chef firehol cookbook

Inspired by official firewall cookbook.

Requirements

• Chef 12.5+
• Ubuntu 16.04

Usage

Firewall resource is mandatory (currently name is ignored):

firewall "firehol" do
  version 6
end

At least one interface should be added:

firewall_interface "world" do
  interface "any" # system network interface
end

Rules can be added as described:

firewall_rule "allow outgoing connections" do
  command   "accept"
  interface "world"
  service   "all"
  type      "client"
end

Custom services can be added with server ports as string:

firewall_service "mosh" do
  server_ports "udp/60000:61000"
end

Or hash:

firewall_service "minidlna" do
  server_ports tcp: %w(1900 8200),
               udp: %w(1900 5353 8200)
end

Routers can be created as shown:

secondary_interface =
  node[:network][:interfaces].keys.find { |interface| !["lo", node[:network][:default_interface]].include? interface }

firewall_router "home2internet" do
  inface     secondary_interface
  outface    node[:network][:default_interface]
  masquerade true
end

firewall_router "internet2home" do
  inface             node[:network][:default_interface]
  outface            secondary_interface
  reverse_masquerade true
end

firewall_rule "home2internet ssh" do
  command   "accept"
  interface "home2internet"
  service   "ssh"
  type      "client"
end

firewall_rule "home2internet route" do
  command   "accept"
  interface "home2internet"
  service   "all"
  type      "route"
end

firewall_rule "internet2home all" do
  command   "accept"
  interface "internet2home"
  service   "all"
  type      "client"
end

firewall_rule "internet2home reject ident" do
  command   "reject with tcp-reset"
  interface "internet2home"
  service   "ident"
  type      "route"
end

In result firehol.conf will be generated:

# File generated by Chef, all changes will be overwritten

FIREHOL_LOG_MODE="LOG"
FIREHOL_LOG_LEVEL="crit"

version 6

client_mosh_ports="default"
server_mosh_ports="udp/60000:61000"
client_minidlna_ports="default"
server_minidlna_ports="tcp/1900 tcp/8200 udp/1900 udp/5353 udp/8200"

interface any world
        server ssh accept # accept ssh connections
        client all accept # allow outgoing connections


router home2internet inface enp0s8 outface enp0s3
        masquerade
        client ssh accept # home2internet ssh
        route all accept # home2internet route

router internet2home inface enp0s3 outface enp0s8
        masquerade reverse
        client all accept # internet2home all
        route ident reject with tcp-reset # internet2home reject ident

Testing

$ bundle install
$ guard
[1] guard(main)> all
$ kitchen verify