--- firewalld_enabled: True firewalld_default_zone: public firewalld_allow_zone_drifting: False # @var firewalld_ipsets:description: A firewalld ipset configuration provides the information of an ip set for firewalld. # @var firewalld_ipsets:example: > # firewalld_ipsets: # - name: appserver # type: "hash:net" # short: "App Servers" # description: "Allow http access from all appservers" # option: {} # entry: # - 192.168.2.1 # - 192.168.2.2 # @end firewalld_ipsets: [] firewalld_ipsets_extra: [] # @var firewalld_services:description: > # A firewalld service can be a list of local ports and destinations and additionally also a list of firewall helper modules # automatically loaded if a service is enabled. # @var firewalld_services:example: > # - name: "" # short: "" # description: "" # port: [] # protocol: [] # source_port: [] # module: [] # destination: {} firewalld_services: [] firewalld_services_extra: [] # @var firewalld_zones:example: > # firewalld_zones: # - name: "" # short: "" # description: "" # target: "" # interface: # - name: "" # source: # - address: "" # - mac: "" # - ipset: "" # service: # - name: "" # port: # - { port: "", protocol: "" } # protocol: # - value: # icmp-block: # - name: # icmp-block-inversion: true # masquerade: true # forward: true # forward-port: # - { port: "", protocol: "" } # source-port: # - { port: "", protocol: "" } # rule: # - source: { address: "", mac: "", ipset: ""} # destination: { address: "", mac: "", ipset: ""} # service: {name: ""} # port: {port: "", protocol: ""} # protocol: {value: ""} # icmp-block: # name: "" # icmp-type: # name: "" # masquerade: true # forward-port: # port: "" # protocol: "" # to-port: "" # to-addr: "" # source-port: # port: "" # protocol: "" # log: # prefix: "" # level: "" # limit: "" # audit: # limit: "" # accept: # limit: "" # reject: # rejecttype: "" # limit: "" # drop: # limit: "" # mark: # set: # limit: "" # end firewalld_zones: - name: "public" short: "Public" description: >- For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted. service: - name: ssh - name: dhcpv6-client - name: cockpit firewalld_zones_extra: []