Name: iptables
Owner: LinuxONE and Linux on z Systems Open-source Team
Description: Development repository for Chef Cookbook iptables
Created: 2016-04-12 16:32:27.0
Updated: 2016-04-12 16:32:28.0
Pushed: 2016-04-13 04:34:26.0
Homepage: https://supermarket.chef.io/cookbooks/iptables
Size: 143
Language: Ruby
GitHub Committers
| User | Most Recent Commit | # Commits |
|---|
Other Committers
| User | Most Recent Commit | # Commits |
|---|
Installs iptables and provides a custom resource for adding and removing iptables rules
The default recipe will install iptables and provides a ruby script (installed in /usr/sbin/rebuild-iptables) to manage rebuilding firewall rules from files dropped off in /etc/iptables.d.
The disabled recipe will install iptables, disable the iptables service (on RHEL platforms), and delete the rules directory /etc/iptables.d.
default['iptables']['iptables_sysconfig'] and default['iptables']['iptables_sysconfig'] are hashes that are used to template /etc/sysconfig/iptables-config and /etc/sysconfig/ip6tables-config. The keys must be upper case and any key / value pair included will be added to the config file.
The custom resource drops off a template in /etc/iptables.d after the name parameter. The rule will get added to the local system firewall through notifying the rebuild-iptables script. See Examples below.
NOTE: In the 1.0 release of this cookbook the iptables_rule definition was converted to a custom resource. This changes the behavior of disabling iptables rules. Previously a rule could be disabled by specifying enable false. You must now specify action :disable
Add recipe[iptables] to your runlist to ensure iptables is installed / running and to ensure that the rebuild-iptables script is on the system. Then create use iptables_rule to add individual rules. See Examples.
Since certain chains can be used with multiple tables (e.g., PREROUTING), you might have to include the name of the table explicitly (i.e., nat, mangle, etc.), so that the /usr/sbin/rebuild-iptables script can infer how to assemble final ruleset file that is going to be loaded. Please note, that unless specified otherwise, rules will be added under the filter table by default.
To enable port 80, e.g. in an my_httpd cookbook, create the following template:
rt 80 for http
WR -p tcp -m tcp --dport 80 -j ACCEPT
This template would be located at: my_httpd/templates/default/http.erb. Then within your recipe call:
bles_rule 'http' do
tion :enable
To redirect port 80 to local port 8080, e.g., in the aforementioned my_httpd cookbook, create the following template:
direct anything on eth0 coming to port 80 to local port 8080
REROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
Please note, that we explicitly add name of the table (being *nat in this example above) where the rules should be added.
This would most likely go in the cookbook, my_httpd/templates/default/http_8080.erb. Then to use it in recipe[httpd]:
bles_rule 'http_8080' do
tion :enable
To create a rule without using a template resource use the lines property:
bles_rule 'http_8080' do
nes '-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080'
To get attribute-driven rules you can (for example) feed a hash of attributes into named iptables.d files like this:
.default['iptables']['http_80'] = '-A FWR -p tcp -m tcp --dport 80 -j ACCEPT'
.default['iptables']['http_443'] = [
an example with multiple lines',
A FWR -p tcp -m tcp --dport 443 -j ACCEPT',
['iptables'].map do |rule_name, rule_body|
tables_rule rule_name do
lines [ rule_body ].flatten.join("\n")
d
Author: Cookbook Engineering Team (cookbooks@chef.io)
Copyright: 2008-2015, Chef Software, Inc.
nsed under the Apache License, Version 2.0 (the "License");
may not use this file except in compliance with the License.
may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
ss required by applicable law or agreed to in writing, software
ributed under the License is distributed on an "AS IS" BASIS,
OUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
the License for the specific language governing permissions and
tations under the License.