Cleanup the nftables files, using includes.

Rename the tables to be cle_ prefixed/unique. This allows people to run
cle nftables and firewalld etc.

Signed-off-by: James Antill <james@and.org>

inventory/group_vars/all

@@ -155,6 +155,12 @@ nftables: True
 nft_custom6_rules: []
 nft_custom_rules: []
 nft_nat_rules: []
+# Table names for nft
+# Note that the ip/ip6 prefix here means we only look at IPv4/IPv6 packets.
+nft_table_filter: "ip cle_infra_filter"
+nft_table_nat: "ip cle_infra_nat"
+nft_table_raw: "ip cle_infra_raw"
+nft_table6_filter: "ip6 cle_infra_filter"
 # default network block device encryption settings for linux-system-roles/nbde_client
 nbde: true
 nbde_device: /dev/md2

roles/base/templates/nftables/_nft_accept_beg

@@ -0,0 +1,14 @@
+# {{ ansible_managed }}
+# _nft_accept_beg
+# Setup an ip filter table with default accept policy, and the std. allow rules.
+
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+add table {{_tn}}
+add chain {{_tn}}   INPUT { type filter hook input priority 0; policy accept; }
+add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; }
+add chain {{_tn}}  OUTPUT { type filter hook output priority 0; policy accept; }

roles/base/templates/nftables/_nft_accept_end

@@ -0,0 +1,7 @@
+# _nft_accept_end
+# Default accept policy, standard end rules
+# This kind of makes it default drop, but the spelling is weird.
+
+# otherwise kick everything out
+add rule {{_tn}} INPUT   counter reject with icmp type host-prohibited
+add rule {{_tn}} FORWARD counter reject with icmp type host-prohibited

roles/base/templates/nftables/_nft_accept_http

@@ -0,0 +1,6 @@
+# _nft_accept_http
+# Accept HTTP(s)
+
+add rule {{_tn}} INPUT ct state new tcp dport  80 counter accept
+add rule {{_tn}} INPUT ct state new tcp dport 443 counter accept
+

roles/base/templates/nftables/_nft_accept_monitoring

@@ -0,0 +1,15 @@
+# _nft_accept_monitoring
+# Default accept policy, let things be monitored
+
+# for nrpe - allow it from nocs
+add rule {{_tn}} INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
+# FIXME - this is the global nat-ip and we need the noc01-specific ip
+add rule {{_tn}} INPUT ip saddr 38.145.60.16  tcp dport 5666 counter accept
+add rule {{_tn}} INPUT ip saddr 38.145.60.15  tcp dport 5666 counter accept
+add rule {{_tn}} INPUT ip saddr 10.3.163.10   tcp dport 5666 counter accept
+add rule {{_tn}} INPUT ip saddr 10.3.166.10   tcp dport 5666 counter accept
+# zabbix01
+add rule {{_tn}} INPUT                        tcp dport 10051 counter accept
+add rule {{_tn}} INPUT ip saddr 10.3.163.198  tcp dport 10050 counter accept
+

roles/base/templates/nftables/_nft_accept_ports

@@ -0,0 +1,16 @@
+# _nft_accept_ports
+# Default accept policy, accept host defined tcp/udp ports
+
+# if the host/group defines incoming tcp_ports - allow them
+{% if tcp_ports is defined %}
+{% for port in tcp_ports %}
+add rule {{_tn}} INPUT tcp dport {{ port }} counter accept
+{% endfor %}
+{% endif %}
+
+# if the host/group defines incoming udp_ports - allow them
+{% if udp_ports is defined %}
+{% for port in udp_ports %}
+add rule {{_tn}} INPUT udp dport {{ port }} counter accept
+{% endfor %}
+{% endif %}

roles/base/templates/nftables/_nft_accept_proxy_ports

@@ -0,0 +1,17 @@
+# _nft_accept_proxy_ports
+# Default accept policy, deal with proxy ports (if defined)
+
+# if there are any proxy-only tcp_ports - allow them
+{% if proxy_tcp_ports is defined %}
+{% for port in proxy_tcp_ports %}
+{% for proxy in (groups['proxies'] + groups['proxies_internal']) %}
+{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %}
+add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
+{% else %}
+add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
+{% endif %}
+{% endfor %}
+# nagios
+add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept
+{% endfor %}
+{% endif %}

roles/base/templates/nftables/_nft_accept_ssh

@@ -0,0 +1,6 @@
+# _nft_accept_ssh
+# Accept ssh
+
+# allow ssh - always
+add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept
+

roles/base/templates/nftables/_nft_accept_std

@@ -0,0 +1,12 @@
+# _nft_accept_std
+# Standard accept lines, SSH is _not_ here.
+
+# allow ping and traceroute
+add rule {{_tn}} INPUT ip protocol icmp counter accept
+
+# localhost is fine
+add rule {{_tn}} INPUT iifname "lo" counter accept
+
+# Established connections allowed
+add rule {{_tn}}  INPUT ct state related,established counter accept
+add rule {{_tn}} OUTPUT ct state related,established counter accept

roles/base/templates/nftables/_nft_accept_vpn

@@ -0,0 +1,24 @@
+# _nft_accept_vpn
+# Default accept policy, vpn stuff.
+# NOTE: That the end of this file rejects all other VPN traffic.
+
+{% if vpn %}
+#
+# We want to have all vpn hosts reject most things from the 'less secure' vpn network
+#
+{% if inventory_hostname in groups['ipa'] %}
+# Allow all vpn hosts to talk to the ipa servers for auth
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport  80 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport  88 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept
+
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport  88 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept
+{% endif %}
+
+# Reject all further connections from less secure vpn
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
+{% endif %}

roles/base/templates/nftables/_nft_block_rules

@@ -0,0 +1,9 @@
+# _nft_block_rules
+# Default accept policy, standard end rules
+
+{% if nft_block_rules is defined %}
+# if there are block rules - put them in as-is
+{% for rule in nft_block_rules %}
+{{ rule }}
+{% endfor %}
+{% endif %}

