2014-12-15 17:19 GMT+01:00 Ciro Iriarte <ciro.iria...@gmail.com>:
> Hi!, anybody know if it's possible to create a rule equivalent to this with
> puppetlabs' firewall module?:
>
> iptables -I INPUT -i eth0 -p <PROTO> --dport <PORT> -m hashlimit
> --hashlimit-mode srcip \
> --hashlimit-srcmask 32 --hashlimit-above 100/s \
> --hashlimit-burst 100 --hashlimit-name=bad -j DROP
>
> I've seen some references of rate limiting, but no example on the
> documentation.
>
> Regards,
> Ciro
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/49ede11f-80b9-468f-82fa-403ae63f5b21%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
Hi,
In this cases what I usually do is create the desired state manually
and then use Puppet RAL to get the puppetized version.
1.- Create the iptables rules you want on the command line
2.- use "puppet resource firewall" to get the puppet code
Eg:
[...]
puppet resource firewall
firewall { '000 accept all icmp':
ensure => 'present',
action => 'accept',
chain => 'INPUT',
isfragment => 'false',
proto => 'icmp',
random => 'false',
rdest => 'false',
reap => 'false',
rsource => 'false',
rttl => 'false',
socket => 'false',
table => 'filter',
}
firewall { '103 allow https':
ensure => 'present',
action => 'accept',
chain => 'INPUT',
isfragment => 'false',
port => ['443'],
proto => 'tcp',
random => 'false',
rdest => 'false',
reap => 'false',
rsource => 'false',
rttl => 'false',
socket => 'false',
table => 'filter',
}
[...]
Best regards
--------------------------------------------------------------------------------------
Juan Sierra Pons j...@elsotanillo.net
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE
--------------------------------------------------------------------------------------
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CABS%3Dy9sJsiYp3-zaRcBiGgZnryE43atPAnhqzYK5bPQborqAKQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
