Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms


simple_iptables (19) Versions 0.2.4

Simple LWRP and recipe for managing iptables rules

cookbook 'simple_iptables', '= 0.2.4'
cookbook 'simple_iptables', '= 0.2.4', :supermarket
knife cookbook site install simple_iptables
knife cookbook site download simple_iptables

Build Status


Simple cookbook with LWRPs for managing iptables rules and policies.


None, other than a system that supports iptables.


The following platforms are supported and known to work:

  • Debian (6.0 and later)
  • RedHat (5.8 and later)
  • CentOS (5.8 and later)

Other platforms that support iptables and the iptables-restore script are likely to work as well; if you use one, please let me know so that I can update the supported platforms list.


This cookbook uses node attributes to track internal state when generating the iptables rules and policies. These attributes should not be overridden by roles, other recipes, etc.


Include the recipe simple_iptables somewhere in your run list, then use the LWRPs simple_iptables_rule and simple_iptables_policy in your recipes.

simple_iptables_rule Resource

Defines a single iptables rule, composed of a rule string (passed as-is to iptables), and a jump target. The name attribute defines an iptables chain that this rule will live in (and, thus, that other rules can jump to). For instance:

# Allow SSH
simple_iptables_rule "ssh" do
  rule "--proto tcp --dport 22"
  jump "ACCEPT"

For convenience, you may also specify an array of rule strings in a single LWRP invocation:

simple_iptables_rule "http" do
  rule [ "--proto tcp --dport 80",
         "--proto tcp --dport 443" ]
  jump "ACCEPT"

Additionally, if you want to declare a module (such as log) you can define jump as false:

# Log
simple_iptables_rule "system" do
  rule "--match limit --limit 5/min --jump LOG --log-prefix \"iptables denied: \" --log-level 7"
  jump false

simple_iptables_policy Resource

Defines a default action for a given iptables chain. This is usually used to switch from a default-accept policy to a default-reject policy. For instance:

# Reject packets other than those explicitly allowed
simple_iptables_policy "INPUT" do
  policy "DROP"


Suppose you had the following simple_iptables configuration:

# Reject packets other than those explicitly allowed
simple_iptables_policy "INPUT" do
  policy "DROP"

# The following rules define a "system" chain; chains
# are used as a convenient way of grouping rules together,
# for logical organization.

# Allow all traffic on the loopback device
simple_iptables_rule "system" do
  rule "--in-interface lo"
  jump "ACCEPT"

# Allow any established connections to continue, even
# if they would be in violation of other rules.
simple_iptables_rule "system" do
  rule "-m conntrack --ctstate ESTABLISHED,RELATED"
  jump "ACCEPT"

# Allow SSH
simple_iptables_rule "system" do
  rule "--proto tcp --dport 22"
  jump "ACCEPT"

simple_iptables_rule "http" do
  rule [ "--proto tcp --dport 80",
         "--proto tcp --dport 443" ]
  jump "ACCEPT"

This would generate a file /etc/iptables-rules with the contents:

# This file generated by Chef. Changes will be overwritten.
:system - [0:0]
-A INPUT --jump system
-A system --in-interface lo --jump ACCEPT
-A system -m conntrack --ctstate ESTABLISHED,RELATED --jump ACCEPT
-A system --proto tcp --dport 22 --jump ACCEPT
-A system --proto tcp --dport 80 --jump ACCEPT
-A system --proto tcp --dport 443 --jump ACCEPT

Which results in the following iptables configuration:

# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
system     all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain system (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https


  • 0.2.4 (Feb 13, 2013)
    • Fixed attribute precedence issues in Chef 11 (#9 - Warwick Poole)
    • Added name to metadata to satisfy recent foodcritic versions
  • 0.2.3 (Nov 10, 2012)
    • Fixed a warning in Chef 11+ (#7 - Hector Castro)
  • 0.2.2 (Oct 13, 2012)
    • Added support for logging module and other non-jump rules (#6 - phoolish)
  • 0.2.1 (Aug 5, 2012)
    • Fixed a bug using simple_iptables with chef-solo (#5)
  • 0.2.0 (Aug 1, 2012)
    • Allow an array of rules in simple_iptables_rule LWRP (Johannes Becker)
    • RedHat/CentOS compatibility (David Stainton)
    • Failing simple_iptables_rules now fail with a more helpful error message
  • 0.1.2 (July 24, 2012)
    • Fixed examples in README (SchraderMJ11)
  • 0.1.1 (May 22, 2012)
    • Added Travis-CI integration (Nathen Harvey)
    • Fixed foodcritic warnings (Nathen Harvey)
  • 0.1.0 (May 12, 2012)
    • Initial release

No quality metric results found