With Firewalld 2.0, there's a new option to specify the ingress and egress priority for each zone, i.e;
# firewall-cmd --version
2.0.1
# firewall-cmd --zone=k8s --list-all
k8s (active)
target: ACCEPT
ingress-priority: -10
egress-priority: -10
icmp-block-inversion: no
...
These can be set to a signed integer value in order to specify the order that rules and routing should be handled between zones, with lower priority values taking precedence.
The priority values can only be set with --permanent
An example of how to do this using an exec;
if versioncmp(fact('firewalld_version'), '2.0.0') >= 0 {
exec { 'Set priority on k8s zone':
command => @(EOF),
firewall-cmd --permanent --zone=k8s --set-ingress-priority -10 && \
firewall-cmd --permanent --zone=k8s --set-egress-priority -10
|EOF
unless => 'firewall-cmd --info-zone=k8s | grep priority | grep -- -10',
path => fact('path'),
}
~> Class['firewalld::reload']
}
With Firewalld 2.0, there's a new option to specify the ingress and egress priority for each zone, i.e;
These can be set to a signed integer value in order to specify the order that rules and routing should be handled between zones, with lower priority values taking precedence.
The priority values can only be set with
--permanentAn example of how to do this using an exec;