CDIST-TYPE__FIREWALLD_RULE(7)

✨ NAME ✨

cdist-type__firewalld_rule — this is the cdist type that configures firewalld rules, bestie 💅

---

🦋 DESCRIPTION 🦋

okay so real talk: this cdist type lets you manage rules in firewalld using the direct way — aka no zone support 🎀

that's it, that's the whole vibe. direct rules, no zones, periodt.

---

👑 REQUIRED PARAMETERS 👑

like, these ones are not optional, you literally have to give them all:

• rule — the actual rule to apply. essentially it's a firewalld command line but with firewalld chopped off the front 🌸
• protocol — either ipv4, ipv4 or eb. See firewall-cmd(1). (and yes bestie, that's genuinely what it says, two ipv4s and an eb — i'm not the one who wrote it, i just work here 😭)
• table — which table to use, like filter or nat. See firewall-cmd(1).
• chain — which chain to use, like INPUT_direct or FORWARD_direct. See firewall-cmd(1).
• priority — the priority to use (0 is topmost). See firewall-cmd(1).

---

💖 OPTIONAL PARAMETERS 💖

• state — 'present' or 'absent', defaults to 'present' ✨

---

🌈 EXAMPLES 🌈

allow access from entrance.place4.ungleich.ch — iconic behavior, honestly:

# Allow access from entrance.place4.ungleich.ch
__firewalld_rule entrance \
    --protocol ipv4 \
    --table filter \
    --chain INPUT_direct \
    --priority 0 \
    --rule '-s entrance.place4.ungleich.ch -j ACCEPT'

allow forwarding of traffic from br0 🦋:

# Allow forwarding of traffic from br0
__firewalld_rule vm-forward --protocol ipv4 \
    --table filter \
    --chain FORWARD_direct \
    --priority 0 \
    --rule '-i br0 -j ACCEPT'

and here's the "make it go away" one — but bestie, read this carefully:

# Ensure old rule is absent - warning, the rule part must stay the same!
__firewalld_rule vm-forward
    --protocol ipv4 \
    --table filter \
    --chain FORWARD_direct \
    --priority 0 \
    --rule '-i br0 -j ACCEPT' \
    --state absent

⚠️ warning — the rule part must stay the same! if you change the --rule while asking for --state absent, it will not be the same rule, and it will not get removed. don't do that to yourself 💀

---

🫶 SEE ALSO 🫶

cdist-type__iptables_rule(7), firewalld(8)

---

🌸 AUTHORS 🌸

Nico Schottelius <nico-cdist--@--schottelius.org> — the legend 👑

---

🎀 COPYING 🎀

Copyright (C) 2015 Nico Schottelius. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

---

💜 COPYRIGHT 💜

ungleich GmbH 2021

---

and that's the whole page, bestie 🧚 no cap. this was version 7.0.0, dated Jul 31, 2022, served fresh from the cdist manual — go forth and manage your rules, you absolute main character 💅✨🍓