vbyrd
commented
6 years ago After further testing with "custom_service", It seems that you can add a protocol to a custom service without a port defined and it will set it in the protocols sections of the service. This feature was added in merge https://github.com/crayfishx/puppet-firewalld/pull/171. Sorry for not catching this before opening up an issue.
Example manifest:
firewalld::custom_service{'pptp':
short => 'pptp',
description => 'Point to Point Tunneling Protocol',
port => [{
'port' => '1723',
'protocol' => 'tcp',
},
{
'port' => '',
'protocol' => 'gre',
}],
}...will produce this:
firewall-cmd --info-service=pptp
pptp
ports: 1723/tcp
protocols: gre
source-ports:
modules:
destination:This behavior works great for my best practices as I define everything in services anyway, however, it seems that this does not work directly on a zone (instead of through a service) if one wanted to do so.
Example manifest:
firewalld_port { 'add protocol GRE to the public public zone':
ensure => present,
zone => 'public',
protocol => 'gre',
}...will error:
Error: Execution of '/bin/firewall-cmd --permanent --zone public --add-port add GRE to the public public zone/gre' returned 102:
Error: Firewalld_port[add GRE to the public public zone]/ensure: change from 'absent' to 'present' failed: Execution of '/bin/firewall-cmd --permanent --zone public --add-port add GRE to the public public zone/gre' returned 102:
nasa-dan
It seems firewalld has had this functionality since "firewalld-0.3.15". I have not been able to find a reference to it in this module. Is there a plan to add this functionality at a later date? I could see common scenarios being the addition of l2tp, gre, and igmp protocols to a zone.
From the firewalld man page:
Example of /etc/protocols: