Skip to content

Support ingress/egress priority on zones for version >=2.0 #379

Description

@ananace

With Firewalld 2.0, there's a new option to specify the ingress and egress priority for each zone, i.e;

# firewall-cmd --version
2.0.1
# firewall-cmd --zone=k8s --list-all
k8s (active)
  target: ACCEPT
  ingress-priority: -10
  egress-priority: -10
  icmp-block-inversion: no
...

These can be set to a signed integer value in order to specify the order that rules and routing should be handled between zones, with lower priority values taking precedence.
The priority values can only be set with --permanent

An example of how to do this using an exec;

if versioncmp(fact('firewalld_version'), '2.0.0') >= 0 {
  exec { 'Set priority on k8s zone':
    command => @(EOF),
      firewall-cmd --permanent --zone=k8s --set-ingress-priority -10 && \
      firewall-cmd --permanent --zone=k8s --set-egress-priority -10
    |EOF
    unless  => 'firewall-cmd --info-zone=k8s | grep priority | grep -- -10',
    path    => fact('path'),
  }
  ~> Class['firewalld::reload']
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions