iptables (11) Versions 0.14.1

Sets up iptables to use a script to maintain rules

cookbook 'iptables', '~> 0.14.1'
cookbook 'iptables', '~> 0.14.1'
knife cookbook site install iptables
knife cookbook site download iptables


Sets up iptables to use a script to maintain firewall rules. However this cookbook may be deprecated or heavily modified in favor of the general firewall cookbook, see Roadmap.


  • [COOK-652] - create a firewall cookbook
  • [COOK-688] - create iptables providers for all resources



  • Ubuntu/Debian
  • RHEL/CentOS



The default recipe will install iptables and provides a ruby script (installed in /usr/sbin/rebuild-iptables) to manage rebuilding firewall rules from files dropped off in /etc/iptables.d.


See Roadmap for plans to replace the definition with LWRPs.


The definition drops off a template in /etc/iptables.d after the name parameter. The rule will get added to the local system firewall through notifying the rebuild-iptables script. See Examples below.


Ensure that the system is set up to use the definition and rebuild script with recipe[iptables]. Then create templates with the firewall rules in the cookbook where the definition will be used. See Examples.

Since certain chains can be used with multiple tables (e.g., PREROUTING), you might have to include the name of the table explicitly (i.e., *nat, *mangle, etc.), so that the /usr/sbin/rebuild-iptables script can infer how to assemble final ruleset file that is going to be loaded. Please note, that unless specified otherwise, rules will be added under the filter table by default.


To enable port 80, e.g. in an httpd cookbook, create the following template:

# Port 80 for http
-A FWR -p tcp -m tcp --dport 80 -j ACCEPT

This would go in the cookbook, httpd/templates/default/http.erb. Then to use it in recipe[httpd]:

iptables_rule "http"

To redirect port 80 to local port 8080, e.g., in the aforementioned httpd cookbook, created the following template:

# Redirect anything on eth0 coming to port 80 to local port 8080
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Please note, that we explicitly add name of the table (being *nat in this example above) where the rules should be added.

This would most likely go in the cookbook, httpd/templates/default/http_8080.erb. Then to use it in recipe[httpd]:

iptables_rule "http_8080"


default["iptables"]["install_rules"] = true  # install the default rules

License and Author

Author:: Adam Jacob Author:: Joshua Timberman

Copyright:: 2008-2011, Opscode, Inc

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Dependent cookbooks

This cookbook has no specified dependencies.

Contingent cookbooks

abiquo Applicable Versions
aem Applicable Versions
amiga-ppp Applicable Versions
apache2 Applicable Versions
cassandra Applicable Versions
chef-manageiq Applicable Versions
docker Applicable Versions
extended_drbd Applicable Versions
ganglia Applicable Versions
hypertable Applicable Versions
jenkins Applicable Versions
openssh Applicable Versions
piwik Applicable Versions
redmine2 Applicable Versions
riak Applicable Versions
sanitize Applicable Versions
sensu Applicable Versions
spacewalk-server Applicable Versions
sshguard Applicable Versions
teamforge Applicable Versions

v0.14.1 (2015-01-01)

  • Fixing File.exists is deprecated for File.exist

v0.14.0 (2014-08-31)

  • [#14] Adds basic testing suite including Berksfile
  • [#14] Adds basic integration/post-converge tests
  • [#14] Adds default prefix and postfix rules to disalow traffic

v0.13.2 (2014-04-09)

  • [COOK-4496] Added Amazon Linux support

v0.13.0 (2014-03-19)

  • [COOK-3927] Substitute Perl version of rebuild-iptables with Ruby version

v0.12.2 (2014-03-18)

  • [COOK-4411] - Add newling to iptables.snat


  • [COOK-2213] - iptables disabled recipe


  • [COOK-1883] - add perl package so rebuild script works


  • [COOK-641] - be able to save output on rhel-family
  • [COOK-655] - use a template from other cookbooks


  • Current public release.
FC001: Use strings in preference to symbols to access node attributes: /tmp/cook/1438b4e80c06a03c678d240e/iptables/recipes/default.rb:45
FC015: Consider converting definition to a LWRP: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:1
FC019: Access node attributes in a consistent manner: /tmp/cook/1438b4e80c06a03c678d240e/iptables/recipes/default.rb:45
FC031: Cookbook without metadata file: /tmp/cook/1438b4e80c06a03c678d240e/iptables/metadata.rb:1
FC043: Prefer new notification syntax: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:20
FC043: Prefer new notification syntax: /tmp/cook/1438b4e80c06a03c678d240e/iptables/definitions/iptables_rule.rb:23
FC045: Consider setting cookbook name in metadata: /tmp/cook/1438b4e80c06a03c678d240e/iptables/metadata.rb:1
© 2008 – 2015 Chef Software, Inc. All Rights Reserved.

Code of Conduct