roles/base/templates/nftables/_nft_blocked_ips

@@ -0,0 +1,9 @@
+# _nft_blocked_ips
+# Probably only use for: Default drop policy
+
+# if the blocked_ips is defined - drop them
+{% if blocked_ips is defined %}
+{% for ip in blocked_ips %}
+add rule {{_tn}} INPUT ip saddr {{ ip }} counter drop
+{% endfor %}
+{% endif %}

roles/base/templates/nftables/_nft_custom_rules

@@ -0,0 +1,9 @@
+# _nft_custom_rules
+# Probably only use for: Default accept policy
+
+# if there are custom rules - put them in as-is
+{% if nft_custom_rules is defined %}
+{% for rule in nft_custom_rules %}
+{{ rule }}
+{% endfor %}
+{% endif %}

roles/base/templates/nftables/_nft_drop_beg

@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+# _nft_drop_beg
+# Setup an ip filter table with default drop policy.
+#
+# Note that there's no _nft_drop_end because _nft_accept_end drops everything
+# and we don't need that.
+
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+add table {{_tn}}
+add chain {{_tn}}   INPUT { type filter hook input priority 0; policy drop; }
+add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; }
+add chain {{_tn}}  OUTPUT { type filter hook output priority 0; policy drop; }

roles/base/templates/nftables/_nft_drop_std

@@ -0,0 +1,12 @@
+# _nft_drop_std
+# Std. allow rules for the drop policy
+
+
+{% include '_nft_accept_std' %}
+
+# MORE loopback allowed
+add rule {{_tn}} OUTPUT oifname "lo" counter accept
+add rule {{_tn}}  INPUT iifname "virbr0" counter accept
+add rule {{_tn}} OUTPUT oifname "virbr0" counter accept
+add rule {{_tn}}  INPUT ip daddr 127.0.0.0/8 counter accept
+add rule {{_tn}} OUTPUT ip daddr 127.0.0.0/8 counter accept

roles/base/templates/nftables/_nft_nat

@@ -0,0 +1,15 @@
+# _nft_nat
+# Setup forwarding via. "ip nat" table, if we have nat rules.
+
+{% if nft_nat_rules is defined %}
+
+add table {{_tnat}}
+add chain {{_tnat}}  PREROUTING { type nat hook prerouting priority {{_nft_prio_preroute}}; policy accept; }
+add chain {{_tnat}}       INPUT { type nat hook input priority {{_nft_prio_input}}; policy accept; }
+add chain {{_tnat}}      OUTPUT { type nat hook output priority {{_nft_prio_output}}; policy accept; }
+add chain {{_tnat}} POSTROUTING { type nat hook postrouting priority {{_nft_prio_postroute}}; policy accept; }
+
+{% for rule in nft_nat_rules %}
+{{ rule }}
+{% endfor %}
+{% endif %}

roles/base/templates/nftables/nftables

@@ -1,127 +1,29 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy accept; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy accept; }
+# {{ template_path }}
 
-# allow ping and traceroute
-add rule ip filter INPUT ip protocol icmp counter accept
+{% include '_nft_accept_beg' %}
 
-# localhost is fine
-add rule ip filter INPUT iifname "lo" counter accept
+{% include '_nft_accept_std' %}
 
-# Established connections allowed
-add rule ip filter  INPUT ct state related,established counter accept
-add rule ip filter OUTPUT ct state related,established counter accept
+{% include '_nft_accept_ssh' %}
 
-# allow ssh - always
-add rule ip filter INPUT ct state new tcp dport 22 counter accept
+{% include '_nft_accept_monitoring' %}
 
-# for nrpe - allow it from nocs
-add rule ip filter INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
-# FIXME - this is the global nat-ip and we need the noc01-specific ip
-add rule ip filter INPUT ip saddr 38.145.60.16  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 38.145.60.15  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.10   tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.166.10   tcp dport 5666 counter accept
-# zabbix01
-add rule ip filter INPUT                        tcp dport 10051 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.198  tcp dport 10050 counter accept
+{% include '_nft_accept_vpn' %}
 
-{% if env != 'staging' and datacenter == 'iad2' and inventory_hostname not in groups['staging_friendly'] %}
-#
-# In the iad2 datacenter, both production and staging hosts are in different
-# vlans, and different subnets. However, just as a precaution, we want prod machines to
-# reject connections from any staging host just in case there's some globally enabled port.
-# There are however a few hosts in production we have marked 'staging-friendly'
-# that we do allow staging to talk to for mostly read-only data they need.
-#
-add rule ip filter INPUT ip saddr 10.3.166.0/24 counter reject with icmp type host-prohibited
-add rule ip filter INPUT ip saddr 10.3.167.0/24 counter reject with icmp type host-prohibited
-{% endif %}
+{% include '_nft_block_rules' %}
 
-{% if vpn %}
-#
-# We want to have all vpn hosts reject most things from the 'less secure' vpn network
-#
-{% if inventory_hostname == 'log01.iad2.fedoraproject.org' %}
-# Allow all vpn hosts to talk to the log server for rsyslog
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport   514 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept
-{% endif %}
-{% if inventory_hostname in groups['ipa'] %}
-# Allow all vpn hosts to talk to the ipa servers for auth
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport  80 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport  88 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept
+{% include '_nft_accept_ports' %}
 
-add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport  88 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept
-{% endif %}
-# Reject all further connections from less secure vpn
-add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
-{% endif %}
+{% include '_nft_accept_proxy_ports' %}
 
+{% include '_nft_custom_rules' %}
 
-{% if nft_block_rules is defined %}
-# if there are block rules - put them in as-is
-{% for rule in nft_block_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
-# if the host/group defines incoming tcp_ports - allow them
-{% if tcp_ports is defined %}
-{% for port in tcp_ports %}
-add rule ip filter INPUT tcp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_end' %}
 
