Version information
Start using this module
Add this module to your Puppetfile:
mod 'arusso-iptables', '1.0.1'
Learn more about managing modules with a PuppetfileDocumentation
iptables Firewall Module
This is yet another iptables module for Puppet. It supports both IPv4 and IPv6 and tries to maintain compatibility with iptables/ip6tables v1.3.5 and above.
Why Another iptables Modules?
Mostly because some of us don't like modifying the running rules directly, and instead would prefer to modify the on-disk rules. This has the advantage of allowing us to comment them inside of the rule file itself, making them easier to read in cases of debugging. Unfortunately, some hosts will always be snowflakes, so this is a big plus for some.
Second, we can expose a more iptables-specific interface in our objects, making it easier to read what you're doing inside of your manifests files.
Lastly, I've tried very hard to do as much error-checking as possible, so that we catch the errors before being deployed to the host. If you come up with a combination of parameters that puts an entry into the iptables file that causes an error, please file an issue.
Usage
The foundation of this module is understanding every rule has an order, from 000-999, and that the rules will be placed in ascending order in the specified chain.
Rules assume only three defaults -- the default table is filter
,the default
chain is INPUT
and the default action is ACCEPT
. So creating an empty rule
will always result in the rule -A INPUT -j ACCEPT
being generated in the
filter
table.
The module also takes into account when IPv6 address are supplied, and will generate IPv6 rules accordingly. If you specify options that are only valid for IPv4, it will throw an error (hopefully a useful one -- if not, file an issue!). We'd rather throw an error and make you aware of an issue early on, then to discover later that your rule only partially applied.
Examples
The following rules will create a chain ADMIN
in addition to the INPUT
and
OUTPUT
chains, and will place any incoming packets from $admin_network
onto
the ADMIN
chain for processing. Admins should be allowed $admin_ports
over
tcp protocol.
$admin_network = '10.0.0.0/24,2001:db8:1000::/64'
$admin_ports = '22,636,5666'
iptables::rule { 'allow admin ssh':
comment => 'Allow admin workstations to connect to admin ports',
order => '100',
protocol => 'tcp',
destination_port => $admin_ports,
chain => 'ADMIN',
}
iptables::rule { 'SA network jumps to ADMIN chain':
comment => 'SA workstations should traverse the ADMIN chain',
order => '10',
destination_port => '22',
protocol => 'tcp',
action => 'ADMIN',
source => $admin_network,
}
iptables::rule { 'allow-puppet-local':
comment => 'Reject SSH from all other workstations',
order => '150',
destination_port => '22',
protocol => 'tcp',
action => 'REJECT',
}
# place some outbound restrictions
iptables::rule { 'allow-outbound-smtp':
comment => 'only allow smtp to our internal mail servers',
order => '500',
destination_port => '25',
protocol => 'tcp',
destination => '10.0.10.10,10.0.10.11,2001:db8:1001::10/126',
action => 'ACCEPT',
chain => 'OUTPUT',
}
iptables::rule { 'restrict-outbound-smtp':
comment => 'do not allow any further smtp outbound',
order => '999',
destination_port => '25',
protocol => 'tcp',
action => 'REJECT',
chain => 'OUTPUT,
}
License
See LICENSE file
Copyright
Copyright © 2013 The Regents of the University of California
Contact
Aaron Russo arusso@berkeley.edu
Support
Please log tickets and issues at the Projects site
2013-09-19 Aaron Russo arusso@berkeley.edu - 1.0.1
- issue #18 - add parameter strict_protocol_checking
2013-08-05 Aaron Russo arusso@berkeley.edu - 1.0.0
- issue #8 - Protocol must be specified when providing sport or dport
- issue #17 - invalid source/destination ip can generate undesired rules
2013-07-29 Aaron Russo arusso@berkeley.edu - 0.9.6
- issue #15 - travis-ci integration is broken
- issue #16 - rules containing ipv4 hosts are creating match-all ipv6 rules
- Added LICENSE and Copyright information
- Added testing for Puppet 3.x
- Removed testing for Puppet 2.6
2013-07-25 Aaron Russo arusso@berkeley.edu - 0.9.5
- issue #14 - multiple destination addresses generated bad rules
- issue #13 - symlinks break puppetdoc
2013-06-14 Aaron Russo arusso@berkeley.edu - 0.9.4
- fixed issue where using log_prefix could generate an invalid rule
2013-06-13 Aaron Russo arusso@berkeley.edu - 0.9.3
- fixed error in logic that didnt have rules applying in certain cases
2013-06-07 Aaron Russo arusso@berkeley.edu - 0.9.2
- bugfixes only fixed:
- reject_with parameter has no affect (Issue #10)
2013-06-06 Aaron Russo arusso@berkeley.edu - 0.9.1
- bugfixes only fixed:
- potential for unwanted rules to be generated (Issue #9)
- comments no appearing (Issue #7)
2013-06-06 Aaron Russo arusso@berkeley.edu - 0.9.0
- major rewrite of code fixed:
- group entries by table AND chain (Issue #2)
- ip6tables support (Issue #3)
- move logic out of template (Issue #6)
2013-06-02 Aaron Russo arusso@berkeley.edu - 0.0.3
- travis-ci support
2013-04-30 Aaron Russo arusso@berkeley.edu - 0.0.2
- Improve RegEx validation code and fix bug with source port (ajacques)
2013-04-29 Aaron Russo arusso@berkeley.edu - 0.0.1
- Initial Release
Dependencies
- ripienaar/concat (>= 0.2.0)
- puppetlabs/stdlib (>= 2.6.0)
- arusso/oski (>= 0.0.1)
The MIT License (MIT) Copyright (c) 2013 The Regents of the University of California Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.