Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms

Select Status


iptables (41) Versions 6.0.0

Installs the iptables daemon and provides resources for managing rules

cookbook 'iptables', '= 6.0.0', :supermarket
cookbook 'iptables', '= 6.0.0'
knife supermarket install iptables
knife supermarket download iptables
Quality 100%

iptables Cookbook

Build Status Cookbook Version

Installs iptables and provides a custom resource for adding and removing iptables rules



  • Ubuntu/Debian
  • RHEL/CentOS and derivatives
  • Amazon Linux


  • Chef 12.10+


  • none



The default recipe will install iptables and provides a pair of resources for managing firewall rules for both iptables and ip6tables.


The disabled recipe will install iptables, disable the iptables service (on RHEL platforms), and flush the current iptables and ip6tables rules.


default['iptables']['iptables_sysconfig'] and default['iptables']['ip6tables_sysconfig'] are hashes that are used to template /etc/sysconfig/iptables-config and /etc/sysconfig/ip6tables-config. The keys must be upper case and any key / value pair included will be added to the config file.

default['iptables']['persisted_rules_iptables'] and default['iptables']['persisted_rules_ip6tables'] are strings that are used to hold the location of the generated iptables-save/iptables-restore format file containing the firewall rules for the system.

default['iptables']['persisted_rules_template'] is a hash that contains the base structure for the generated persisted rule files containing the default tables and chains.

Custom Resource


Use this resource to create ip(6)tables chains that can be later referenced in rules, this resource contains the same accumulated template resource that the rule resource does but only deals with the creation of chains.

Property Optional? Type Description
source Yes String Source template for the generation of the persistent rules file
cookbook Yes String Source cookbook for the generation of the persistent rules file
config_file Yes String Persistent rules file to generate
table Yes String The iptables table to create the chain on (defaults to filter)
chain No String, Array, Hash The chain name and optionally default action and packet counts
filemode Yes String, Integer Filemode of the the persistent rules file

The chain property accepts entries in the following formats:

Chain without default action and packet counts (in this case default action will be set to -)

Array of String
{ 'NEWCHAIN' => ''}

Chain with default action but no packet counts

Array of String

Chain with default action and packet counts

Array of String
['NEWCHAIN1 ACCEPT [0:0]', 'NEWCHAIN2 REJECT [1:1]', 'NEWCHAIN3 DROP [322:322]']
{ 'NEWCHAIN' => 'DROP [0:0]'}


The iptables_chain6 provides IPv6 support with the same behavior as the original iptables_chain.


The custom resource contains an accumulated template resource which generates the persisted rule file which notifies the reload of the firewall rules at the end of the chef run. See Examples below.

NOTE: In the 5.0 release of this cookbook the iptables_rule definition was converted to an accumulated template resource. This changes the behavior of disabling iptables rules. Previously a rule needed to be disabled explicitly by calling the resource with :disable. Now as soon as a rule resource is no longer included in the chef run it will not be added to the accumulated template and will be automatically removed.

Property Optional? Type Description
source Yes String Source template for the generation of the persistent rules file
cookbook Yes String Source cookbook for the generation of the persistent rules file
config_file Yes String Persistent rules file to generate
table Yes String The iptables table to create the chain on (defaults to filter)
chain No (1) String The chain name to be used if the rule is generated from properties
match Yes String The match settings for the rule
target No (1) String The target for the rule
line No (2) String A string containing a complete iptables rule statement, no generation takes place
comment Yes String, True, False The comment for the rule if a string, use resource name if true, no comment if false
extra_options Yes String Extra options to appended to the rule after the destination -j XXXXX
filemode Yes String, Integer Filemode of the the persistent rules file

The resource can be called with one of two property sets:

  1. chain and target are set (match optionally), in which case line is ignored.
  2. chain and target are unset in which case line used.


The iptables_rule6 provides IPv6 support with the same behavior as the original iptable_rule.


Add recipe[iptables] to your runlist to ensure iptables is installed and running on the system. Then create use iptables_rule/ip6tables_rule to add individual rules. See Examples.

Since certain chains can be used with multiple tables (e.g., PREROUTING), you might have to include the name of the table explicitly using the table property (i.e., *nat, *mangle, etc.), so that the resource can infer how to assemble the final ruleset file that is going to be loaded. Please note, that unless specified otherwise, rules will be added under the filter table by default.


