Forge Home

iptables

This module installs and manages iptables. Check README.rdoc for details. Puppi is required for some common functions: you can install them without using the whole module.

75,467 downloads

22,795 latest version

3.5 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 2.1.15 (latest)
  • 2.1.14
  • 2.1.13
  • 2.1.12
  • 2.1.11
  • 2.1.10
  • 2.1.9
  • 2.1.4
  • 2.1.3
  • 2.1.2
  • 2.1.1
  • 2.0.1
released Aug 12th 2016
This version is compatible with:
    This module has been deprecated by its author since Oct 28th 2019.

    The reason given was: No longer maintained

    The author has suggested puppetlabs-firewall as its replacement.

    Start using this module

    Documentation

    example42/iptables — version 2.1.15 Aug 12th 2016

    Deprecation notice

    This module was designed for Puppet versions 2 and 3. It should work also on Puppet 4 but doesn't use any of its features.

    The current Puppet 3 compatible codebase is no longer actively maintained by example42.

    Still, Pull Requests that fix bugs or introduce backwards compatible features will be accepted.

    Puppet module: iptables

    This is a Puppet module for iptables based on the second generation layout ("NextGen") of Example42 Puppet Modules.

    Made by Alessandro Franceschi / Lab42

    Official site: http://www.example42.com

    Official git repository: http://github.com/example42/puppet-iptables

    Released under the terms of Apache 2 License.

    This module requires functions provided by the Example42 Puppi module (you need it even if you don't use and install Puppi)

    DESCRIPTION:

    This module manages iptables. In order to have functionality and flexibility some design decisions have been enforced:

    • Rules are based on a iptables-save format file.
    • On RedHat/Centos systems it has been followed the standard iptables service approach
    • On Debian/Ubuntu the same approach is achived via the iptables-persistent package
    • Custom firewall solutions and builders are ignored or disabled (Shorewall, Ufw...)

    The rules configuration can be made in two ways:

    • File Mode: Providing custom iptables files (as static files or templates)
    • Concat Mode: Buildind up rules files with concat (this is the default choice and allows dynamic automatic firewalling rules with Example42 firewall extension)

    USAGE - Overrides and Customizations

    • Default usage (Concat mode). It follows these defaults:
      • Default policy is ACCEPT (to permit reachability in case of syntax errors)
      • Last rule of every chain is a DENY as defined by $iptables_block_policy
      • Intermediate rules are generally ACCEPTs
      • Localhost and established traffic is ALLOWED

    So a simple:

        class { 'iptables':
        }
    
    • Allows SSH access on port TCP 22
    • Allows ping and all ICMP packets
    • Allows localhost and established traffic
    • Allows outbound traffic
    • Allows multicast and broadcast traffic
    • Blocks everything else
    • Use custom sources for iptables file

        class { 'iptables':
          config => 'file', # This is needed to activate file mode
          source => [ "puppet:///modules/lab42/iptables/iptables-${hostname}" , "puppet:///modules/lab42/iptables/iptables" ], 
        }
      
    • Use custom template for iptables file. Note that template and source arguments are alternative.

        class { 'iptables':
          config => 'file', # This is needed to activate file mode
          template => 'example42/iptables/iptables.conf.erb',
        }
      
    • Automatically include a custom subclass

        class { 'iptables':
          my_class => 'iptables::example42',
        }
      

    ###usage with Hiera Make sure you include the iptables class. Than you can rules as a hash with the rules you want, for example:

    classes:
      - iptables
    
    iptables::rules:
      ACCEPT80:
         source: '192.168.0.0/24'
         port:   '80'
      CUSTOM1234:
         rule:   '-m tcp -p tcp --dport 1234 -m comment --comment "This is a custom rule to do ..."' 
    

    This examples expect you to load the classes that are mentioned in the classes array (This is well explained in puppetlabs doc).

    CONCAT MODE SPECIFIC USER VARIABLES:

    In concat mode some parameters define the general behaviour:

    • $block_policy *

    Define what to do with packets not expressively accepted:

    • drop (Default) - DROP them silently

    • reject - REJECT them with ICMP unreachable

    • accept - ACCEPT them (Beware, if you do this you have no firewall :-)

    • $icmp_policy *

    Define what to to with ICMP packets

    • drop - DROP them all

    • safe - ALLOW all ICMP types except echo & reply (Ping)

    • accept (Default) - ACCEPT them all

    • $output_policy *

    Define what to to with outbound packets

    • drop - DROP them (except for established and localhost

    • accept (Default) - ACCEPT them

    • $log *

    Define what you what to log (all | dropped | none)

    • $log_level *

    Define the level of logging (numeric or see syslog.conf(5))

    • $safe_ssh *

    Define if you want to force the precence of a rule that allows access to SSH port (tcp/22).

    • $broadcast_policy *

    Define what to do with INPUT broadcast packets

    • drop - Treat them with the $iptables_block_policy

    • accept (Default) - Expressely ACCEPT them

    • $multicast_policy *

    Define what to do with INPUT multicast

    • "drop" - Treat them with the $iptables_block_policy
    • "accept" (Default) - Expressely ACCEPT them

    So for example for a stricter setup, compared to default:

        class { 'iptables':
          config           => 'concat', # This enforces concat mode (Default value)
          safe_ssh         => false,
          broadcast_policy => 'drop',
          multicast_policy => 'drop',
          icmp_policy      => 'drop',
          output_policy    => 'drop',
        }
    

    IPv6 specific configuration

    In order to enable IPv6 there have to be configured two parts:

    • iptables should be IPv6 enabled: class{ 'iptables' : enable_v6 => true, }
    • then iptables::rules can be IPv6 enabled also: iptables::rule { 'http': port => '80', protocol => 'tcp', enable_v6 => true, }

    If specific source / destination adresses should be used, a definition will look like: iptables::rule { 'http': source => '10.42.0.0/24', source_v6 => '2001:0db8:3c4d:0015:0000:0000:abcd:ef12', destination => '$ipaddress_eth0', destination_v6 => '2001:470:27:37e::2/64', port => '80', protocol => 'tcp', enable_v6 => true, }

    Usage of iptables module with Example42 automatic firewalling

    The concat mode of this module is particularly useful when used with Example42's automatic firewalling features.

    You can enable them either setting a topscope variable or passing the firewall => true parameter to a (nextgen) class.

    You have also to set firewall_tool => 'iptables'.

    So, for example, you can enable site wide automatic firewalling with:

        $::firewall = true
        $::firewall_tool = 'iptables'
    

    and then whenever you add a NextGen Example42 module to a node, it's port is automatically openened (to every ip).

    If you want to have better control on who can access to that port, you can use the firewall_src parameter and you can define the destination IP with the firewall_dst one. For example the following accepts connections on MySql port only form 10.42.42.42/32 on eth1:

        class { 'mysql':
          firewall_src  => '10.42.42.42/32', # Allowed source
          firewall_dst  => $ipaddress_eth1,  # Destination IP (default is $ipaddress
        }
    

    Module specific defines

    All the single rules in Concat mode are managed by the iptables::rule define. You can use it to automatically allow access from all your nodes when you don't know their address upstream (for example in the cloud)

        @@firewall { $hostname:
          source => $ipaddress,
          tag    => prod,
        }
        Firewall <| tag == prod |>
    

    If you have a single node from where you want to ensure access you can also do something like:

        firewall { 'alfa': source => '42.42.42.42', }
    

    Build Status