This puppet module installs an iptables ruleset on a host.
Rulesets are written in the format generated by the iptables-save command. This means you can write your ruleset interactively, then export it using iptables-save and have puppet restore the result automatically.
- Place the 'iptables/' folder in your modules directory
- Put your ruleset in the 'iptables/templates/' folder in a file named <ruleset>.iptables-save
- Load the '''iptables''' class with parameters in your host manifest
class { "iptables" : ruleset_name => "masquerade-example.iptables-save" ; }
An example ruleset is included in the source which loads a masquerade rule into the nat table.
- An optional boolean parameter 'ip_forward' can be set to true (default: false) that will enable ip-forwarding on the host
-
Designed for Debian/Ubuntu distributions and tested on Ubuntu Oneiric (11.10.) Some modifications would be needed for it to work on Red Hat derived distros.
-
Does NOT enforce a ruleset on a running host. The ruleset is installed into the iptables-persistent service and loaded only at installation time and then by iptables-persistent on subsequent boots.