Switch from iptables to nftables, add separate network states

network/files/firewall_rules.nft.jinja

@@ -0,0 +1,12 @@
+# This file is managed by Saltstack. (State {{ STATE }})
+
+#!/usr/sbin/nft
+
+table inet filter {
+  chain input {
+    tcp dport 22 accept
+    {% for port in ALLOWED_PORTS %}
+    tcp dport {{ port }} accept
+    {% endfor %}
+  }
+}

network/firewall.sls

@@ -1,12 +1,12 @@
-system_firewall_pkgs:
+network_firewall_pkgs:
   pkg.installed:
     - pkgs:
-      - iptables
+      - nftables
 
-system_firewall_rules:
+network_firewall_rules:
   file.managed:
-    - name: /etc/iptables/rules-save
-    - source: salt://{{ tpldir }}/files/firewall_rules.v4.jinja
+    - name: /etc/nftables.d/noveria.nft
+    - source: salt://{{ tpldir }}/files/firewall_rules.nft.jinja
     - template: jinja
     - context:
         STATE: {{ sls }}
@@ -16,15 +16,15 @@ system_firewall_rules:
     - mode: '0600'
     - makedirs: true
     - require:
-      - system_firewall_pkgs
+      - network_firewall_pkgs
 
-system_firewall_service_reload:
+network_firewall_service_reload:
   service.running:
-    - name: iptables
+    - name: nftables
     - enable: true
     - reload: true
     - watch:
-      - system_firewall_rules
+      - network_firewall_rules
     - require:
-      - system_firewall_pkgs
+      - network_firewall_pkgs
   

network/init.sls

@@ -1,7 +1,7 @@
 include:
-  - .base
+  - .firewall
 
-system_network_interfaces:
+network_interfaces:
   file.managed:
     - name: /etc/network/interfaces
     - source: salt://{{ tpldir }}/files/network_interfaces
@@ -11,10 +11,10 @@ system_network_interfaces:
     - require:
       - system_base_pkgs
 
-system_network_service_reload:
+network_service_reload:
   service.running:
     - name: networking
     - enable: true
     - reload: true
     - watch:
-      - system_network_interfaces
+      - system_network_interfaces

system/files/firewall_rules.v4.jinja

@@ -1,23 +0,0 @@
-# This file is managed by Saltstack. (State {{ STATE }})
-
-*filter
-
-:INPUT DROP [0:0]
-:FORWARD DROP [0:0]
-:OUTPUT ACCEPT [0:0]
-
--A INPUT -i lo -j ACCEPT
-
--A INPUT ! -i lo -d 127.0.0.0/8 -j DROP
-
--A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-
--A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-
--A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-
-{% for port in ALLOWED_PORTS %}
--A INPUT -p tcp --dport {{ port }} -j ACCEPT
-{% endfor %}
-
-COMMIT

system/init.sls

@@ -2,8 +2,6 @@ include:
   - .base
   - .bootloader
   - .disks
-  - .firewall
-  - .network
   - .user
   - .shell
   - .salt

top.sls

@@ -1,5 +1,6 @@
 base:
   '*':
     - system
+    - network
     - applications
     - util