-# if the host/group defines incoming udp_ports - allow them
-{% if udp_ports is defined %}
-{% for port in udp_ports %}
-add rule ip filter INPUT udp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% set _nft_prio_preroute = "-100" %}
+{% set _nft_prio_input = "100" %}
+{% set _nft_prio_output = "-100" %}
+{% set _nft_prio_postroute = "100" %}
 
-# if there are any proxy-only tcp_ports - allow them
-{% if proxy_tcp_ports is defined %}
-{% for port in proxy_tcp_ports %}
-{% for proxy in (groups['proxies'] + groups['proxies_internal']) %}
-{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %}
-add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
-{% else %}
-add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
-{% endif %}
-{% endfor %}
-# nagios
-add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
-
-# if there are custom rules - put them in as-is
-{% if nft_custom_rules is defined %}
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
-
-# otherwise kick everything out
-add rule ip filter INPUT   counter reject with icmp type host-prohibited
-add rule ip filter FORWARD counter reject with icmp type host-prohibited
-
-{% if nft_nat_rules is defined %}
-
-add table ip nat
-add chain ip nat  PREROUTING { type nat hook prerouting priority -100; policy accept; }
-add chain ip nat       INPUT { type nat hook input priority 100; policy accept; }
-add chain ip nat      OUTPUT { type nat hook output priority -100; policy accept; }
-add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; }
-
-{% for rule in nft_nat_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
+{% include '_nft_nat' %}

roles/base/templates/nftables/nftables-ipv6

@@ -1,48 +1,51 @@
 # {{ ansible_managed }}
-add table ip6 filter
-add chain ip6 filter INPUT { type filter hook input priority 0; policy accept; }
-add chain ip6 filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip6 filter OUTPUT { type filter hook output priority 0; policy accept; }
+
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn6 = nft_table6_filter %}
+
+add table {{_tn6}}
+add chain {{_tn6}} INPUT { type filter hook input priority 0; policy accept; }
+add chain {{_tn6}} FORWARD { type filter hook forward priority 0; policy accept; }
+add chain {{_tn6}} OUTPUT { type filter hook output priority 0; policy accept; }
 
 # loopback allowed
-add rule ip6 filter INPUT iifname "lo" counter accept
+add rule {{_tn6}} INPUT iifname "lo" counter accept
 
 # Accept ping and traceroute (needs icmp)
-add rule ip6 filter INPUT meta l4proto ipv6-icmp counter accept
+add rule {{_tn6}} INPUT meta l4proto ipv6-icmp counter accept
 
 # Established connections allowed
-add rule ip6 filter INPUT ct state related,established counter accept
+add rule {{_tn6}} INPUT ct state related,established counter accept
 
 # Established connections allowed
-add rule ip6 filter OUTPUT ct state related,established counter accept
+add rule {{_tn6}} OUTPUT ct state related,established counter accept
 
 # allow dhcp6d from aws
-add rule ip6 filter INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept
+add rule {{_tn6}} INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept
 
 # if the blocked_ips is defined - drop them
 {% if blocked_ip_v6 is defined %}
 {% for ip in blocked_ip_v6 %}
-add rule ip6 filter INPUT ip6 saddr {{ ip }} counter drop
+add rule {{_tn6}} INPUT ip6 saddr {{ ip }} counter drop
 {% endfor %}
 {% endif %}
 
 # allow ssh - always
-add rule ip6 filter INPUT ct state new tcp dport 22 counter accept
-
-# for nrpe (if we want noc02 to be able to get into remote systems)
-#add rule ip6 filter INPUT ip6 saddr 2600:2701:4000:5211:dead:beef:fe:fed9 tcp dport 5666 counter accept
+add rule {{_tn6}} INPUT ct state new tcp dport 22 counter accept
 
 # if the host/group defines incoming tcp_ports - allow them
 {% if tcp_ports is defined %}
 {% for port in tcp_ports %}
-add rule ip6 filter INPUT tcp dport {{ port }} counter accept
+add rule {{_tn6}} INPUT tcp dport {{ port }} counter accept
 {% endfor %}
 {% endif %}
 
 # if the host/group defines incoming udp_ports - allow them
 {% if udp_ports is defined %}
 {% for port in udp_ports %}
-add rule ip6 filter INPUT udp dport {{ port }} counter accept
+add rule {{_tn6}} INPUT udp dport {{ port }} counter accept
 {% endfor %}
 {% endif %}
 
@@ -54,5 +57,5 @@ add rule ip6 filter INPUT udp dport {{ port }} counter accept
 {% endif %}
 
 # otherwise kick everything out
-add rule ip6 filter INPUT counter reject with icmpv6 type admin-prohibited
-add rule ip6 filter FORWARD counter reject with icmpv6 type admin-prohibited
+add rule {{_tn6}} INPUT counter reject with icmpv6 type admin-prohibited
+add rule {{_tn6}} FORWARD counter reject with icmpv6 type admin-prohibited

roles/base/templates/nftables/nftables.bastion

@@ -1,155 +1,53 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy accept; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy accept; }
+# {{ template_path }}
 
-# allow ping and traceroute
-add rule ip filter INPUT ip protocol icmp counter accept
+{% include '_nft_accept_beg' %}
 
-# localhost is fine
-add rule ip filter INPUT iifname "lo" counter accept
+{% include '_nft_accept_std' %}
 
-# Established connections allowed
-add rule ip filter  INPUT ct state related,established counter accept
-add rule ip filter OUTPUT ct state related,established counter accept
+{% include '_nft_accept_ssh' %}
 
-# allow ssh - always
-add rule ip filter INPUT ct state new tcp dport 22 counter accept
-
-# for nrpe - allow it from nocs
-add rule ip filter INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
-# FIXME - this is the global nat-ip and we need the noc01-specific ip
-add rule ip filter INPUT ip saddr 38.145.60.16  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 38.145.60.15  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.10   tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.166.10   tcp dport 5666 counter accept
-# zabbix01
-add rule ip filter INPUT                        tcp dport 10051 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.198  tcp dport 10050 counter accept
-
-{% if env != 'staging' and datacenter == 'iad2' and inventory_hostname not in groups['staging_friendly'] %}
-#
-# In the iad2 datacenter, both production and staging hosts are in different
-# vlans, and different subnets. However, just as a precaution, we want prod machines to
-# reject connections from any staging host just in case there's some globally enabled port.
-# There are however a few hosts in production we have marked 'staging-friendly'
-# that we do allow staging to talk to for mostly read-only data they need.
-#
-add rule ip filter INPUT ip saddr 10.3.166.0/24 counter reject with icmp type host-prohibited
-add rule ip filter INPUT ip saddr 10.3.167.0/24 counter reject with icmp type host-prohibited
-{% endif %}
-
-{% if vpn %}
-#
-# We want to have all vpn hosts reject most things from the 'less secure' vpn network
-#
-{% if inventory_hostname == 'log01.iad2.fedoraproject.org' %}
-# Allow all vpn hosts to talk to the log server for rsyslog
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport   514 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept
-{% endif %}
-{% if inventory_hostname in groups['ipa'] %}
-# Allow all vpn hosts to talk to the ipa servers for auth
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport  80 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport  88 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept
-
-add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport  88 counter accept
-add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept
-{% endif %}
-# Reject all further connections from less secure vpn
-add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
-{% endif %}
+{% include '_nft_accept_monitoring' %}
 
 # smtp rules we want to allow vpn and out internal networks and mimecast
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.0/24   tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 192.168.0.0/24   tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.1.0/24   tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.0.0/24   tcp dport 25 counter accept
 
-add rule ip filter INPUT ip saddr 10.3.160.0/19    tcp dport 25 counter accept
+# This rejects all VPN traffic at the end.
+{% include '_nft_accept_vpn' %}
+
+add rule {{_tn}} INPUT ip saddr 10.3.160.0/19    tcp dport 25 counter accept
 
 # s390x builders/virthost
-add rule ip filter INPUT ip saddr 10.1.102.0/24    tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 10.1.102.0/24    tcp dport 25 counter accept
 # redhat mxes
-add rule ip filter INPUT ip saddr 10.30.177.0/24   tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 10.30.29.0/24    tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 10.30.177.0/24   tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 10.30.29.0/24    tcp dport 25 counter accept
 # mimecast ips from
 # https://community.mimecast.com/s/article/email-security-cloud-gateway-data-centers-and-urls?r=297&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1
-add rule ip filter INPUT ip saddr 170.10.128.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 170.10.129.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 170.10.130.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 170.10.131.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 170.10.132.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 170.10.133.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 207.211.30.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 207.211.31.0/25  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 216.205.24.0/24  tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 63.128.21.0/24   tcp dport 25 counter accept
-add rule ip filter INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 170.10.128.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 170.10.129.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 170.10.130.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 170.10.131.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 170.10.132.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 170.10.133.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 207.211.30.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 207.211.31.0/25  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 216.205.24.0/24  tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 63.128.21.0/24   tcp dport 25 counter accept
+add rule {{_tn}} INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept
 
-{% if nft_block_rules is defined %}
-# if there are block rules - put them in as-is
-{% for rule in nft_block_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
+{% include '_nft_block_rules' %}
 
-# if the host/group defines incoming tcp_ports - allow them
-{% if tcp_ports is defined %}
-{% for port in tcp_ports %}
-add rule ip filter INPUT tcp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_ports' %}
 
-# if the host/group defines incoming udp_ports - allow them
-{% if udp_ports is defined %}
-{% for port in udp_ports %}
-add rule ip filter INPUT udp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_proxy_ports' %}
 
-# if there are any proxy-only tcp_ports - allow them
-{% if proxy_tcp_ports is defined %}
-{% for port in proxy_tcp_ports %}
-{% for proxy in (groups['proxies'] + groups['proxies_internal']) %}
-{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %}
-add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
-{% else %}
-add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
-{% endif %}
-{% endfor %}
-# nagios
-add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% include '_nft_custom_rules' %}
 
-# if there are custom rules - put them in as-is
-{% if nft_custom_rules is defined %}
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_end' %}
 
-# otherwise kick everything out
-add rule ip filter INPUT   counter reject with icmp type host-prohibited
-add rule ip filter FORWARD counter reject with icmp type host-prohibited
-
-{% if nft_nat_rules is defined %}
-
-add table ip nat
-add chain ip nat  PREROUTING { type nat hook prerouting priority -100; policy accept; }
-add chain ip nat       INPUT { type nat hook input priority 100; policy accept; }
-add chain ip nat      OUTPUT { type nat hook output priority -100; policy accept; }
-add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; }
-
-{% for rule in nft_nat_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
+{% include '_nft_nat' %}

roles/base/templates/nftables/nftables.kojibuilder

@@ -1,40 +1,20 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy drop; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy drop; }
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy drop; }
+# {{ template_path }}
 
-# loopback allowed
-add rule ip filter  INPUT iifname "lo" counter accept
-add rule ip filter OUTPUT oifname "lo" counter accept
-add rule ip filter  INPUT iifname "virbr0" counter accept
-add rule ip filter OUTPUT oifname "virbr0" counter accept
-add rule ip filter  INPUT ip daddr 127.0.0.0/8 counter accept
-add rule ip filter OUTPUT ip daddr 127.0.0.0/8 counter accept
+{% include '_nft_drop_beg' %}
 
-# Accept ping and traceroute (needs icmp)
-add rule ip filter  INPUT ip protocol icmp counter accept
-add rule ip filter OUTPUT ip protocol icmp counter accept
+{% include '_nft_drop_std' %}
 
