `$name`
-##### `table`
+##### <a name="table"></a>`table`
Data type: `Ferm::Tables`
Default value: `'filter'`
-##### `ip_version`
+##### <a name="ip_version"></a>`ip_version`
Data type: `Enum['ip','ip6']`
Default value: `'ip'`
-##### `prepend_to_chain`
+##### <a name="prepend_to_chain"></a>`prepend_to_chain`
Data type: `Boolean`
Default value: ``true``
-### `ferm::rule`
+### <a name="fermrule"></a>`ferm::rule`
This defined resource manages a single rule in a specific chain
#### Parameters
-The following parameters are available in the `ferm::rule` defined type.
+The following parameters are available in the `ferm::rule` defined type:
+
+* [`chain`](#chain)
+* [`proto`](#proto)
+* [`comment`](#comment)
+* [`action`](#action)
+* [`policy`](#policy)
+* [`dport`](#dport)
+* [`sport`](#sport)
+* [`saddr`](#saddr)
+* [`daddr`](#daddr)
+* [`proto_options`](#proto_options)
+* [`interface`](#interface)
+* [`ensure`](#ensure)
+* [`table`](#table)
-##### `chain`
+##### <a name="chain"></a>`chain`
Data type: `String[1]`
Configure the chain where we want to add the rule
-##### `proto`
+##### <a name="proto"></a>`proto`
Data type: `Ferm::Protocols`
Which protocol do we want to match, typically UDP or TCP
-##### `comment`
+##### <a name="comment"></a>`comment`
Data type: `String`
Default value: `$name`
-##### `action`
+##### <a name="action"></a>`action`
Data type: `Optional[Ferm::Actions]`
Default value: ``undef``
-##### `policy`
+##### <a name="policy"></a>`policy`
Data type: `Optional[Ferm::Policies]`
Default value: ``undef``
-##### `dport`
+##### <a name="dport"></a>`dport`
Data type: `Optional[Ferm::Port]`
Default value: ``undef``
-##### `sport`
+##### <a name="sport"></a>`sport`
Data type: `Optional[Ferm::Port]`
Default value: ``undef``
-##### `saddr`
+##### <a name="saddr"></a>`saddr`
Data type: `Optional[Variant[Array, String[1]]]`
Default value: ``undef``
-##### `daddr`
+##### <a name="daddr"></a>`daddr`
Data type: `Optional[Variant[Array, String[1]]]`
Default value: ``undef``
-##### `proto_options`
+##### <a name="proto_options"></a>`proto_options`
Data type: `Optional[String[1]]`
Default value: ``undef``
-##### `interface`
+##### <a name="interface"></a>`interface`
Data type: `Optional[String[1]]`
Default value: ``undef``
-##### `ensure`
+##### <a name="ensure"></a>`ensure`
Data type: `Enum['absent','present']`
Default value: `'present'`
-##### `table`
+##### <a name="table"></a>`table`
Data type: `Ferm::Tables`
## Data types
-### `Ferm::Actions`
+### <a name="fermactions"></a>`Ferm::Actions`
As you can also *jump* to other chains, each chain-name is also a valid action/target
-Alias of `Variant[Enum['RETURN', 'ACCEPT', 'DROP', 'REJECT', 'NOTRACK', 'LOG', 'MARK', 'DNAT', 'SNAT', 'MASQUERADE', 'REDIRECT'], String[1]]`
+Alias of
+
+```puppet
+Variant[Enum['RETURN', 'ACCEPT', 'DROP', 'REJECT', 'NOTRACK', 'LOG', 'MARK', 'DNAT', 'SNAT', 'MASQUERADE', 'REDIRECT'], String[1]]
+```
-### `Ferm::Policies`
+### <a name="fermpolicies"></a>`Ferm::Policies`
a list of allowed policies for a chain
-Alias of `Enum['ACCEPT', 'DROP']`
+Alias of
-### `Ferm::Port`
+```puppet
+Enum['ACCEPT', 'DROP']
+```
+
+### <a name="fermport"></a>`Ferm::Port`
allowed variants:
-----------------
+ Array of Integers (creates a multiport matcher)
+ ferm range port-spec (pair of colon-separated integer, assumes 0 if first is omitted)
-Alias of `Variant[Stdlib::Port, Array[Stdlib::Port], Pattern['^\d*:\d+$']]`
+Alias of
+
+```puppet
+Variant[Stdlib::Port, Array[Stdlib::Port], Pattern['^\d*:\d+$']]
+```
-### `Ferm::Protocols`
+### <a name="fermprotocols"></a>`Ferm::Protocols`
a list of allowed protocolls to match
-Alias of `Variant[Enum['icmp', 'tcp', 'udp', 'udplite', 'icmpv6', 'esp', 'ah', 'sctp', 'mh', 'all'], Array[Enum['icmp', 'tcp', 'udp', 'udplite', 'icmpv6', 'esp', 'ah', 'sctp', 'mh', 'all']]]`
+Alias of
-### `Ferm::Tables`
+```puppet
+Variant[Integer[0, 255], Array[Integer[0, 255]], Enum['icmp', 'tcp', 'udp', 'udplite', 'icmpv6', 'esp', 'ah', 'sctp', 'mh', 'all'], Array[Enum['icmp', 'tcp', 'udp', 'udplite', 'icmpv6', 'esp', 'ah', 'sctp', 'mh', 'all']]]
+```
+
+### <a name="fermtables"></a>`Ferm::Tables`
a list of available tables
-Alias of `Enum['raw', 'mangle', 'nat', 'filter']`
+Alias of
+
+```puppet
+Enum['raw', 'mangle', 'nat', 'filter']
+```
projects / puppet-ferm.git / commitdiff