Use this module on Debian, optionally set the noflush_tables parameter
What are you seeing
Despite setting noflust_tables, all my tables where flushed when doing a systemctl reload nftables.
Upon further investigation, I saw that, on Debian, the default config path /etc/nftables.confis used in the systemd service overwrite,
and that file_line is used to add include "/etc/nftables/puppet.nft" to include all the rules from the puppet-managed files.
The problem is, Debian has the following config by default in /etc/nftables.conf:
This does not get cleaned up, only the include ... line is added at the end, meaning you will always flush all tables and create a default inet filter table and chains, before you get to the puppet-managed part.
I think either this file needs to be cleaned up by the module, or a new, empty, file needs to be used.
Else we get unexpected results, like noflush_tables not working,
and possibly other things if Debian maintainers decide to add other defaults to a file that we use, but don't fully manage...
How to reproduce (e.g Puppet code you use)
Use this module on Debian, optionally set the
noflush_tables
parameterWhat are you seeing
Despite setting
noflust_tables
, all my tables where flushed when doing asystemctl reload nftables
. Upon further investigation, I saw that, on Debian, the default config path/etc/nftables.conf
is used in the systemd service overwrite, and thatfile_line
is used to addinclude "/etc/nftables/puppet.nft"
to include all the rules from the puppet-managed files.The problem is, Debian has the following config by default in
/etc/nftables.conf
:This does not get cleaned up, only the
include ...
line is added at the end, meaning you will always flush all tables and create a defaultinet filter
table and chains, before you get to the puppet-managed part.I think either this file needs to be cleaned up by the module, or a new, empty, file needs to be used. Else we get unexpected results, like
noflush_tables
not working, and possibly other things if Debian maintainers decide to add other defaults to a file that we use, but don't fully manage...