-# Established connections allowed
-add rule ip filter  INPUT ct state related,established counter accept
-add rule ip filter OUTPUT ct state related,established counter accept
-
-# if the blocked_ips is defined - drop them
-{% if blocked_ips is defined %}
-{% for ip in blocked_ips %}
-add rule ip filter INPUT ip saddr {{ ip }} counter drop
-{% endfor %}
-{% endif %}
+{% include '_nft_blocked_ips' %}
 
 {% if host in groups['osbuild'] %}
 # osbuild api for osbuild koji plugin
 #!# WARNING: This is very different...
 # -A OUTPUT -p tcp --dport 443 -m set --match-set osbuildapi dst -j ACCEPT
 
-add set  ip filter osbuildapi { type ipv4_addr ; size 65536; }
+add set  {{_tn}} osbuildapi { type ipv4_addr ; size 65536; }
 
-add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept
+add rule {{_tn}} OUTPUT tcp dport 443 ip daddr @osbuildapi accept
 
 # Then in the update script...
 # nft flush set      global osbuildapi
@@ -47,155 +27,144 @@ add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept
 
 # kojipkgs
 {% if host in groups['buildvm_s390x'] %}
-add rule ip filter OUTPUT ip daddr 10.16.0.17   tcp dport 80 counter accept
-add rule ip filter OUTPUT ip daddr 10.16.0.35   tcp dport 80 counter accept
-add rule ip filter OUTPUT ip daddr 10.1.102.24  tcp dport 80 counter accept
-add rule ip filter OUTPUT ip daddr 10.1.102.50  tcp dport 80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.16.0.17   tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.16.0.35   tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.1.102.24  tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.1.102.50  tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept
 {% endif %}
 
 # tang for buildhw
-add rule ip filter OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept
 
 # DNS
-add rule ip filter OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept
 
 # bastion smtp
-add rule ip filter OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept
 
 # infra.fp.o
-add rule ip filter OUTPUT ip daddr 10.3.163.35 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept
 
 # rsyslog out to log01
-add rule ip filter OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept
 
 # SSH
-add rule ip filter  INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept
+add rule {{_tn}}  INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept
 
 {% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %}
 # Allow SSHFS binding to koji01
-add rule ip filter OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept
 {% endif %}
 
 # http to pull sources from pkgs lookaside
-#add rule ip filter OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept
+#add rule {{_tn}} OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept
 
 # https git on pagure,io
-add rule ip filter OUTPUT ip daddr 8.43.85.76 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 8.43.85.76 tcp dport 443 counter accept
 
 # admin.fedoraproject.org  for fas (proyx(1)01 and proxy(1)10)
 {% if host in groups['staging'] %}
-add rule ip filter OUTPUT ip daddr 10.3.166.74 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.74 tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.75 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.75 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.74 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.74 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.75 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.75 tcp dport 443 counter accept
 {% endif %}
 
-add rule ip filter OUTPUT ip daddr 10.3.163.74 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.74 tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.75 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.75 tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.76 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.76 tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.77 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.77 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.74 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.74 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.75 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.75 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.76 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.76 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.77 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.77 tcp dport 443 counter accept
 
 # ipa client ports
 {% if host in groups['staging'] %}
-add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 389 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 389 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 636 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 636 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport  53 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport  53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 389 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 389 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 636 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 636 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport  53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport  53 counter accept
 {% else %}
-add rule ip filter OUTPUT ip daddr 10.3.163.54  tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport  80 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 443 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  tcp dport 389 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  tcp dport 389 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 389 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  tcp dport 636 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  tcp dport 636 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 636 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  tcp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  tcp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  udp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  udp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport  88 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  tcp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  tcp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  udp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  udp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport 464 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.54  udp dport  53 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.55  udp dport  53 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport  53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport  80 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 443 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  tcp dport 389 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  tcp dport 389 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 389 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  tcp dport 636 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  tcp dport 636 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 636 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  tcp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  tcp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  udp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  udp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport  88 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  tcp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  tcp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  udp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  udp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport 464 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.54  udp dport  53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.55  udp dport  53 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport  53 counter accept
 {% endif %}
 
 {% if host in groups['staging'] %}
 # Allow nfs from koji01
-add rule ip filter  INPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept
+add rule {{_tn}}  INPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept
 {% endif %}
 #nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but 
 # kinda necessary
-add rule ip filter  INPUT ip saddr 10.3.162.11 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.162.11 counter accept
+add rule {{_tn}}  INPUT ip saddr 10.3.162.11 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.162.11 counter accept
 #!# NOTE: tcp/udp doesn't translate without a port??
-add rule ip filter  INPUT ip saddr 10.3.162.12 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.162.12 counter accept
-add rule ip filter  INPUT ip saddr 10.3.162.13 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.162.13 counter accept
-add rule ip filter  INPUT ip saddr 10.3.162.14 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.162.14 counter accept
+add rule {{_tn}}  INPUT ip saddr 10.3.162.12 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.162.12 counter accept
+add rule {{_tn}}  INPUT ip saddr 10.3.162.13 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.162.13 counter accept
+add rule {{_tn}}  INPUT ip saddr 10.3.162.14 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.162.14 counter accept
 
 # ntp
-add rule ip filter OUTPUT ip daddr 10.3.163.31 udp dport 123 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.163.32 udp dport 123 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 udp dport 123 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.32 udp dport 123 counter accept
 
 # dhcp
-add rule ip filter OUTPUT ip daddr 10.3.163.10 udp dport 67 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.163.10 udp dport 67 counter accept
 
