cookbook 'iptables', '= 0.14.1'
iptables
(41) Versions
0.14.1
-
Follow132
Installs the iptables daemon and provides resources for managing rules
cookbook 'iptables', '= 0.14.1', :supermarket
knife supermarket install iptables
knife supermarket download iptables
Description
Sets up iptables to use a script to maintain firewall rules. However
this cookbook may be deprecated or heavily modified in favor of the
general firewall cookbook, see Roadmap.
Roadmap
- [COOK-652] - create a firewall cookbook
- [COOK-688] - create iptables providers for all resources
Requirements
Platform:
- Ubuntu/Debian
- RHEL/CentOS
Recipes
default
The default recipe will install iptables and provides a ruby script
(installed in /usr/sbin/rebuild-iptables) to manage rebuilding
firewall rules from files dropped off in /etc/iptables.d.
Definitions
See Roadmap for plans to replace the definition with LWRPs.
iptables_rule
The definition drops off a template in /etc/iptables.d after the
name parameter. The rule will get added to the local system firewall
through notifying the rebuild-iptables script. See Examples below.
Usage
Ensure that the system is set up to use the definition and rebuild
script with recipe[iptables]. Then create templates with the
firewall rules in the cookbook where the definition will be used. See
Examples.
Since certain chains can be used with multiple tables (e.g., PREROUTING),
you might have to include the name of the table explicitly (i.e., *nat,
*mangle, etc.), so that the /usr/sbin/rebuild-iptables script can infer
how to assemble final ruleset file that is going to be loaded. Please note,
that unless specified otherwise, rules will be added under the filter
table by default.
Examples
To enable port 80, e.g. in an httpd cookbook, create the following
template:
# Port 80 for http
-A FWR -p tcp -m tcp --dport 80 -j ACCEPT
This would go in the cookbook,
httpd/templates/default/http.erb. Then to use it in
recipe[httpd]:
iptables_rule "http"
To redirect port 80 to local port 8080, e.g., in the aforementioned httpd
cookbook, created the following template:
*nat
# Redirect anything on eth0 coming to port 80 to local port 8080
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
Please note, that we explicitly add name of the table (being *nat in this
example above) where the rules should be added.
This would most likely go in the cookbook,
httpd/templates/default/http_8080.erb. Then to use it in
recipe[httpd]:
iptables_rule "http_8080"
Attributes
default["iptables"]["install_rules"] = true # install the default rules
License and Author
Author:: Adam Jacob adam@opscode.com
Author:: Joshua Timberman joshua@opscode.com
Copyright:: 2008-2011, Opscode, Inc
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Dependent cookbooks
This cookbook has no specified dependencies.
Contingent cookbooks
v0.14.1 (2015-01-01)
- Fixing File.exists is deprecated for File.exist
v0.14.0 (2014-08-31)
- [#14] Adds basic testing suite including Berksfile
- [#14] Adds basic integration/post-converge tests
- [#14] Adds default prefix and postfix rules to disalow traffic
v0.13.2 (2014-04-09)
- [COOK-4496] Added Amazon Linux support
v0.13.0 (2014-03-19)
- [COOK-3927] Substitute Perl version of rebuild-iptables with Ruby version
v0.12.2 (2014-03-18)
- [COOK-4411] - Add newling to iptables.snat
v0.12.0
- [COOK-2213] - iptables disabled recipe
v0.11.0
- [COOK-1883] - add perl package so rebuild script works
v0.10.0
- [COOK-641] - be able to save output on rhel-family
- [COOK-655] - use a template from other cookbooks
v0.9.3
- Current public release.
Foodcritic Metric
0.14.1 failed this metric
FC001: Use strings in preference to symbols to access node attributes: /tmp/cook/1438b4e80c06a03c678d240e/iptables/recipes/default.rb:45
FC015: Consider converting definition to a LWRP: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:1
FC019: Access node attributes in a consistent manner: /tmp/cook/1438b4e80c06a03c678d240e/iptables/recipes/default.rb:45
FC031: Cookbook without metadata file: /tmp/cook/1438b4e80c06a03c678d240e/iptables/metadata.rb:1
FC043: Prefer new notification syntax: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:20
FC043: Prefer new notification syntax: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:23
FC045: Consider setting cookbook name in metadata: /tmp/cook/1438b4e80c06a03c678d240e/iptables/metadata.rb:1
0.14.1 failed this metric
FC015: Consider converting definition to a LWRP: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:1
FC019: Access node attributes in a consistent manner: /tmp/cook/1438b4e80c06a03c678d240e/iptables/recipes/default.rb:45
FC031: Cookbook without metadata file: /tmp/cook/1438b4e80c06a03c678d240e/iptables/metadata.rb:1
FC043: Prefer new notification syntax: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:20
FC043: Prefer new notification syntax: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:23
FC045: Consider setting cookbook name in metadata: /tmp/cook/1438b4e80c06a03c678d240e/iptables/metadata.rb:1