To enable port 80, e.g. in an my_httpd cookbook, create the following rule resource:

# Port 80 for http
iptables_chain 'fwr' do
  chain 'FWR'

iptables_rule 'httpd' do
  line '-A FWR -p tcp -m tcp --dport 80 -j ACCEPT'

or to generate:

# Port 80 for http
iptables_chain 'fwr' do
  chain 'FWR'

iptables_rule 'httpd' do
  chain 'FWR'
  match '-p tcp -m tcp --dport 80'
  target 'ACCEPT'

To redirect port 80 to local port 8080, e.g., in the aforementioned my_httpd cookbook, create the following rule resource:

# Redirect anything on eth0 coming to port 80 to local port 8080
iptables_rule 'httpd' do
  table 'nat'
  chain 'PREROUTING'
  match '-i eth0 -p tcp --dport 80'
  target 'REDIRECT'
  extra_options '--to-port 8080'

To create a rule without using the line property (you can optionally specify table when using line):

iptables_rule 'http_8080' do
  line '-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080'
  table 'nat'

Additionally, a rule can be marked as sensitive so it's contents does not get output to the the console or logged with the sensitive property set to true. The mode of the generated rule file can be set with the filemode property:

iptables_rule 'http_8080' do
  line '-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080'
  table 'nat'
  sensitive true
iptables_rule 'http_8080' do
  line '-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080'
  table 'nat'
  sensitive true
  filemode '0600'

To get attribute-driven rules you can (for example) feed a hash of attributes into named iptables.d files like this:

node.default['iptables']['rules']['http_80'] = '-A FWR -p tcp -m tcp --dport 80 -j ACCEPT'
node.default['iptables']['rules']['http_443'] = [
  '# an example with multiple lines',
  '-A FWR -p tcp -m tcp --dport 443 -j ACCEPT',

node['iptables']['rules'].map do |rule_name, rule_body|
  iptables_rule rule_name do
    line [ rule_body ].flatten.join("\n")

License & Authors

Author: Cookbook Engineering Team (

Copyright: 2008-2019, Chef Software, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.

Dependent cookbooks

This cookbook has no specified dependencies.

