cookbook 'iptables', '= 2.0.0'
iptables
(41) Versions
2.0.0
-
Follow132
Installs the iptables daemon and provides resources for managing rules
cookbook 'iptables', '= 2.0.0', :supermarket
knife supermarket install iptables
knife supermarket download iptables
iptables Cookbook
Installs iptables and provides a custom resource for adding and removing iptables rules
Requirements
Platforms
- Ubuntu/Debian
- RHEL/CentOS and derivatives
Chef
- Chef 12+
Cookbooks
- compat_resource
Recipes
default
The default recipe will install iptables and provides a ruby script
(installed in /usr/sbin/rebuild-iptables
) to manage rebuilding
firewall rules from files dropped off in /etc/iptables.d
.
Custom Resource
rule
The custom resource drops off a template in /etc/iptables.d
after the
name
parameter. The rule will get added to the local system firewall
through notifying the rebuild-iptables
script. See Examples below.
NOTE: In the 1.0 release of this cookbook the iptables_rule definition was
converted to a custom resource. This changes the behavior of disabling
iptables rules. Previously a rule could be disabled by specifying enable false
.
You must now specify action :disable
Usage
Add recipe[iptables]
to your runlist to ensure iptables is installed / running
and to ensure that the rebuild-iptables
script is on the system.
Then create use iptables_rule to add individual rules. See Examples.
Since certain chains can be used with multiple tables (e.g., PREROUTING),
you might have to include the name of the table explicitly (i.e., *nat,
*mangle, etc.), so that the /usr/sbin/rebuild-iptables
script can infer
how to assemble final ruleset file that is going to be loaded. Please note,
that unless specified otherwise, rules will be added under the filter
table by default.
Examples
To enable port 80, e.g. in an my_httpd
cookbook, create the following
template:
# Port 80 for http
-A FWR -p tcp -m tcp --dport 80 -j ACCEPT
This template would be located at:
my_httpd/templates/default/http.erb
. Then within your recipe call:
iptables_rule 'http' do
action :enable
end
To redirect port 80 to local port 8080, e.g., in the aforementioned my_httpd
cookbook, create the following template:
*nat
# Redirect anything on eth0 coming to port 80 to local port 8080
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
Please note, that we explicitly add name of the table (being *nat in this
example above) where the rules should be added.
This would most likely go in the cookbook,
my_httpd/templates/default/http_8080.erb
. Then to use it in
recipe[httpd]
:
iptables_rule 'http_8080' do
action :enable
end
License & Authors
Author: Cookbook Engineering Team (cookbooks@chef.io)
Copyright: 2008-2015, Chef Software, Inc.
```
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
```
iptables Cookbook CHANGELOG
This file is used to list changes made in each version of the iptables cookbook.
v2.0.0 (2015-10-21)
- Migrated LWRP to Chef 12.5 custom resources format with backwards compatibility provided via compat_resource cookbook to 12.X family
- Added Start / enable of iptables service in the default recipe when on RHEL based systems and the management of /etc/sysconfig/iptables so the service can start
- Added removal of /etc/iptables.d/ to the disabled recipe to allow for reenabling later on
- Modified the iptables service disable in the disable recipe to only run when on RHEL based systems
- Expanded the serverspec tests and test kitchen suites to better test rules custom resource and disable recipe
v1.1.0 (2015-10-05)
- Fixed metadata description of the default recipe
- Added Kitchen CI config
- Added Chefspec unit tests
- Updated to our standard Rubocop config and resolve all warnings
- Added Travis CI config for lint / unit testing on Ruby 2/2.1/2.2
- Updated Contributing and Testing docs
- Added a maintainers doc
- Added a Gemfile with development and testing dependencies
- Added cookbook version and Travis CI badges to the readme
- Clarified in the readme that the minimum supported Chef release is 11.0
- Added a Rakefile easier testing
- Added a chefignore file to limit files that are uploaded to the Chef server
- Update to modern notification format to resolve Foodcritic warnings
- Added source_url and issues_url to the metadata for Supermarket
- Removed pre-Ruby 1.9 hash rockets
v1.0.0 (2015-04-29)
NOTE: This release includes breaking changes to the behavior of this cookbook.
The iptables_rule definition was converted to a LWRP. This changes the behavior
of disabling iptables rules. Previously a rule could be disabled by specifying
enable false
. You must now specify action :disable
. Additionally the cookbook
no longer installs the out of the box iptables rules. These were rules made assumptions
about the operating environment and should not have been installed out of the box.
This makes this recipe a library cookbook that can be better wrapped to meet the needs
or your particular environment.
- Definition converted to a LWRP to providing why-run support and
- The out of the box iptables rules are no longer installed. If you need these rules you'll need to wrap the cookbook and use the LWRP to define these same rules.
- Removed all references to the roadmap and deprecation of the cookbook. It's not going anywhere any time soon
- Use platform_family to better support Debian derivatives
- Converted file / directory modes to strings to preserve the leading 0
- Added additional RHEL derivitive distributions to the metadata
- Expanded excluded files in the gitignore and chefignore files
- Included the latest contributing documentation to match the current process
v0.14.1 (2015-01-01)
- Fixing File.exists is deprecated for File.exist
v0.14.0 (2014-08-31)
- [#14] Adds basic testing suite including Berksfile
- [#14] Adds basic integration/post-converge tests
- [#14] Adds default prefix and postfix rules to disalow traffic
v0.13.2 (2014-04-09)
- [COOK-4496] Added Amazon Linux support
v0.13.0 (2014-03-19)
- [COOK-3927] Substitute Perl version of rebuild-iptables with Ruby version
v0.12.2 (2014-03-18)
- [COOK-4411] - Add newling to iptables.snat
v0.12.0
- [COOK-2213] - iptables disabled recipe
v0.11.0
- [COOK-1883] - add perl package so rebuild script works
v0.10.0
- [COOK-641] - be able to save output on rhel-family
- [COOK-655] - use a template from other cookbooks
v0.9.3
- Current public release.
Foodcritic Metric
2.0.0 failed this metric
FC016: LWRP does not declare a default action: /tmp/cook/47b5fdb835c7b7b9f641e6a2/iptables/resources/rule.rb:1
2.0.0 failed this metric