Class: Ansible::Ruby::Modules::Iptables

Inherits:
Base show all
Defined in:
lib/ansible/ruby/modules/generated/extras/system/iptables.rb

Instance Method Summary collapse

Methods inherited from Base

#to_h

Methods inherited from Ansible::Ruby::Models::Base

attr_option, attr_options, attribute, #initialize, #to_h, validates

Constructor Details

This class inherits a constructor from Ansible::Ruby::Models::Base

Instance Method Details

#chain ⇒ String

Returns Chain to operate on. This option can either be the name of a user defined chain or any of the builtin chains: ‘INPUT’, ‘FORWARD’, ‘OUTPUT’, ‘PREROUTING’, ‘POSTROUTING’, ‘SECMARK’, ‘CONNSECMARK’.

Returns:

  • (String) —

    Chain to operate on. This option can either be the name of a user defined chain or any of the builtin chains: ‘INPUT’, ‘FORWARD’, ‘OUTPUT’, ‘PREROUTING’, ‘POSTROUTING’, ‘SECMARK’, ‘CONNSECMARK’



22
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 22

attribute :chain

#comment ⇒ String?

Returns This specifies a comment that will be added to the rule.

Returns:

  • (String, nil) —

    This specifies a comment that will be added to the rule



82
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 82

attribute :comment

#ctstate ⇒ Object?

Returns ctstate is a list of the connection states to match in the conntrack module. Possible states are: ‘INVALID’, ‘NEW’, ‘ESTABLISHED’, ‘RELATED’, ‘UNTRACKED’, ‘SNAT’, ‘DNAT’.

Returns:

  • (Object, nil) —

    ctstate is a list of the connection states to match in the conntrack module. Possible states are: ‘INVALID’, ‘NEW’, ‘ESTABLISHED’, ‘RELATED’, ‘UNTRACKED’, ‘SNAT’, ‘DNAT’



86
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 86

attribute :ctstate

#destination ⇒ Object?

Returns Destination specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.

Returns:

  • (Object, nil) —

    Destination specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.



34
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 34

attribute :destination

#destination_port ⇒ String?

Returns Destination port or port range specification. This can either be a service name or a port number. An inclusive range can also be specified, using the format first:last. If the first port is omitted, ‘0’ is assumed; if the last is omitted, ‘65535’ is assumed. If the first port is greater than the second one they will be swapped.

Returns:

  • (String, nil) —

    Destination port or port range specification. This can either be a service name or a port number. An inclusive range can also be specified, using the format first:last. If the first port is omitted, ‘0’ is assumed; if the last is omitted, ‘65535’ is assumed. If the first port is greater than the second one they will be swapped.



63
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 63

attribute :destination_port

#fragment ⇒ Object?

Returns This means that the rule only refers to second and further fragments of fragmented packets. Since there is no way to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match any rules which specify them. When the “!” argument precedes fragment argument, the rule will only match head fragments, or unfragmented packets.

Returns:

  • (Object, nil) —

    This means that the rule only refers to second and further fragments of fragmented packets. Since there is no way to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match any rules which specify them. When the “!” argument precedes fragment argument, the rule will only match head fragments, or unfragmented packets.



54
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 54

attribute :fragment

#goto ⇒ Object?

Returns This specifies that the processing should continue in a user specified chain. Unlike the jump argument return will not continue processing in this chain but instead in the chain that called us via jump.

Returns:

  • (Object, nil) —

    This specifies that the processing should continue in a user specified chain. Unlike the jump argument return will not continue processing in this chain but instead in the chain that called us via jump.



44
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 44

attribute :goto

#in_interface ⇒ String?

Returns Name of an interface via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING chains). When the “!” argument is used before the interface name, the sense is inverted. If the interface name ends in a “+”, then any interface which begins with this name will match. If this option is omitted, any interface name will match.

Returns:

  • (String, nil) —

    Name of an interface via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING chains). When the “!” argument is used before the interface name, the sense is inverted. If the interface name ends in a “+”, then any interface which begins with this name will match. If this option is omitted, any interface name will match.



47
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 47

attribute :in_interface

#ip_version ⇒ :ipv4, ...

Returns Which version of the IP protocol this rule should apply to.

Returns:

  • (:ipv4, :ipv6, nil) —

    Which version of the IP protocol this rule should apply to.



18
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 18

attribute :ip_version

#jump ⇒ String?

Returns This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and the goto paramater is not used), then matching the rule will have no effect on the packet’s fate, but the counters on the rule will be incremented.

Returns:

  • (String, nil) —

    This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and the goto paramater is not used), then matching the rule will have no effect on the packet’s fate, but the counters on the rule will be incremented.



40
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 40

attribute :jump

#limit ⇒ Object?

Returns Specifies the maximum average number of matches to allow per second. The number can specify units explicitly, using ‘/second’, ‘/minute’, ‘/hour’ or ‘/day’, or parts of them (so ‘5/second’ is the same as ‘5/s’).

Returns:

  • (Object, nil) —

    Specifies the maximum average number of matches to allow per second. The number can specify units explicitly, using ‘/second’, ‘/minute’, ‘/hour’ or ‘/day’, or parts of them (so ‘5/second’ is the same as ‘5/s’).



89
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 89

attribute :limit

#limit_burst ⇒ Object?

Returns Specifies the maximum burst before the above limit kicks in.

Returns:

  • (Object, nil) —

    Specifies the maximum burst before the above limit kicks in.



92
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 92

attribute :limit_burst

#match ⇒ Object?

Returns Specifies a match to use, that is, an extension module that tests for a specific property. The set of matches make up the condition under which a target is invoked. Matches are evaluated first to last if specified as an array and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.

Returns:

  • (Object, nil) —

    Specifies a match to use, that is, an extension module that tests for a specific property. The set of matches make up the condition under which a target is invoked. Matches are evaluated first to last if specified as an array and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.



37
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 37

attribute :match

#out_interface ⇒ Object?

Returns Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains). When the “!” argument is used before the interface name, the sense is inverted. If the interface name ends in a “+”, then any interface which begins with this name will match. If this option is omitted, any interface name will match.

Returns:

  • (Object, nil) —

    Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains). When the “!” argument is used before the interface name, the sense is inverted. If the interface name ends in a “+”, then any interface which begins with this name will match. If this option is omitted, any interface name will match.



51
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 51

attribute :out_interface

#protocol ⇒ String?

Returns The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp, udplite, icmp, esp, ah, sctp or the special keyword “all”, or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A “!” argument before the protocol inverts the test. The number zero is equivalent to all. “all” will match with all protocols and is taken as default when this option is omitted.

Returns:

  • (String, nil) —

    The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp, udplite, icmp, esp, ah, sctp or the special keyword “all”, or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A “!” argument before the protocol inverts the test. The number zero is equivalent to all. “all” will match with all protocols and is taken as default when this option is omitted.



26
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 26

attribute :protocol

#reject_with ⇒ Object?

Returns Specifies the error packet type to return while rejecting.

Returns:

  • (Object, nil) —

    Specifies the error packet type to return while rejecting.



98
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 98

attribute :reject_with

#set_counters ⇒ Object?

Returns This enables the administrator to initialize the packet and byte counters of a rule (during INSERT, APPEND, REPLACE operations).

Returns:

  • (Object, nil) —

    This enables the administrator to initialize the packet and byte counters of a rule (during INSERT, APPEND, REPLACE operations).



57
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 57

attribute :set_counters

#set_dscp_mark ⇒ String?

Returns This allows specifying a DSCP mark to be added to packets. It takes either an integer or hex value. Mutually exclusive with C(set_dscp_mark_class).

Returns:

  • (String, nil) —

    This allows specifying a DSCP mark to be added to packets. It takes either an integer or hex value. Mutually exclusive with C(set_dscp_mark_class).



74
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 74

attribute :set_dscp_mark

#set_dscp_mark_class ⇒ String?

Returns This allows specifying a predefined DiffServ class which will be translated to the corresponding DSCP mark. Mutually exclusive with C(set_dscp_mark).

Returns:

  • (String, nil) —

    This allows specifying a predefined DiffServ class which will be translated to the corresponding DSCP mark. Mutually exclusive with C(set_dscp_mark).



78
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 78

attribute :set_dscp_mark_class

#source ⇒ String?

Returns Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.

Returns:

  • (String, nil) —

    Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A “!” argument before the address specification inverts the sense of the address.



30
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 30

attribute :source

#source_port ⇒ Object?

Returns Source port or port range specification. This can either be a service name or a port number. An inclusive range can also be specified, using the format first:last. If the first port is omitted, ‘0’ is assumed; if the last is omitted, ‘65535’ is assumed. If the first port is greater than the second one they will be swapped.

Returns:

  • (Object, nil) —

    Source port or port range specification. This can either be a service name or a port number. An inclusive range can also be specified, using the format first:last. If the first port is omitted, ‘0’ is assumed; if the last is omitted, ‘65535’ is assumed. If the first port is greater than the second one they will be swapped.



60
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 60

attribute :source_port

#state ⇒ :present, ...

Returns Whether the rule should be absent or present.

Returns:

  • (:present, :absent, nil) —

    Whether the rule should be absent or present.



14
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 14

attribute :state

#table ⇒ :filter, ...

Returns This option specifies the packet matching table which the command should operate on. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there.

Returns:

  • (:filter, :nat, :mangle, :raw, :security, nil) —

    This option specifies the packet matching table which the command should operate on. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there.



10
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 10

attribute :table

#to_destination ⇒ Object?

Returns This specifies a destination address to use with DNAT: without this, the destination address is never altered.

Returns:

  • (Object, nil) —

    This specifies a destination address to use with DNAT: without this, the destination address is never altered.



71
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 71

attribute :to_destination

#to_ports ⇒ String?

Returns This specifies a destination port or range of ports to use: without this, the destination port is never altered. This is only valid if the rule also specifies one of the following protocols: tcp, udp, dccp or sctp.

Returns:

  • (String, nil) —

    This specifies a destination port or range of ports to use: without this, the destination port is never altered. This is only valid if the rule also specifies one of the following protocols: tcp, udp, dccp or sctp.



67
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 67

attribute :to_ports

#uid_owner ⇒ Object?

Returns Specifies the UID or username to use in match by owner rule.

Returns:

  • (Object, nil) —

    Specifies the UID or username to use in match by owner rule.



95
 
# File 'lib/ansible/ruby/modules/generated/extras/system/iptables.rb', line 95

attribute :uid_owner