Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone have experience setting up puppetlabs-firewall module on ubuntu 12.04?

The documentation on https://github.com/puppetlabs/puppetlabs-firewall states:

At the moment you need to provide some setup outside of what we provide in the module to support proper ordering, purging and firewall peristence.

So It is recommended that you provide the following in top scope somewhere (such as your site.pp):

# Always persist firewall rules
exec { 'persist-firewall':
  command     => $operatingsystem ? {
    'debian'          => '/sbin/iptables-save > /etc/iptables/rules.v4',
    /(RedHat|CentOS)/ => '/sbin/iptables-save > /etc/sysconfig/iptables',
  },
  refreshonly => true,
}
# These defaults ensure that the persistence command is executed after 
# every change to the firewall, and that pre & post classes are run in the
# right order to avoid potentially locking you out of your box during the
# first puppet run.
Firewall {
  notify  => Exec['persist-firewall'],
  before  => Class['my_fw::post'],
  require => Class['my_fw::pre'],
}
Firewallchain {
  notify  => Exec['persist-firewall'],
}

# Purge unmanaged firewall resources
#
# This will clear any existing rules, and make sure that only rules
# defined in puppet exist on the machine
resources { "firewall":
  purge => true
}

I'm having difficulties understanding what is does and how it works. When I'm putting this in the top scope it locks down all my puppet hosts. And I don't want to apply firewall rules with this module to all my puppet hosts, but just a subset for testing purposes. Since I'm using shorewall for most of my hosts and just trying out too control the firewall by puppet instead of by distributing shorewall config files. Does anyone have a working setup on ubuntu where I can assign a firewall to specific hosts with minimal duplication in configuring? An example would really help me out.

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

To fully understand how the module work look in the $module_path/firewall/lib/puppet/{type|proider}/* It's all written in Ruby. Even if you don't know the language it's quite straight forward to interpret.

As mentioned in the comment the additional code in your manifest it's a work around so the module works properly. I guess they had some issue to implements all the code directly in the type/provider via ruby. Makes sense to use the default iptables-save functionality, because it's much easier to reload the firewall setting after the restart and it works for most popular linux distributions.

Even if you copy/paste that code it shouldn't affect your current configuration, as long you don't use the resource type in the node default or in the node configuration. For test purpose include this code directly in the testing node. Should produce the same result. Above it's an example:

    Firewall {
      notify => Exec["persist-firewall"],
      before  => Class['my_fw::post'],
      require => Class['my_fw::pre'],
    }

    Firewallchain {
      notify  => Exec['persist-firewall'],
    }

    resources { "firewall":
      purge => true
    }

    firewall { '100 ssh 22':
      port => '22',
      proto => 'tcp',
      action => 'accept',
    }

    firewall { '100 www 80':
      port => '80',
      proto => 'tcp',
      action => 'accept',
    }

    firewall { '100 sql 5436':
      port => '5436',
      proto => 'tcp',
      action => 'accept',
    }

    firewall { '100 sql 5438':
      port => '5438',
      proto => 'tcp',
      action => 'accept',
    }

    firewall { '100 sql 5440':
      port => '5440',
      proto => 'tcp',
      action => 'accept',
    }

    exec { "persist-firewall":
      command => $operatingsystem ? {
        "debian" => "/sbin/iptables-save > /etc/iptables/rules.v4",
        /(RedHat|CentOS)/ => "/sbin/iptables-save > /etc/sysconfig/iptables",
      },
      refreshonly => 'true',
    }

In this example I am allowing 22, 80. 5436, 5438 INCOMING TCP connection.

share|improve this answer
    
Are you able to explain to me the before and require does?: Firewall { before => Class['my_fw::post'], require => Class['my_fw::pre'], } –  Vincent Jan 14 '13 at 10:54
    
Check the README from the original package. They use those two class in combination with stages to add default policy. Think of it as post and pre hooks. –  golja Jan 14 '13 at 12:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.