Puppet Class: profile::base::firewall::log

Defined in:
modules/profile/manifests/base/firewall/log.pp

Overview

Firewall logging class

Parameters:

  • log_burst (Integer) (defaults to: hiera('profile::base::firewall::log::log_burst'))
  • log_rate (Pattern[/\d+\/(second|minute|hour|day)/]) (defaults to: hiera('profile::base::firewall::log::log_rate'))


2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
# File 'modules/profile/manifests/base/firewall/log.pp', line 2

class profile::base::firewall::log (
  Integer                                  $log_burst = hiera('profile::base::firewall::log::log_burst'),
  Pattern[/\d+\/(second|minute|hour|day)/] $log_rate = hiera('profile::base::firewall::log::log_rate'),
) {
  # we only call this class from profile::base::firewall
  assert_private()
  class { '::ulogd': }

  # Explicitly drop pxe/dhcp packets packets so they dont hit the log
  ferm::filter_log { 'filter-bootp':
      proto => 'udp',
      daddr => '255.255.255.255',
      sport => 67,
      dport => 68,
  }

  ferm::rule { 'log-everything':
      rule => "NFLOG mod limit limit ${log_rate} limit-burst ${log_burst} nflog-prefix \"[fw-in-drop]\";",
      prio => '99',
  }

}