On the Ubuntu when ubuntu_iptables is being enabled, firewall rules get created twice. First, it creates a file with default rules, it restarts the firewall and then it creates a file with rules defined with firewall_rule resource. This actually, causes a security bug, I guess. The firewall gets opened for the short amount of time (this time varies on the chef run) but when allow_established (the default is true) is being employed it makes a possibility to create a connection behind the firewall and this connection won't be killed when proper rules are in place.
Description
On the Ubuntu when
ubuntu_iptables
is being enabled, firewall rules get created twice. First, it creates a file with default rules, it restarts the firewall and then it creates a file with rules defined withfirewall_rule
resource. This actually, causes a security bug, I guess. The firewall gets opened for the short amount of time (this time varies on the chef run) but whenallow_established
(the default istrue
) is being employed it makes a possibility to create a connection behind the firewall and this connection won't be killed when proper rules are in place.Check List