Contingent cookbooks

abiquo Applicable Versions
aem Applicable Versions
amiga-ppp Applicable Versions
apache2 Applicable Versions
arcgis-enterprise Applicable Versions
arcgis-notebooks Applicable Versions
cassandra Applicable Versions
chef-manageiq Applicable Versions
chef-waiter Applicable Versions
cloudless-box Applicable Versions
common_linux Applicable Versions
concourse Applicable Versions
confd-iptables Applicable Versions
cookbook-openshift3 Applicable Versions
cookbook-openshift3 0.0.1
cookbook-openshift3 0.0.2
cookbook-openshift3 1.0.2
cookbook-openshift3 1.0.3
cookbook-openshift3 1.0.4
cookbook-openshift3 1.0.5
cookbook-openshift3 1.0.6
cookbook-openshift3 1.0.7
cookbook-openshift3 1.0.8
cookbook-openshift3 1.0.9
cookbook-openshift3 1.10.0
cookbook-openshift3 1.10.1
cookbook-openshift3 1.10.2
cookbook-openshift3 1.10.3
cookbook-openshift3 1.10.4
cookbook-openshift3 1.10.5
cookbook-openshift3 1.10.6
cookbook-openshift3 1.10.7
cookbook-openshift3 1.10.8
cookbook-openshift3 1.10.9
cookbook-openshift3 1.10.10
cookbook-openshift3 1.10.11
cookbook-openshift3 1.10.12
cookbook-openshift3 1.10.13
cookbook-openshift3 1.10.14
cookbook-openshift3 1.10.15
cookbook-openshift3 1.10.16
cookbook-openshift3 1.10.17
cookbook-openshift3 1.10.18
cookbook-openshift3 1.10.19
cookbook-openshift3 1.10.20
cookbook-openshift3 1.10.21
cookbook-openshift3 1.10.22
cookbook-openshift3 1.10.23
cookbook-openshift3 1.10.24
cookbook-openshift3 1.10.25
cookbook-openshift3 1.10.26
cookbook-openshift3 1.10.27
cookbook-openshift3 1.10.28
cookbook-openshift3 1.10.29
cookbook-openshift3 1.10.30
cookbook-openshift3 1.10.31
cookbook-openshift3 1.10.32
cookbook-openshift3 1.10.33
cookbook-openshift3 1.10.34
cookbook-openshift3 1.10.35
cookbook-openshift3 1.10.36
cookbook-openshift3 1.10.37
cookbook-openshift3 1.10.38
cookbook-openshift3 1.10.39
cookbook-openshift3 1.10.40
cookbook-openshift3 1.10.41
cookbook-openshift3 1.10.42
cookbook-openshift3 1.10.43
cookbook-openshift3 1.10.44
cookbook-openshift3 1.10.45
cookbook-openshift3 1.10.46
cookbook-openshift3 1.10.47
cookbook-openshift3 1.10.48
cookbook-openshift3 1.10.49
cookbook-openshift3 1.10.50
cookbook-openshift3 1.10.51
cookbook-openshift3 1.10.52
cookbook-openshift3 1.10.53
cookbook-openshift3 1.10.54
cookbook-openshift3 1.10.55
cookbook-openshift3 1.10.56
cookbook-openshift3 1.10.57
cookbook-openshift3 1.10.58
cookbook-openshift3 1.10.59
cookbook-openshift3 1.10.60
cookbook-openshift3 1.10.61
cookbook-openshift3 1.10.62
cookbook-openshift3 1.10.63
cookbook-openshift3 1.10.64
cookbook-openshift3 1.10.66
cookbook-openshift3 1.10.67
cookbook-openshift3 2.0.5
cookbook-openshift3 2.0.6
cookbook-openshift3 2.0.7
cookbook-openshift3 2.0.9
cookbook-openshift3 2.0.10
cookbook-openshift3 2.0.12
cookbook-openshift3 2.0.13
cookbook-openshift3 2.0.14
cookbook-openshift3 2.0.15
cookbook-openshift3 2.0.18
cookbook-openshift3 2.0.19
cookbook-openshift3 2.0.20
cookbook-openshift3 2.0.21
cookbook-openshift3 2.0.22
cookbook-openshift3 2.0.23
cookbook-openshift3 2.0.24
cookbook-openshift3 2.0.26
cookbook-openshift3 2.0.27
cookbook-openshift3 2.0.28
cookbook-openshift3 2.0.29
cookbook-openshift3 2.0.32
cookbook-openshift3 2.0.33
cookbook-openshift3 2.0.41
cookbook-openshift3 2.0.42
cookbook-openshift3 2.0.43
cookbook-openshift3 2.0.44
cookbook-openshift3 2.0.45
cookbook-openshift3 2.0.46
cookbook-openshift3 2.0.47
cookbook-openshift3 2.0.48
cookbook-openshift3 2.0.49
cookbook-openshift3 2.0.50
cookbook-openshift3 2.0.51
cookbook-openshift3 2.0.52
cookbook-openshift3 2.0.53
cookbook-openshift3 2.0.54
cookbook-openshift3 2.0.55
cookbook-openshift3 2.0.57
cookbook-openshift3 2.0.58
cookbook-openshift3 2.0.60
cookbook-openshift3 2.0.62
cookbook-openshift3 2.0.63
cookbook-openshift3 2.0.64
cookbook-openshift3 2.0.65
cookbook-openshift3 2.0.66
cookbook-openshift3 2.0.68
cookbook-openshift3 2.0.69
cookbook-openshift3 2.0.71
cookbook-openshift3 2.0.72
cookbook-openshift3 2.0.74
cookbook-openshift3 2.0.75
cookbook-openshift3 2.0.76
cookbook-openshift3 2.0.77
cookbook-openshift3 2.0.82
cookbook-openshift3 2.0.83
cookbook-openshift3 2.0.85
cookbook-openshift3 2.0.86
cookbook-openshift3 2.0.88
cookbook-openshift3 2.0.90
cookbook-openshift3 2.1.0
cookbook-openshift3 2.1.1
cookbook-openshift3 2.1.2
cookbook-openshift3 2.1.3
cookbook-openshift3 2.1.4
cookbook-openshift3 2.1.5
cookbook-openshift3 2.1.6
cookbook-openshift3 2.1.7
cookbook-openshift3 2.1.8
cookbook-openshift3 2.1.9
cookbook-openshift3 2.1.11
cookbook-openshift3 2.1.13
cookbook-openshift3 2.1.14
cookbook-openshift3 2.1.17
cookbook-openshift3 2.1.18
cookbook-openshift3 2.1.19
cookbook-openshift3 2.1.21
cookbook-openshift3 2.1.23
cookbook-openshift3 2.1.24
cookbook-openshift3 2.1.25
cookbook-openshift3 2.1.26
docker Applicable Versions
drupal-cookbook Applicable Versions
esri-tomcat Applicable Versions
extended_drbd Applicable Versions
ganglia Applicable Versions
hypertable Applicable Versions
jenkins Applicable Versions
kimchi Applicable Versions
openssh Applicable Versions
piwik Applicable Versions
plexconnect Applicable Versions
redmine2 Applicable Versions
riak Applicable Versions
sanitize Applicable Versions
sensu Applicable Versions
spacewalk-server Applicable Versions
sshguard Applicable Versions
teamforge Applicable Versions
treslek Applicable Versions

