puppet-iptables/README.markdown.erb at develop · stdmod/puppet-iptables · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
#iptables

####Table of Contents

1. [Overview](#overview)
2. [Module Description](#module-description)
3. [Setup](#setup)
    * [Resources managed by iptables module](#resources-managed-by-iptables-module)
    * [Setup requirements](#setup-requirements)
    * [Beginning with module iptables](#beginning-with-module-iptables)
4. [Usage](#usage)
5. [Operating Systems Support](#operating-systems-support)
6. [Development](#development)

##Overview

This module installs, manages and configures iptables.

##Module Description

The module is based on **stdmod** naming standars.

Refer to http://github.com/stdmod/ for complete documentation on the common parameters.


##Setup

###Resources managed by iptables module
* This module installs the iptables package
* Enabled the iptables service
* Can manage all the configuration files (by default no file is changed)

###Setup Requirements
* PuppetLabs stdlib module
* Puppet version >= 2.7.x
* Facter version >= 1.6.2

###Beginning with module iptables

To install the package provided by the module just include it:

        include iptables

The main class arguments can be provided either via Hiera (from Puppet 3.x) or direct parameters:

        class { 'iptables':
          parameter => value,
        }

The module provides also a generic define to manage any iptables configuration file:

        iptables::conf { 'sample.conf':
          content => '# Test',
        }


##Usage

* A common way to use this module involves the management of the main configuration file via a custom template (provided in a custom site module):

        class { 'iptables':
          config_file_template => 'site/iptables/iptables.conf.erb',
        }

* You can write custom templates that use setting provided but the config_file_options_hash paramenter

        class { 'iptables':
          config_file_template      => 'site/iptables/iptables.conf.erb',
          config_file_options_hash  => {
            opt  => 'value',
            opt2 => 'value2',
          },
        }

* Use custom source (here an array) for main configuration file. Note that template and source arguments are alternative.

        class { 'iptables':
          config_file_source => [ "puppet:///modules/site/iptables/iptables.conf-${hostname}" ,
                                  "puppet:///modules/site/iptables/iptables.conf" ],
        }


* Use custom source directory for the whole configuration directory, where present.

        class { 'iptables':
          config_dir_source  => 'puppet:///modules/site/iptables/conf/',
        }

* Use custom source directory for the whole configuration directory and purge all the local files that are not on the dir.
  Note: This option can be used to be sure that the content of a directory is exactly the same you expect, but it is desctructive and may remove files.

        class { 'iptables':
          config_dir_source => 'puppet:///modules/site/iptables/conf/',
          config_dir_purge  => true, # Default: false.
        }

* Use custom source directory for the whole configuration dir and define recursing policy.

        class { 'iptables':
          config_dir_source    => 'puppet:///modules/site/iptables/conf/',
          config_dir_recursion => false, # Default: true.
        }


##Operating Systems Support

This is tested on these OS:
- RedHat osfamily 5 and 6
- Debian 6 and 7
- Ubuntu 10.04 and 12.04


##Development

Pull requests (PR) and bug reports via GitHub are welcomed.

When submitting PR please follow these quidelines:
- Provide puppet-lint compliant code
- If possible provide rspec tests
- Follow the module style and stdmod naming standards

When submitting bug report please include or link:
- The Puppet code that triggers the error
- The output of facter on the system where you try it
- All the relevant error logs
- Any other information useful to undestand the context