cookbook 'iptables', '= 0.14.0', :supermarket
Installs the iptables daemon and provides a LWRP for managing rules
cookbook 'iptables', '= 0.14.0'
knife supermarket install iptables
knife supermarket download iptables
Sets up iptables to use a script to maintain firewall rules. However this cookbook may be deprecated or heavily modified in favor of the general firewall cookbook, see Roadmap.
- [COOK-652] - create a firewall cookbook
- [COOK-688] - create iptables providers for all resources
The default recipe will install iptables and provides a ruby script
/usr/sbin/rebuild-iptables) to manage rebuilding
firewall rules from files dropped off in
See Roadmap for plans to replace the definition with LWRPs.
The definition drops off a template in
/etc/iptables.d after the
name parameter. The rule will get added to the local system firewall
through notifying the
rebuild-iptables script. See Examples below.
Ensure that the system is set up to use the definition and rebuild
recipe[iptables]. Then create templates with the
firewall rules in the cookbook where the definition will be used. See
To enable port 80, e.g. in an
httpd cookbook, create the following
# Port 80 for http -A FWR -p tcp -m tcp --dport 80 -j ACCEPT
This would go in the cookbook,
httpd/templates/default/http.erb. Then to use it in
default["iptables"]["install_rules"] = true # install the default rules
License and Author
Copyright:: 2008-2011, Opscode, Inc
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
This cookbook has no specified dependencies.
- [#14] Adds basic testing suite including Berksfile
- [#14] Adds basic integration/post-converge tests
- [#14] Adds default prefix and postfix rules to disalow traffic
- [COOK-4496] Added Amazon Linux support
- [COOK-3927] Substitute Perl version of rebuild-iptables with Ruby version
- [COOK-4411] - Add newling to iptables.snat
- [COOK-2213] - iptables disabled recipe
- [COOK-1883] - add perl package so rebuild script works
- [COOK-641] - be able to save output on rhel-family
- [COOK-655] - use a template from other cookbooks
- Current public release.