iptables Cookbook CHANGELOG

This file is used to list changes made in each version of the iptables cookbook.

6.0.0 (2020-01-08)

  • Rule resources refactored to accumulator style. See the new usage in the readme
  • CentOS 8 support

5.0.0 (2020-01-08)

  • Cookstyle fixes - @tas50
  • name_attributes -> name_properties - @tas50
  • Remove recipe and long_description metadata - @tas50
  • Simplify platform check logic - @tas50
  • Remove respond_to? from metadata.rb - @tas50
  • Require Chef 12.15+ - @tas50

4.5.0 (2018-11-24)

  • Add sensitive option to resources
  • Added filemode property to generated rule files

4.4.1 (2018-09-11)

  • Remove mention of matchers in the readme
  • Add back support for RHEL 6 + fix Amazon Linux 2 support
  • Add additional specs for the package installs so we don't break this in the future

4.4.0 (2018-09-10)

  • Use persistent iptables package for Debian config
  • Add IPv6 support to iptables_rule and Add iptables_rule6
  • Extend disabled recipe for Fedora and Amazon distros

4.3.4 (2018-02-15)

  • Fix converge failures in the custom resource introduced in 4.3.3
  • Remove stove and tomlrb from the Gemfile
  • use apt_update not apt cookbook in testing
  • Add Amazon Linux to test kitchen
  • Simplify the platform family check using our helpers

4.3.3 (2018-02-15)

  • Don't use kind_of in the custom resource (FC117)

4.3.2 (2018-02-07)

  • Fix FC108 to resolve test failures
  • Switch from ServerSpec to InSpec
  • Resolve ChefSpec warnings
  • Remove ChefSpec matchers that are no longer needed since ChefSpec autogenerates these

4.3.1 (2017-11-06)

  • Updating namespace for attribute-based rules in the readme

4.3.0 (2017-10-28)

  • Add Amazon Linux support on Chef 13

4.2.1 (2017-09-08)

  • Resolve deprecation warning

4.2.0 (2017-04-14)

  • [GH-69] - Clearing out iptables rule files on RHEL with the iptables::disabled recipe

4.1.0 (2017-04-11)

  • specify optional table property for use with lines

4.0.1 (2017-03-29)

  • Update metadata to require Chef 12.10+ due to use of with_run_context

4.0.0 (2017-02-27)

  • Remove EOL platforms from testing
  • Require Chef 12.5 and remove compat_resource dependency

3.1.0 (2017-01-16)

  • Update readme to include new attribute
  • Check subcmd exit codes in rebuild-iptables script
  • fixed iptables disabled recipe to flush iptables after disabling the service

3.0.1 (2016-10-10)

  • Fix rules resource so rebuild-iptables only runs once
  • Add tests for nested resources
  • Add system ruby attribute so that it can be overridden

3.0.0 (2016-09-16)

  • Remove kitchen cloud config
  • Fix default specs to work properly on RHEL and other general spec cleanup
  • Simplify testing and fix failing tests on RHEL
  • allow using a file provider instead of a template
  • rename 'content' to 'lines' and add documentation
  • make the attributes example a bit more useful
  • using iptables-restore logic for rhel - same as debian
  • copy new config to default location in case of iptables restart
  • refactored rebuild-iptables script
  • Update supported os
  • Use compat_resource to restore Chef 12.1 - 12.4 compatibility

v2.2.0 (2016-02-17)