 # s390x builders ssh
-add rule ip filter  INPUT ip saddr 10.3.0.0/16 tcp dport 22 counter accept
-add rule ip filter OUTPUT ip daddr 10.3.0.0/16 tcp sport 22 counter accept
+add rule {{_tn}}  INPUT ip saddr 10.3.0.0/16 tcp dport 22 counter accept
+add rule {{_tn}} OUTPUT ip daddr 10.3.0.0/16 tcp sport 22 counter accept
 
-# if the host/group defines incoming tcp_ports - allow them
-{% for port in tcp_ports %}
-add rule ip filter INPUT tcp dport {{ port }} counter accept
-{% endfor %}
+{% include '_nft_accept_ports' %}
 
-# if the host/group defines incoming udp_ports - allow them
-{% for port in udp_ports %}
-add rule ip filter INPUT udp dport {{ port }} counter accept
-{% endfor %}
-
-# if there are custom rules - put them in as-is
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
+{% include '_nft_custom_rules' %}

roles/base/templates/nftables/nftables.osuosl

@@ -1,25 +1,11 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy accept; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy accept; }
+# {{ template_path }}
 
-# allow ping and traceroute
-add rule ip filter INPUT ip protocol icmp counter accept
+{% include '_nft_accept_beg' %}
 
-# localhost is fine
-add rule ip filter INPUT iifname "lo" counter accept
+{% include '_nft_accept_std' %}
 
-# Established connections allowed
-add rule ip filter  INPUT ct state related,established counter accept
-add rule ip filter OUTPUT ct state related,established counter accept
-
-# if the blocked_ips is defined - drop them
-{% if blocked_ips is defined %}
-{% for ip in blocked_ips %}
-add rule ip filter INPUT ip saddr {{ ip }} counter drop
-{% endfor %}
-{% endif %}
+{% include '_nft_blocked_ips' %}
 
 # allow ssh only from needed ips
 # vpn in from tun0
@@ -27,35 +13,10 @@ add rule ip filter INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp
 # external ip for iad2
 add rule ip filter INPUT ip saddr 38.145.60.0/24 ct state new tcp dport 22 counter accept
 
-# for nrpe - allow it from nocs
-add rule ip filter INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
-# FIXME - this is the global nat-ip and we need the noc01-specific ip
-add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.10  tcp dport 5666 counter accept
+{% include '_nft_accept_monitoring' %}
 
-# if the host/group defines incoming tcp_ports - allow them
-{% if tcp_ports is defined %}
-{% for port in tcp_ports %}
-add rule ip filter INPUT tcp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_ports' %}
 
-# if the host/group defines incoming udp_ports - allow them
-{% if udp_ports is defined %}
-{% for port in udp_ports %}
-add rule ip filter INPUT udp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% include '_nft_custom_rules' %}
 
-# if there are custom rules - put them in as-is
-{% if nft_custom_rules is defined %}
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
-
-# otherwise kick everything out
-add rule ip filter   INPUT counter reject with icmp type host-prohibited
-add rule ip filter FORWARD counter reject with icmp type host-prohibited
+{% include '_nft_accept_end' %}

roles/base/templates/nftables/nftables.releng

@@ -1,87 +1,50 @@
 # {{ ansible_managed }}
+# {{ template_path }}
+
 #
 # NOTE: Chaging this template updates iptables on all releng hosts :)
 # Please check with sysadmin-main before pushing out an update here.
 #
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy drop; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy accept; }
 
-# loopback allowed
-add rule ip filter INPUT iifname "lo" counter accept
+# NOTE: We don't use _nft_accept_beg because INPUT policy default is drop
 
-# Accept ping and traceroute (needs icmp)
-add rule ip filter INPUT ip protocol icmp counter accept
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
 
-# Established connections allowed
-add rule ip filter INPUT ct state related,established counter accept
+add table {{_tn}}
+add chain {{_tn}}   INPUT { type filter hook input priority 0; policy drop; }
+add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; }
+add chain {{_tn}}  OUTPUT { type filter hook output priority 0; policy accept; }
 
-# Overwrite any global rules
-# for nrpe - allow it from nocs
-add rule ip filter INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
-# FIXME - this is the global nat-ip and we need the noc01-specific ip
-add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.10  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.166.10  tcp dport 5666 counter accept
-# Zabbix
-add rule ip filter INPUT tcp dport 10051 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept
+{% include '_nft_accept_std' %}
 
-# if the blocked_ips is defined - drop them
-{% if blocked_ips is defined %}
-{% for ip in blocked_ips %}
-add rule ip filter INPUT ip saddr {{ ip }} counter drop
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_monitoring' %}
+
+{% include '_nft_blocked_ips' %}
 
 # SSH
 #!# NOTE: Do we still need/wants these 13+ years later?
 # ssh block against uni in .cz where problem(s) have been cited
 # added by skvidal on jan 24 2011 - as per request from spot
-add rule ip filter INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject
+add rule {{_tn}} INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject
 # matches last rule for a service we want blocked
-add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset
-add rule ip filter INPUT tcp dport 22 counter accept
+add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset
+add rule {{_tn}} INPUT tcp dport 22 counter accept
 
 # Allow all netapp traffic
-add rule ip filter INPUT ip saddr 10.3.162.0/24 counter accept
+add rule {{_tn}} INPUT ip saddr 10.3.162.0/24 counter accept
 
+{% include '_nft_accept_ssh' %}
 
-# Custom Services
+{% include '_nft_accept_http' %}
 
-# Services TCP
-add rule ip filter INPUT tcp dport  22 counter accept
-add rule ip filter INPUT tcp dport  80 counter accept
-add rule ip filter INPUT tcp dport 443 counter accept
+{% include '_nft_accept_ports' %}
 
-# Services UDP
+{% include '_nft_custom_rules' %}
 
-# more services we use - ports for random services and TG listeners.
-# if the host/group defines incoming tcp_ports - allow them
-{% if tcp_ports is defined %}
-{% for port in tcp_ports %}
-add rule ip filter INPUT tcp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_vpn' %}
 
