No firewallchain autorequire for INPUT, OUTPUT and FORWARD when table is :filter to enable DROP policy without blocking

[doc75]

This modification allows to disable autorequire of firewallchain only for the following:
INPUT:filter:...
OUTPUT:filter:...
FORWARD:filter:...

It allows to specify those firewallchains at the end of all firewall rules (in the my_fw::post for example) with a default DROP policy without blocking everything.

[kbarber-jenkins-bot]

Can one of the admins verify this patch?

[doc75]

CLA accepted just after the commit...

[apenney]

Any chance I can get you to explain this a little further? (Sorry, I mostly just do basic stuff with iptables myself). I'm not questioning the value of the contribution/patch, I just want to make sure I can add something to the README to explain this in more detail and I'm not sure I fully understand it.

[apenney]

(note to self, tested with rspec-system, works fine)

[ruckc]

Essentially, best practice security says that your firewall defaults to
drop. Therefore, when you create the firewallchain resource with a default
DROP policy, it is executed first, before the accept rules. This means
that when running it via puppet, if doing it through puppet agent -t in
ssh, it stops all communication BEFORE it gets to the action=>accept
firewall resources, which then bricks your server until console access is
attained to shutdown the firewall, and rerun puppet.

Curtis Ruck
Anytime: 210-857-1126

On Fri, Sep 13, 2013 at 1:51 PM, Ashley Penney notifications@github.comwrote:

Any chance I can get you to explain this a little further? (Sorry, I
mostly just do basic stuff with iptables myself). I'm not questioning the
value of the contribution/patch, I just want to make sure I can add
something to the README to explain this in more detail and I'm not sure I
fully understand it.

—
Reply to this email directly or view it on GitHubhttps://github.com//pull/240#issuecomment-24412268
.

[apenney]

I can see that being kind of a pain. ;)

[doc75]

@apenney: Thanks a lot for the merge
@ruckc: thanks for providing the explanation to enable the merge.