Forge Home

Modules

Resources

PuppetEcosystemPuppet CommunityUpdates

firewalld

Configure firewalld zones and rich rules
Project URLRSS FeedReport issues

501,968 downloads

177,184 latest version

2.8 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 3.4.0 (latest)
  • 3.3.2
  • 3.3.1
  • 3.3.0
  • 3.2.1
  • 3.2.0
  • 3.1.8
  • 3.1.7
  • 3.1.6
  • 3.1.5
  • 3.1.4
  • 3.1.3
  • 3.1.2
  • 3.1.1
  • 3.1.0
  • 3.0.2
  • 3.0.1
  • 3.0.0
  • 2.2.0
  • 2.1.1
  • 2.1.0
  • 2.0.0
  • 1.2.3
  • 1.2.2
  • 1.2.1
  • 1.2.0
  • 1.1.1
  • 1.1.0
  • 1.0.0
  • 0.1.0 (deleted)
  • 0.0.2
  • 0.0.1
released Mar 3rd 2015
This version is compatible with:
This module has been deprecated by its author since Oct 21st 2019.

The reason given was: Migrated to Vox Pupuli

The author has suggested puppet-firewalld as its replacement.

Start using this module

Tags: security, rhel, firewall, firewalld

Documentation

crayfishx/firewalld — version 0.0.1 Mar 3rd 2015

Module: firewalld

Description

This module manages firewalld, the userland interface that replaces iptables and ships with RHEL7. The module manages firewalld itself as well as providing types and providers for managing firewalld zones and rich rules.

Usage

The firewalld module contains types and providers to manage zones and rich rules by interfacing with the firewall-cmd command. The following types are currently supported. Note that all zone and rules management is done in --permanent mode.

Firewalld Zones

Firewalld zones can be managed with the firewalld_zone resource type.

Example:

  firewalld_zone { 'restricted':
    ensure => present,
    target => '%%REJECT%%',
    purge_rich_rules => true,
  }

Parameters:

  • target: Specify the target of the zone
  • purge_rich_rules: Optional, and defaulted to false. When true any configured rich rules found in the zone that do not match what is in the Puppet catalog will be purged.

Firewalld rich rules

Firewalld rich rules are managed using the firewalld_rich_rule resource type

firewalld_rich_rules will autorequire the firewalld_zone specified in the zone parameter so there is no need to add dependancies for this

Example:

  firewalld_rich_rule { 'Accept SSH from barny':
    ensure => present,
    zone   => 'restricted',
    source => '192.168.1.2/32',
    service => 'ssh',
    action  => 'accept',
  }

Parameters:

  • zone: Name of the zone this rich rule belongs to

  • family: Protocol family, defaults to ipv4

  • source: Source address information. This can be a hash containing the keys address and invert, or a string containing just the IP address

       source => '192.168.2.1',

   source => { 'address' => '192.168.1.1', 'invert' => true }

  • dest: Source address information. This can be a hash containing the keys address and invert, or a string containing just the IP address

       dest => '192.168.2.1',

   dest => { 'address' => '192.168.1.1', 'invert' => true }

  • log: When set to true will enable logging, optionally this can be hash with prefix, level and limit

       log => { 'level' => 'debug', 'prefix' => 'foo' },

   log => true,

  • audit: When set to true will enable auditing, optionally this can be hash with limit

       audit => { 'limit' => '3/s' },

   audit => true,

  • action: A string containing the action accept, reject or drop. For reject it can be optionally supplied as a hash containing type

       action => 'accept'

   action => { 'action' => 'reject', 'type' => 'bad' }

The following paramters are the element of the rich rule, only one may be used.

  • service: Name of the service

  • port: A hash containing port and protocol values

       port => {
     'port' => 80,
     'protocol' => 'tcp',
   },

  • icmp_block: Specify an icmp-block for the rule

  • masquerade: Set to true or false to enable masquerading

  • forward_port: Set forward-port, this should be a hash containing port,protocol,to_port,to_addr

       forward_port => {
     'port' => '8080',
     'protocol' => 'tcp',
     'to_addr' => '10.2.1.1',
     'to_port' => '8993'
   },

Limitations / TODO (PR's welcome!)

  • Currently only target is a managable property for a zone

Author