CDIST-TYPE__IPTABLES_RULE(7) | cdist | CDIST-TYPE__IPTABLES_RULE(7) |
cdist-type__iptables_rule - Deploy iptable rulesets
This cdist type allows you to manage iptable rules in a distribution independent manner.
See cdist-type__iptables_apply(7) for the execution order of these rules. It will be executed automaticly to apply all rules non-volaite.
All rules without any of these parameters will be treated like --v4 because of backward compatibility.
# Deploy some policies __iptables_rule policy-in --rule "-P INPUT DROP" __iptables_rule policy-out --rule "-P OUTPUT ACCEPT" __iptables_rule policy-fwd --rule "-P FORWARD DROP" # The usual established rule __iptables_rule established --rule "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT" # Some service rules __iptables_rule http --rule "-A INPUT -p tcp --dport 80 -j ACCEPT" __iptables_rule ssh --rule "-A INPUT -p tcp --dport 22 -j ACCEPT" __iptables_rule https --rule "-A INPUT -p tcp --dport 443 -j ACCEPT" # Ensure some rules are not present anymore __iptables_rule munin --rule "-A INPUT -p tcp --dport 4949 -j ACCEPT" \
--state absent # IPv4-only rule for ICMPv4 __iptables_rule icmp-v4 --v4 --rule "-A INPUT -p icmp -j ACCEPT" # IPv6-only rule for ICMPv6 __iptables_rule icmp-v6 --v6 --rule "-A INPUT -p icmpv6 -j ACCEPT" # doing something for the dual stack __iptables_rule fwd-eth0-eth1 --v4 --v6 --rule "-A INPUT -i eth0 -o eth1 -j ACCEPT" __iptables_rule fwd-eth1-eth0 --all --rule "-A -o eth1 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT"
Nico Schottelius <nico-cdist--@--schottelius.org> Matthias Stecher <matthiasstecher--@--gmx.de>
Copyright (C) 2013 Nico Schottelius. Copyright (C) 2020 Matthias Stecher. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
ungleich GmbH 2021
January 15, 2023 | 7.0.0 |