I'm using puppetlabs firewall module and I'm having troubles setting up iptables for a simple web host.
I'm following this guide and want to set up additional rules. https://sysadmincasts.com/episodes/18-managing-iptables-with-puppet
For example, I've added rules to allow outgoing traffic with git and mysql ports:
firewall { '200 allow outgoing mysql':
chain => 'OUTPUT',
state => ['NEW'],
proto => 'tcp',
dport => '3306',
action => 'accept',
}
firewall { '200 allow outgoing git':
chain => 'OUTPUT',
state => ['NEW'],
dport => '9418',
proto => 'tcp',
action => 'accept',
}
and looking in iptables, I can see the following rules:
root@app01:~/geppetto# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 /* 000 accept all icmp */
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 001 accept all to lo interface */
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 003 accept related established rules */ state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80 /* 200 allow incoming http */ state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22 /* 200 allow openssh */ state NEW
LOG all -- 0.0.0.0/0 0.0.0.0/0 /* 900 log dropped input chain */ LOG flags 0 level 6 prefix "[IPTABLES INPUT] dropped "
DROP all -- 0.0.0.0/0 0.0.0.0/0 /* 910 deny all other input requests */
Chain FORWARD (policy ACCEPT)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 /* 900 log dropped forward chain */ LOG flags 0 level 6 prefix "[IPTABLES FORWARD] dropped "
DROP all -- 0.0.0.0/0 0.0.0.0/0 /* 910 deny all other forward requests */
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 004 accept related established rules */ state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 53 /* 200 allow outgoing dns lookups */ state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 9418 /* 200 allow outgoing git */ state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80 /* 200 allow outgoing http */ state NEW
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 /* 200 allow outgoing icmp type 8 (ping) */ icmptype 8
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 3306 /* 200 allow outgoing mysql */ state NEW
LOG all -- 0.0.0.0/0 0.0.0.0/0 /* 900 log dropped output chain */ LOG flags 0 level 6 prefix "[IPTABLES OUTPUT] dropped "
DROP all -- 0.0.0.0/0 0.0.0.0/0 /* 910 deny all other output requests */
However, I can't access anything with git from the machine. Running git fetch origin just times out. Do I have to set up some rules for the outgoing source port as well? Thanks in advance!