Are you seeing the not-working rules generate iptables rules (verify
with iptables-save after applying manifest)?
Also, it's been a while since I dug into the ruby that generates the
rules, you should probably use the before operator -> between rules to
enforce ordering, like
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x5', proto => 'udp', port => '53',
action => 'accept', } ->
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x5', proto => 'tcp', state => 'NEW',
port => '53', action => 'accept', }
Jeff
On 12/11/2013 10:24 PM, Jim Miller wrote:
We're testing out the Puppetlabs-Firewall module. And it seems I'm
either missing something fundamental or Logging/Accpet works/doesn't
work in an irregular way. I would be most grateful for some input.
_COMMON:_
firewall { '002 accept related established rules INPUT': proto =>
'all', state => ['RELATED', 'ESTABLISHED'], action => 'accept' }
firewall { '003 accept related established rules OUTPUT': chain =>
'OUTPUT', proto => 'all', state => ['RELATED', 'ESTABLISHED'], action
=> 'accept' }
_This works for new inbound SSH connections:_
firewall { '007 fwd to ssh_in': chain => 'INPUT', iniface => 'eth0',
source => '10.x8.xx1.0/24', proto => 'tcp', state => 'NEW', port =>
'22', action => 'accept' }
_This works for inbound SSH connections:
_ firewallchain { 'ssh_in:filter:IPv4': ensure => present, }
firewall { '008 fwd to ssh_in': chain => 'INPUT', iniface => 'eth0',
source => '10.x8.xx1.0/24', proto => 'tcp', state => 'NEW', port =>
'22', jump => 'ssh_in' }
firewall { '009 ssh_in': chain => 'ssh_in', jump => 'LOG',
log_prefix => 'ssh_in ' }
firewall { '011 ssh_in': chain => 'ssh_in', action => 'accept' }
_This works for DNS:_
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x5', proto => 'udp', port => '53',
action => 'accept', }
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x5', proto => 'tcp', state => 'NEW',
port => '53', action => 'accept', }
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x6', proto => 'udp', port => '53',
action => 'accept', }
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x6', proto => 'tcp', state => 'NEW',
port => '53', action => 'accept', }
_This does NOT work for DNS:_
firewallchain { 'dns_out:filter:IPv4': ensure => present, }
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x5', proto => 'udp', port => '53',
jump => 'dns_out', }
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x5', proto => 'tcp', state => 'NEW',
port => '53', jump => 'dns_out', }
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x6', proto => 'udp', port => '53',
jump => 'dns_out', }
firewall { '016 fwd to dns_out': chain => 'OUTPUT', outiface =>
'eth0', destination => '10.x8.x0.x6', proto => 'tcp', state => 'NEW',
port => '53', jump => 'dns_out', }
firewall { '024 dns_out': chain => 'dns_out', jump => 'LOG',
log_prefix => 'dns_out', }
firewall { '025 dns_out': chain => 'dns_out', action => 'accept', }
None of the above rules generates any errors.
My understanding of reading the doc is the default policy is 'accept'
when not specified (not sure about custom chains). When I try to
connect to the server, I don't see logs being generated.
Thanks,
Jim
--
You received this message because you are subscribed to the Google
Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/e12d97d9-2e43-482c-aa22-7bccaf6de17d%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
--
You received this message because you are subscribed to the Google Groups "Puppet
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/52A93540.6030500%40bericotechnologies.com.
For more options, visit https://groups.google.com/groups/opt_out.
