This module manages your firewall using iptables with pillar configured rules. Thanks to the nature of Pillars it is possible to write global and local settings (e.g. enable globally, configure locally)
Pull requests are welcome for other platforms (or other improvements ofcourse!)
All the configuration for the firewall is done via pillar (pillar.example).
firewall: enabled: True install: True strict: True
firewall: services: ssh: allow: - ['eth0','tcp','10.94.0.0/16'] - ['eth1','',''] - ['','','172.22.42.0/24']
Allow an entire class such as your internal network:
whitelist: networks: ips_allow: - 10.0.0.0/8
Salt combines both and effectively enables your firewall and applies the rules.
- Setting install to True will install
- Strict mode means: Deny everything except explicitly allowed (use with care!), including ipv6 traffic
- block_nomatch: With non-strict mode adds in a "REJECT" rule below the accept rules, otherwise other traffic to that service is still allowed. Can be defined per-service or globally, defaults to False.
- Servicenames can be either port numbers or servicenames (e.g. ssh, zabbix-agent, http) and are available for viewing/configuring in
- Allow rules are defined with : [interface, protocol, ip/subnet]. Empty interface or ip/subnet means "match all". Empty protocol means "tcp".
- You can define rules in multiple pillars. services items will be merged when you enable multiple services pillars.
You can use nat for interface.
#!stateconf yaml . jinja # iptables -t nat -A POSTROUTING -o eth0 -s 192.168.18.0/24 -j MASQUERADE nat: eth0: ips_allow: - 192.168.18.0/24