Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback

2026-10-07 07:29:29 +00:00
parent 27e9d4a1ab
commit cfe87002c5
19 changed files with 417 additions and 227 deletions
@@ -0,0 +1,9 @@
+#!/bin/sh
+# Started by a transient timer before a rule set load; Ansible stops the timer
+# once the new rule set is confirmed.
+cd /etc/nftables.d || exit 1
+mv -f host.nft host.nft.rolled-back
+if [ -s host.nft.good ]; then
+	cp host.nft.good host.nft && nft -f host.nft && exit 0
+fi
+nft delete table inet host