-# if the host/group defines incoming udp_ports - allow them
-{% if udp_ports is defined %}
-{% for port in udp_ports %}
-add rule ip filter INPUT udp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
-
-# if there are custom rules - put them in as-is
-{% if nft_custom_rules is defined %}
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
-
-# Extra protection for 192.168.100.x vpn hosts.
-add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
-
-add rule ip filter   INPUT counter reject with icmp type host-prohibited
+{% include '_nft_accept_end' %}

roles/base/templates/nftables/nftables.sign

@@ -1,22 +1,11 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy accept; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy accept; }
+# {{ template_path }}
 
-# loopback allowed
-add rule ip filter INPUT iifname "lo" counter accept
+{% include '_nft_accept_beg' %}
 
-# Accept ping and traceroute (needs icmp)
-add rule ip filter INPUT ip protocol icmp counter accept
-
-# Established connections allowed
-add rule ip filter INPUT ct state related,established counter accept
+{% include '_nft_accept_std' %}
 
 # Allow connections from client/server
-add rule ip filter INPUT tcp dport 44333-44334 counter accept
-
-# otherwise kick everything out
-add rule ip filter   INPUT counter reject with icmp type host-prohibited
-add rule ip filter FORWARD counter reject with icmp type host-prohibited
+add rule {{_tn}} INPUT tcp dport 44333-44334 counter accept
 
+{% include '_nft_accept_end' %}

roles/base/templates/nftables/nftables.staging

@@ -1,43 +1,18 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
+# {{ template_path }}
 
-# allow ping and traceroute
-add rule ip filter INPUT ip protocol icmp counter accept
+{% include '_nft_accept_beg' %}
 
-# localhost is fine
-add rule ip filter INPUT iifname "lo" counter accept
+{% include '_nft_accept_std' %}
 
-# Established connections allowed
-add rule ip filter INPUT ct state related,established counter accept
-add rule ip filter OUTPUT ct state related,established counter accept
+{% include '_nft_accept_ssh' %}
 
-# allow ssh - always
-add rule ip filter INPUT ct state new tcp dport 22 counter accept
+{% include '_nft_accept_monitoring' %}
 
-# for nrpe - allow it from nocs
-add rule ip filter INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
-# FIXME - this is the global nat-ip and we need the noc01-specific ip
-add rule ip filter INPUT ip saddr 38.145.60.16  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 38.145.60.15  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.10   tcp dport 5666 counter accept
-# zabbix01.stg
-add rule ip filter INPUT tcp dport 10051 counter accept
-add rule ip filter INPUT ip saddr 10.3.166.61 tcp dport 10050 counter accept
+{% include '_nft_accept_ports' %}
 
-
-# if the host/group defines incoming tcp_ports - allow them
-{% for port in tcp_ports %}
-add rule ip filter INPUT tcp dport {{ port }} counter accept
-{% endfor %}
-
-# if the host/group defines incoming udp_ports - allow them
-{% for port in udp_ports %}
-add rule ip filter INPUT udp dport {{ port }} counter accept
-{% endfor %}
+# NOTE: This uses proxies_stg and not proxies. Also the VPN bits. ... so unique
+# include '_nft_accept_proxy_ports'
 
 # if there are any proxy-only tcp_ports - allow them
 {% if proxy_tcp_ports is defined %}
@@ -54,15 +29,8 @@ add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['ad
 {% endfor %}
 {% endif %}
 
-# if there are custom rules - put them in as-is
-{% if nft_custom_rules is defined %}
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
+{% include '_nft_custom_rules' %}
 
-# otherwise kick everything out
-add rule ip filter INPUT   counter reject with icmp type host-prohibited
-add rule ip filter FORWARD counter reject with icmp type host-prohibited
+{% include '_nft_accept_end' %}
 
 # No nat rules

roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org

@@ -1,42 +1,23 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy accept; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy accept; }
+# {{ template_path }}
 
-# allow ping and traceroute
-add rule ip filter INPUT ip protocol icmp counter accept
+{% include '_nft_accept_beg' %}
 
-# localhost is fine
-add rule ip filter INPUT iifname "lo" counter accept
+{% include '_nft_accept_std' %}
 
-# Established connections allowed
-add rule ip filter  INPUT ct state related,established counter accept
-add rule ip filter OUTPUT ct state related,established counter accept
+{% include '_nft_accept_ssh' %}
 
-# if the blocked_ips is defined - drop them
-{% if blocked_ips is defined %}
-{% for ip in blocked_ips %}
-add rule ip filter INPUT ip saddr {{ ip }} counter drop
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_monitoring' %}
 
-# allow ssh - always
-add rule ip filter INPUT ct state new tcp dport 22 counter accept
+{% include '_nft_blocked_ips' %}
 
-# for nrpe - allow it from nocs
-add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
-# FIXME - this is the global nat-ip and we need the noc01-specific ip
-add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept
-# NOTE: we don't allow 10.3.163.10 / 10.3.166.10 or zabbix?
+# NOTE: This is _nft_accept_ports but with special variables.
 
