iptables Firewall Module

This is yet another iptables module for Puppet. It supports both IPv4 and IPv6 and tries to maintain compatibility with iptables/ip6tables v1.3.5 and above.

Why Another iptables Modules?

Mostly because some of us don't like modifying the running rules directly, and instead would prefer to modify the on-disk rules. This has the advantage of allowing us to comment them inside of the rule file itself, making them easier to read in cases of debugging. Unfortunately, some hosts will always be snowflakes, so this is a big plus for some.

Second, we can expose a more iptables-specific interface in our objects, making it easier to read what you're doing inside of your manifests files.

Lastly, I've tried very hard to do as much error-checking as possible, so that we catch the errors before being deployed to the host. If you come up with a combination of parameters that puts an entry into the iptables file that causes an error, please file an issue.

Usage

The foundation of this module is understanding every rule has an order, from 000-999, and that the rules will be placed in ascending order in the specified chain.

Rules assume only three defaults -- the default table is filter,the default chain is INPUT and the default action is ACCEPT. So creating an empty rule will always result in the rule -A INPUT -j ACCEPT being generated in the filter table.

The module also takes into account when IPv6 address are supplied, and will generate IPv6 rules accordingly. If you specify options that are only valid for IPv4, it will throw an error (hopefully a useful one -- if not, file an issue!). We'd rather throw an error and make you aware of an issue early on, then to discover later that your rule only partially applied.

Examples

The following rules will create a chain ADMIN in addition to the INPUT and OUTPUT chains, and will place any incoming packets from $admin_network onto the ADMIN chain for processing. Admins should be allowed $admin_ports over tcp protocol.

$admin_network = '10.0.0.0/24,2001:db8:1000::/64'
$admin_ports = '22,636,5666'

iptables::rule { 'allow admin ssh':
  comment          => 'Allow admin workstations to connect to admin ports',
  order            => '100',
  protocol         => 'tcp',
  destination_port => $admin_ports,
  chain            => 'ADMIN',
}

iptables::rule { 'SA network jumps to ADMIN chain':
  comment          => 'SA workstations should traverse the ADMIN chain',
  order            => '10',
  destination_port => '22',
  protocol         => 'tcp',
  action           => 'ADMIN',
  source           => $admin_network,
}

iptables::rule { 'allow-puppet-local':
  comment          => 'Reject SSH from all other workstations',
  order            => '150',
  destination_port => '22',
  protocol         => 'tcp',
  action           => 'REJECT',
}

# place some outbound restrictions
iptables::rule { 'allow-outbound-smtp':
  comment          => 'only allow smtp to our internal mail servers',
  order            => '500',
  destination_port => '25',
  protocol         => 'tcp',
  destination      => '10.0.10.10,10.0.10.11,2001:db8:1001::10/126',
  action           => 'ACCEPT',
  chain            => 'OUTPUT',
}

iptables::rule { 'restrict-outbound-smtp':
  comment          => 'do not allow any further smtp outbound',
  order            => '999',
  destination_port => '25',
  protocol         => 'tcp',
  action           => 'REJECT',
  chain            => 'OUTPUT,
}

License

See LICENSE file

Copyright

Copyright © 2013 The Regents of the University of California

Contact

Aaron Russo arusso@berkeley.edu

Support

Please log tickets and issues at the Projects site

2013-09-19 Aaron Russo arusso@berkeley.edu - 1.0.1

• issue #18 - add parameter strict_protocol_checking

2013-08-05 Aaron Russo arusso@berkeley.edu - 1.0.0

• issue #8 - Protocol must be specified when providing sport or dport
• issue #17 - invalid source/destination ip can generate undesired rules

2013-07-29 Aaron Russo arusso@berkeley.edu - 0.9.6

• issue #15 - travis-ci integration is broken
• issue #16 - rules containing ipv4 hosts are creating match-all ipv6 rules
• Added LICENSE and Copyright information
• Added testing for Puppet 3.x
• Removed testing for Puppet 2.6

2013-07-25 Aaron Russo arusso@berkeley.edu - 0.9.5

• issue #14 - multiple destination addresses generated bad rules
• issue #13 - symlinks break puppetdoc

2013-06-14 Aaron Russo arusso@berkeley.edu - 0.9.4

• fixed issue where using log_prefix could generate an invalid rule

2013-06-13 Aaron Russo arusso@berkeley.edu - 0.9.3

• fixed error in logic that didnt have rules applying in certain cases

2013-06-07 Aaron Russo arusso@berkeley.edu - 0.9.2

• bugfixes only fixed:
• reject_with parameter has no affect (Issue #10)

2013-06-06 Aaron Russo arusso@berkeley.edu - 0.9.1

• bugfixes only fixed:
• potential for unwanted rules to be generated (Issue #9)
• comments no appearing (Issue #7)

2013-06-06 Aaron Russo arusso@berkeley.edu - 0.9.0

• major rewrite of code fixed:
• group entries by table AND chain (Issue #2)
• ip6tables support (Issue #3)
• move logic out of template (Issue #6)

2013-06-02 Aaron Russo arusso@berkeley.edu - 0.0.3

• travis-ci support

2013-04-30 Aaron Russo arusso@berkeley.edu - 0.0.2

• Improve RegEx validation code and fix bug with source port (ajacques)

2013-04-29 Aaron Russo arusso@berkeley.edu - 0.0.1

• Initial Release