X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/0e74e2f70ceb291199499bcd7aa1828e1908fa65..84b5aa673d3d29cbf124c93abaa4c6995b9c1ea5:/cookbooks/networking/templates/default/nftables.conf.erb

diff --git a/cookbooks/networking/templates/default/nftables.conf.erb b/cookbooks/networking/templates/default/nftables.conf.erb
index d98237d6e..cc3cd8f7f 100644
--- a/cookbooks/networking/templates/default/nftables.conf.erb
+++ b/cookbooks/networking/templates/default/nftables.conf.erb
@@ -24,12 +24,12 @@ table inet chef-filter {
 
   set ip-blocklist {
     type ipv4_addr
-    flags dynamic
+    flags interval
   }
 
   set ip6-blocklist {
     type ipv6_addr
-    flags dynamic
+    flags interval
   }
 
   set ratelimit-icmp-echo-ip {
@@ -57,6 +57,13 @@ table inet chef-filter {
 <%- end %>
   }
 
+<%- end %>
+
+<%- node[:networking][:firewall][:helpers].each do |helper| %>
+  ct helper <%= helper[:name] %> {
+    type "<%= helper[:helper] %>" protocol <%= helper[:protocol] %>
+  }
+
 <%- end %>
   chain log-and-drop {
     limit rate 1/second log