ferm

Ansible role to install and configure ferm firewall.

Sponsor

Building and improving this Ansible role have been sponsored by my current and previous employers like Cloudpunks GmbH and Proact Deutschland GmbH.

Table of content

• Requirements
• Default Variables
  • ferm_default_forward_policy
  • ferm_default_input_policy
  • ferm_default_output_policy
  • ferm_default_weight
  • ferm_enabled
  • ferm_extra_hooks
  • ferm_general_dirs
  • ferm_general_hooks
  • ferm_general_rules
  • ferm_group_dirs
  • ferm_group_rules
  • ferm_host_dirs
  • ferm_host_rules
  • ferm_raw_rules
• Discovered Tags
• Dependencies
• License
• Author

---

Requirements

• Minimum Ansible version: 2.10

Default Variables

ferm_default_forward_policy

Default policy for forward chain

Default value

ferm_default_forward_policy: DROP

ferm_default_input_policy

Default policy for input chain

Default value

ferm_default_input_policy: DROP

ferm_default_output_policy

Default policy for output chain

Default value

ferm_default_output_policy: ACCEPT

ferm_default_weight

Default weight for rule files

Default value

ferm_default_weight: 50

ferm_enabled

Generally enable or disable ferm

Default value

ferm_enabled: true

ferm_extra_hooks

List of extra hook scripts

Default value

ferm_extra_hooks: []

ferm_general_dirs

List of general directories for chains

Default value

ferm_general_dirs:
  - /etc/ferm/before.d
  - /etc/ferm/ferm.d
  - /etc/ferm/input.d
  - /etc/ferm/output.d
  - /etc/ferm/forward.d
  - /etc/ferm/pre.d
  - /etc/ferm/post.d
  - /etc/ferm/flush.d

ferm_general_hooks

List of general hook scripts

Default value

ferm_general_hooks: []

ferm_general_rules

List of general rule definitions

Default value

ferm_general_rules:
  - name: ssh
    weight: 20
    type: input
    content: |
      proto tcp dport ssh ACCEPT;

ferm_group_dirs

List of group directories for chains

Default value

ferm_group_dirs: []

ferm_group_rules

List of group rule definitions

Default value

ferm_group_rules: []

ferm_host_dirs

List of host directories for chains

Default value

ferm_host_dirs: []

ferm_host_rules

List of host rule definitions

Default value

ferm_host_rules: []

ferm_raw_rules

Raw rules applied with ferm

Default value

ferm_raw_rules: |
  @include before.d/;

  domain (ip ip6) {
    table filter {
      chain INPUT {
        policy {{ ferm_default_input_policy }};

        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        interface lo ACCEPT;
        proto icmp ACCEPT;

        @include input.d/;
      }

      chain FORWARD {
        policy {{ ferm_default_forward_policy }};

        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        @include forward.d/;
      }

      chain OUTPUT {
        policy {{ ferm_default_output_policy }};
        @include output.d/;
      }
    }
  }

  @include ferm.d/;

Discovered Tags

ferm

Dependencies

• None

License

Apache-2.0

Author

Thomas Boerger