add nftables role

linux/nftables/defaults/main.yml

@@ -0,0 +1,8 @@
+nftables_whitelisted_interfaces:
+  - lo
+nftables_tcp_in:
+  - 22
+  - 80
+  - 443
+#nftables_udp_in:
+#  - 53

linux/nftables/handlers/main.yml

@@ -0,0 +1,3 @@
+- name: reload_nftables
+  shell: "nft -f {{ nftables_ruleset_path }}"
+  become: yes

linux/nftables/tasks/main.yml

@@ -0,0 +1,22 @@
+- name: ensure nftables is installed
+  package:
+    name: nftables
+    state: installed
+  become: yes
+
+- name: deploy nftables ruleset
+  template:
+    src: nftables.conf
+    dest: "{{ nftables_ruleset_path }}"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: reload_nftables
+  become: yes
+
+- name: ensure nftables is enabled and started
+  service:
+    name: nftables
+    enabled: true
+    state: started
+  become: yes

linux/nftables/templates/nftables.conf

@@ -0,0 +1,59 @@
+flush ruleset                                                                    
+                                                                                 
+table inet firewall {
+                                                                                 
+    chain inbound_ipv4 {
+        # accepting ping (icmp-echo-request) for diagnostic purposes.
+        # However, it also lets probes discover this host is alive.
+        # This sample accepts them within a certain rate limit:
+        #
+        icmp type echo-request limit rate 5/second accept      
+    }
+
+    chain inbound_ipv6 {                                                         
+        # accept neighbour discovery otherwise connectivity breaks
+        #
+        icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
+                                                                                 
+        # accepting ping (icmpv6-echo-request) for diagnostic purposes.
+        # However, it also lets probes discover this host is alive.
+        # This sample accepts them within a certain rate limit:
+        #
+        icmpv6 type echo-request limit rate 5/second accept
+    }
+
+    chain inbound {                                                              
+
+        # By default, drop all traffic unless it meets a filter
+        # criteria specified by the rules that follow below.
+        type filter hook input priority 0; policy drop;
+
+        # Allow traffic from established and related packets, drop invalid
+        ct state vmap { established : accept, related : accept, invalid : drop } 
+
+        {% for interface in nftables_whitelisted_interfaces %}
+        iifname {{ interface }} accept
+        {% endfor %}
+
+        # Jump to chain according to layer 3 protocol using a verdict map
+        meta protocol vmap { ip : jump inbound_ipv4, ip6 : jump inbound_ipv6 }
+
+        {% if nftables_tcp_in is defined %}
+        tcp dport { {{ nftables_tcp_in |join(",") }} } accept
+        {% endif %}
+
+        {% if nftables_udp_in is defined %}
+        udp dport { {{ nftables_udp_in |join(",") }} } accept
+        {% endif %}
+
+        # Uncomment to enable logging of denied inbound traffic
+        # log prefix "[nftables] Inbound Denied: " counter drop
+    }                                                                            
+                                                                                 
+    chain forward {                                                              
+        # Drop everything (assumes this device is not a router)                  
+        type filter hook forward priority 0; policy drop;                        
+    }                                                                            
+                                                                                 
+    # no need to define output chain, default policy is accept if undefined.
+}

linux/nftables/vars/main.yml

@@ -0,0 +1 @@
+nftables_ruleset_path: /etc/nftables.conf