windows_firewall_global: Manage windows global firewall settingswindows_firewall_group: Enable/Disable windows firewall groupwindows_firewall_ipsec_rule: Manage Windows Firewall with Puppetwindows_firewall_profile: Enable/Disable windows firewall profilewindows_firewall_rule: Manage Windows Firewall with Puppet
Manage windows global firewall settings
The following properties are available in the windows_firewall_global type.
Configures the computers that are authorized to establish tunnel mode connections
Authz computer transport
Configures the users that are authorized to establish tunnel mode connections
Authz user group transport
Boot time rule category
"con sec rule category
Valid values: none, neighbordiscovery, icmp, dhcp, notconfigured
Configures the default IPsec exemptions. Default is to exempt IPv6 neighbordiscovery protocol and DHCP from IPsec
Firewall rule category
Valid values: yes, no
configures the option to use DH to secure key exchange
Valid values: never, serverbehindnat, serverandclientbehindnat, notconfigured
Configures when security associations can be established with a computer behind a network address translator
Sets main mode key lifetime in minutes and sessions
Configures the security association idle time in minutes
configures the main mode list of proposals
Valid values: enable, disable, notconfigured
Stateful FTP
Valid values: enable, disable, notconfigured
Stateful PPTP
Stealth rule category
Configures how CRL checking is enforced
The following parameters are available in the windows_firewall_global type.
namevar
Not used (reference only)
The specific backend to use for this windows_firewall_global resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.
Enable/Disable windows firewall group
The following properties are available in the windows_firewall_group type.
Valid values: true, false
Whether the rule group is enabled (true or false)
Default value: true
The following parameters are available in the windows_firewall_group type.
namevar
Name of the rule group to enable/disable
The specific backend to use for this windows_firewall_group resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.
Manage Windows Firewall with Puppet
The following properties are available in the windows_firewall_ipsec_rule type.
This parameter provides information about the firewall rule
Default value: ''
This parameter specifies the source string for the DisplayGroup parameter (read-only)
Specifies the localized, user-facing name of the firewall rule being created
Valid values: true, false
This parameter specifies that the rule object is administratively enabled or administratively disabled (true or false)
Default value: true
Valid values: present, absent
How to ensure this firewall rule (present or absent)
Default value: present
Valid values: none, require, request
This parameter determines the degree of enforcement for security on inbound traffic
Default value: none
Valid values: any, wired, wireless, remote_access
Specifies that only network connections made through the indicated interface types are subject to the requirements of this rule
Default value: any
Specifies that network packets with matching IP addresses match this rule (hostname not allowed), use an array to pass more then one
Default value: any
Specifies that network packets with matching IP port numbers match this rule, use an array to pass more then one
Default value: any
Valid values: none, transport, tunnel
Specifies the type of IPsec mode connection that the IPsec rule defines (None, Transport, or Tunnel)
Default value: transport
Valid values: none, require, request
This parameter determines the degree of enforcement for security on outbound traffic
Default value: none
Valid values: none, default, computerkerberos, anonymous
Gets the main mode rules that are associated with the given phase 1 authentication set to be created
Valid values: none, default, userkerberos
Gets the IPsec rules that are associated with the given phase 2 authentication set to be created
Valid values: domain, private, public, any
Specifies one or more profiles to which the rule is assigned
Default value: any
Valid values: tcp, udp, icmpv4, icmpv6, %r{^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$}
This parameter specifies the protocol for an IPsec rule
Specifies that network packets with matching IP addresses match this rule (hostname not allowed), use an array to pass more then one
Default value: any
This parameter value is the second end point of an IPsec rule, use an array to pass more then one
Default value: any
The following parameters are available in the windows_firewall_ipsec_rule type.
namevar
Name of this rule
The specific backend to use for this windows_firewall_ipsec_rule resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.
Enable/Disable windows firewall profile
The following properties are available in the windows_firewall_profile type.
Name and location of the firewall log
Configures default inbound and outbound behavior
Valid values: enable, disable, notconfigured
Notify user when a program listens for inbound connections
Valid values: enable, disable, notconfigured
Merge local connection security rules with Group Policy rules. Valid when configuring a Group Policy store
Valid values: enable, disable, notconfigured
Merge local firewall rules with Group Policy rules. Valid when configuring a Group Policy store
Valid values: enable, disable, notconfigured
log allowed connections
Valid values: enable, disable, notconfigured
log dropped connections
maximum size of log file in KB
Valid values: enable, disable, notconfigured
Allow remote management of Windows Firewall
Valid values: on, off, true, false
State of this firewall profile
Valid values: enable, disable, notconfigured
Control stateful unicast response to multicast
The following parameters are available in the windows_firewall_profile type.
namevar
Name of the profile to work on
The specific backend to use for this windows_firewall_profile resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.
Manage Windows Firewall with Puppet
The following properties are available in the windows_firewall_rule type.
Valid values: block, allow
What to do when this rule matches (Accept/Reject)
Valid values: notrequired, required, noencap
Specifies that authentication or encryption is required on firewall rules (authentication, encryption)
Default value: notrequired
Description of this rule
Default value: ''
Valid values: inbound, outbound
Direction the rule applies to (inbound/outbound)
group that the rule belongs to (read-only)
Display name for this rule
Valid values: block, allow, defer_to_user, defer_to_app
Apply rule to encapsulated traffic (?) - see: https://serverfault.com/questions/89824/windows-advanced-firewall-what-does-edge-traversal-mean#89846
Default value: block
Valid values: true, false
Whether the rule is enabled (true or false)
Default value: true
Valid values: notrequired, required, dynamic
Specifies that authentication or encryption is required on firewall rules (authentication, encryption)
Default value: notrequired
Valid values: present, absent
How to ensure this firewall rule (present or absent)
Default value: present
Protocol type to use (with ICMPv4/ICMPv6)"
Values should be:
- Just the type (3) ICMP type code: 0 through 255.
- ICMP type code pairs: 3:4 (type 3, code 4)
any
Valid values: any, wired, wireless, remote_access
Interface types this rule applies to
Default value: any
the local IP the rule targets (hostname not allowed), use an array to pass more then one
Default value: any
the local port the rule targets, use an array to pass more then one
Specifies that matching IPsec rules of the indicated user accounts are created
Default value: any
Valid values: domain, private, public, any
Which profile(s) this rule belongs to, use an array to pass more then one
Default value: any
Path to program this rule applies to
Default value: any
Valid values: any, tcp, udp, icmpv4, icmpv6, %r{^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$}
the protocol the rule targets
Default value: any
the remote IP the rule targets (hostname not allowed), use an array to pass more then one
Default value: any
Specifies that matching IPsec rules of the indicated computer accounts are created
Default value: any
the remote port the rule targets, use an array to pass more then one
Default value: any
Specifies that matching IPsec rules of the indicated user accounts are created
Default value: any
service names this rule applies to
Default value: any
The following parameters are available in the windows_firewall_rule type.
namevar
Name of this rule
The specific backend to use for this windows_firewall_rule resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.