 # if the host/group defines incoming tcp_ports - allow them
 # NOTE: These are specific to eth0
 {% if tcp_ports_eth0 is defined %}
 {% for port in tcp_ports_eth0 %}
-add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept
+add rule {{_tn}} INPUT iifname "eth0" tcp dport {{ port }} counter accept
 {% endfor %}
 {% endif %}
 
@@ -44,7 +25,7 @@ add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept
 # NOTE: These are specific to eth0
 {% if udp_ports_eth0 is defined %}
 {% for port in udp_ports_eth0 %}
-add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept
+add rule {{_tn}} INPUT iifname "eth0" udp dport {{ port }} counter accept
 {% endfor %}
 {% endif %}
 
@@ -52,7 +33,7 @@ add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept
 # NOTE: These are specific to eth1
 {% if tcp_ports_eth1 is defined %}
 {% for port in tcp_ports_eth1 %}
-add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept
+add rule {{_tn}} INPUT iifname "eth1" tcp dport {{ port }} counter accept
 {% endfor %}
 {% endif %}
 
@@ -60,30 +41,19 @@ add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept
 # NOTE: These are specific to eth1
 {% if udp_ports_eth1 is defined %}
 {% for port in udp_ports_eth1 %}
-add rule ip filter INPUT iifname "eth1" udp dport {{ port }} counter accept
+add rule {{_tn}} INPUT iifname "eth1" udp dport {{ port }} counter accept
 {% endfor %}
 {% endif %}
+a
 
-# if there are custom rules - put them in as-is
-{% if nft_custom_rules is defined %}
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
+{% include '_nft_custom_rules' %}
 
-# otherwise kick everything out
-add rule ip filter   INPUT counter reject with icmp type host-prohibited
-add rule ip filter FORWARD counter reject with icmp type host-prohibited
+{% include '_nft_accept_end' %}
 
-{% if nft_nat_rules %}
-#!# FIXME: These are different priority to iptables template...
-add table ip nat
-add chain ip nat  PREROUTING { type nat hook prerouting priority 0; policy accept; }
-add chain ip nat       INPUT { type nat hook input priority 0; policy accept; }
-add chain ip nat      OUTPUT { type nat hook output priority 0; policy accept; }
-add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; }
+# Why are these different from nftables??
+{% set _nft_prio_preroute = "0" %}
+{% set _nft_prio_input = "0" %}
+{% set _nft_prio_output = "0" %}
+{% set _nft_prio_postroute = "0" %}
 
-{% for rule in nft_nat_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
+{% include '_nft_nat' %}

roles/base/templates/nftables/nftables.torrent02.fedoraproject.org

@@ -1,87 +1,31 @@
 # {{ ansible_managed }}
-add table ip filter
-add chain ip filter   INPUT { type filter hook input priority 0; policy accept; }
-add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } 
-add chain ip filter  OUTPUT { type filter hook output priority 0; policy accept; }
+# {{ template_path }}
 
-# allow ping and traceroute
-add rule ip filter INPUT ip protocol icmp counter accept
+{% include '_nft_accept_beg' %}
 
-# localhost is fine
-add rule ip filter INPUT iifname "lo" counter accept
+{% include '_nft_accept_std' %}
 
-# Established connections allowed
-add rule ip filter  INPUT ct state related,established counter accept
-add rule ip filter OUTPUT ct state related,established counter accept
+{% include '_nft_accept_ssh' %}
 
-# if the blocked_ips is defined - drop them
-{% if blocked_ips is defined %}
-{% for ip in blocked_ips %}
-add rule ip filter INPUT ip saddr {{ ip }} counter drop
-{% endfor %}
-{% endif %}
+{% include '_nft_accept_monitoring' %}
 
-# allow ssh - always
-add rule ip filter INPUT ct state new tcp dport 22 counter accept
+{% include '_nft_blocked_ips' %}
 
-# for nrpe - allow it from nocs
-add rule ip filter INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
-# FIXME - this is the global nat-ip and we need the noc01-specific ip
-add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept
-add rule ip filter INPUT ip saddr 10.3.163.10  tcp dport 5666 counter accept
-# NOTE: This doesn't include 10.3.166.10
-# NOTE: This doesn't include zabbix.
+{% include '_nft_accept_ports' %}
 
-{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging_friendly'] %}
-#
-# In the phx2 datacenter, both production and staging hosts are in the same 
-# subnet/vlan. We want production hosts to reject connectons from staging group hosts
-# to prevent them from interfering with production. There are however a few hosts in 
-# production we have marked 'staging-friendly' that we do allow staging to talk to for 
-# mostly read-only data they need.
-#
-{% for host in groups['staging']|sort %}
-{% if 'eth0_ip' in hostvars[host] %}# {{ host }}
-add rule ip filter INPUT ip saddr {{ hostvars[host]['eth0_ip'] }} counter reject with icmp type host-prohibited
-{% else %}# {{ host }} has no 'eth0_ip' listed
-{% endif %}
-{% endfor %}
-{% endif %}
+{% include '_nft_custom_rules' %}
 
+{% include '_nft_accept_end' %}
 
-# if the host/group defines incoming tcp_ports - allow them
-{% if tcp_ports is defined %}
-{% for port in tcp_ports %}
-add rule ip filter INPUT tcp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
+# This is the special bit for torrents...
+{% set _tnr = nft_table_raw %}
 
-# if the host/group defines incoming udp_ports - allow them
-{% if udp_ports is defined %}
-{% for port in udp_ports %}
-add rule ip filter INPUT udp dport {{ port }} counter accept
-{% endfor %}
-{% endif %}
-
-# if there are custom rules - put them in as-is
-{% if nft_custom_rules is defined %}
-{% for rule in nft_custom_rules %}
-{{ rule }}
-{% endfor %}
-{% endif %}
-
-# otherwise kick everything out
-add rule ip filter INPUT   counter reject with icmp type host-prohibited
-add rule ip filter FORWARD counter reject with icmp type host-prohibited
-
-add table ip raw
-add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; }
-add chain ip raw     OUTPUT { type filter hook output priority -300; policy accept; }
+add table {{_tnr}}
+add chain {{_tnr}} PREROUTING { type filter hook prerouting priority -300; policy accept; }
+add chain {{_tnr}}     OUTPUT { type filter hook output priority -300; policy accept; }
 
 #
 # We don't want to track all the torrent tracker connections, there's too many.
 #
-add rule ip raw PREROUTING tcp dport 6969 counter notrack
-add rule ip raw     OUTPUT tcp sport 6969 counter notrack
+add rule {{_tnr}} PREROUTING tcp dport 6969 counter notrack
+add rule {{_tnr}}     OUTPUT tcp sport 6969 counter notrack