chr4-cookbooks / iptables-ng

Cookbook to maintain iptables rules and policies on different platforms, respecting the way the os handles these settings.
GNU General Public License v3.0
38 stars 32 forks source link

? Does this restart iptables every chef run? #28

Closed acqant closed 10 years ago

acqant commented 10 years ago

I see iptables dmesg logs every chef run. Even if the rules don't change it restarts iptables?

chr4 commented 10 years ago

That should not be the case. Can you give some more information?

The output section of chef-client --once that concerns changed iptables rules and lsb_release -a would be helpful.

chr4 commented 10 years ago

Also how you call the LWRPs and/or iptables-ng attributes you are using. Thanks!

acqant commented 10 years ago

CB

  # Configure Iptables
    include_recipe "iptables-ng"
    iptables_ng_chain 'name' do
      chain  'INPUT'       # The chain to set the policy for (name_attribute)
      table  'filter'      # The table to use (defaults to 'filter')
      policy 'DROP [0:0]'  # The policy to use (defaults to 'ACCEPT [0:0]' for
                           # build-in chains, to '- [0:0]' for custom ones
      action :create       # Supported actions: :create, :create_if_missing, :delete
                           # Default action: :create
    end
    iptables_ng_rule 'ssh' do
        rule "--protocol tcp --dport 33333 --match state --state NEW --jump ACCEPT"
    end
    iptables_ng_rule 'related_n_established' do
        rule '-m state --state ESTABLISHED,RELATED -j ACCEPT'
    end
    iptables_ng_rule 'icmp' do
        rule '--protocol icmp --icmp-type any -j ACCEPT'
    end

Chef run

Recipe: iptables-ng::manage
  * ruby_block[create_rules] action createRecipe: <Dynamically Defined Resource>
  * file[/etc/sysconfig/iptables] action create (up to date)

    - execute the ruby block create_rules

Recipe: iptables-ng::manage
  * ruby_block[restart_iptables] action createRecipe: <Dynamically Defined Resource>
  * service[iptables] action enable (up to date)
  * service[iptables] action restart
    - restart service service[iptables]

    - execute the ruby block restart_iptables

/var/log/messages

Jul  9 13:42:05 localhost kernel: ip_tables: (C) 2000-2006 Netfilter Core Team
Jul  9 13:42:05 localhost kernel: nf_conntrack version 0.5.0 (7971 buckets, 31884 max)

└─> cat /etc/issue CentOS release 6.5 (Final) Kernel \r on an \m

acqant commented 10 years ago

Any way to disable iptables with this CB?

chr4 commented 10 years ago

Sorry, I do not know "CB" :( Can you explain?

Your rules seem to not make a lot of sense. In case those are the real rules:

The cookbook is designed to only restart the iptables service when the iptables-restore config is changed. In your case this would be /etc/sysconfig/iptables and /etc/sysconfig/ip6tables.

Hope this information helps!

chr4 commented 10 years ago

Just realized that "CB" probably means cookbook :)

You can disable rules using the :delete action.

acqant commented 10 years ago

ok, took out the include_recipe in the CB ( it's a thing now! )

wiped out the iptables.d directory and added numbered rules.. looking much better thanks.

On Wed, Jul 9, 2014 at 7:28 PM, Chris Aumann notifications@github.com wrote:

Just realized that "CB" probably means cookbook :)

You can disable rules using the :delete action.

— Reply to this email directly or view it on GitHub https://github.com/chr4-cookbooks/iptables-ng/issues/28#issuecomment-48548311 .