  • Remove the dependency on compat_resource cookbook. This fixes RHEL systems, but increases the required Chef version to 12.5 or later

v2.1.1 (2016-01-26)

  • Fixed failures on RHEL in the disabled recipe

v2.1.0 (2016-01-25)

  • Improved compatbility with Fedora
  • Added management of the iptables sysconfig files using 2 new attributes. See the readme for more information

v2.0.2 (2016-01-15)

  • Fixed rules not being rebuilt when using the disable action in the custom resource

v2.0.1 (2015-11-16)

  • Added Chefspec matchers

v2.0.0 (2015-10-21)

  • Migrated LWRP to Chef 12.5 custom resources format with backwards compatibility provided via compat_resource cookbook to 12.X family
  • Added Start / enable of iptables service in the default recipe when on RHEL based systems and the management of /etc/sysconfig/iptables so the service can start
  • Added removal of /etc/iptables.d/ to the disabled recipe to allow for reenabling later on
  • Modified the iptables service disable in the disable recipe to only run when on RHEL based systems
  • Expanded the serverspec tests and test kitchen suites to better test rules custom resource and disable recipe

v1.1.0 (2015-10-05)

  • Fixed metadata description of the default recipe
  • Added Kitchen CI config
  • Added Chefspec unit tests
  • Updated to our standard Rubocop config and resolve all warnings
  • Added Travis CI config for lint / unit testing on Ruby 2/2.1/2.2
  • Updated Contributing and Testing docs
  • Added a maintainers doc
  • Added a Gemfile with development and testing dependencies
  • Added cookbook version and Travis CI badges to the readme
  • Clarified in the readme that the minimum supported Chef release is 11.0
  • Added a Rakefile easier testing
  • Added a chefignore file to limit files that are uploaded to the Chef server
  • Update to modern notification format to resolve Foodcritic warnings
  • Added source_url and issues_url to the metadata for Supermarket
  • Removed pre-Ruby 1.9 hash rockets

v1.0.0 (2015-04-29)

NOTE: This release includes breaking changes to the behavior of this cookbook. The iptables_rule definition was converted to a LWRP. This changes the behavior of disabling iptables rules. Previously a rule could be disabled by specifying enable false. You must now specify action :disable. Additionally the cookbook no longer installs the out of the box iptables rules. These were rules made assumptions about the operating environment and should not have been installed out of the box. This makes this recipe a library cookbook that can be better wrapped to meet the needs or your particular environment.
- Definition converted to a LWRP to providing why-run support and
- The out of the box iptables rules are no longer installed. If you need these rules you'll need to wrap the cookbook and use the LWRP to define these same rules.
- Removed all references to the roadmap and deprecation of the cookbook. It's not going anywhere any time soon
- Use platform_family to better support Debian derivatives
- Converted file / directory modes to strings to preserve the leading 0
- Added additional RHEL derivitive distributions to the metadata
- Expanded excluded files in the gitignore and chefignore files
- Included the latest contributing documentation to match the current process

v0.14.1 (2015-01-01)

  • Fixing File.exists is deprecated for File.exist

v0.14.0 (2014-08-31)

  • [#14] Adds basic testing suite including Berksfile
  • [#14] Adds basic integration/post-converge tests
  • [#14] Adds default prefix and postfix rules to disalow traffic

v0.13.2 (2014-04-09)

  • [COOK-4496] Added Amazon Linux support

v0.13.0 (2014-03-19)

  • [COOK-3927] Substitute Perl version of rebuild-iptables with Ruby version

v0.12.2 (2014-03-18)

  • [COOK-4411] - Add newling to iptables.snat


  • [COOK-2213] - iptables disabled recipe


  • [COOK-1883] - add perl package so rebuild script works


  • [COOK-641] - be able to save output on rhel-family
  • [COOK-655] - use a template from other cookbooks


  • Current public release.

Collaborator Number Metric

6.0.0 passed this metric

Contributing File Metric

6.0.0 passed this metric

Foodcritic Metric

6.0.0 passed this metric

No Binaries Metric

6.0.0 passed this metric

Testing File Metric

6.0.0 passed this metric

Version Tag Metric

6.0.0 passed this metric