Couple of questions about nftables module and nftables; • nftables:rules:puppet only sets up incoming traffic - when I run puppet agent -t on the box it connects out to the puppet servers (and fails because nft blocks the connection). I’m trying to understand when / why puppet would connect in to the host (is it something to do with Choria ?). Also why doesnt the rule also configure an outbound connection rule as that seems to be required • I’m trying to figure out how to add a general rule to configure logging of all connections - I found a page that suggests using “nft add rule filter input log” but I dont understand how to configure that via the puppet module. • Additionally I’d like to be able to add a rule (as an alternative to logging everything) which logs dropped / rejected connections in to the host as a ‘catch all’ at the end of all the input rules - I tried for ssh to use nftables::rule (content ‘tcp dport 22 log’) - but it doesn’t seem to be working as expected. • We’re trying to lock down access to ssh to specific IPs / Subnets - but then open everything else (as if the firewall were not present) - I created a rule using nftables::rule (content ‘tcp dport {1-65535} accept’) which seems to work but it seems a bit of a crazy fix and wondered if there was a more elegant way to set this up.