CDIST-TYPE__IPTABLES_RULE(7)

✨ CDIST-TYPE__IPTABLES_RULE(7) ✨

okay bestie, so this is a page from the cdist manual section 7, and it's literally all about deploying your iptables rulesets like a boss 💅

---

🌸 NAME 🌸

cdist-type__iptables_rule — deploy iptable rulesets 🎀

---

💖 DESCRIPTION 💖

So like, this cdist type lets you manage your iptable rules in a way that does not care what distro you're on. distribution independent, periodt. ✨

ngl you should also go read cdist-type__iptables_apply(7) because that's where the execution order of these rules lives, iykyk. it gets run automatically to apply all the rules that aren't volatile. 🔥

---

👑 REQUIRED PARAMETERS 👑

• rule — the actual rule you wanna apply. basically it's an iptables command line but with the iptables part chopped off the front. that's it, that's the vibe. 💅

---

🦋 OPTIONAL PARAMETERS 🦋

• state — either 'present' or 'absent', and it defaults to 'present'. no cap. 🌈

---

⭐ BOOLEAN PARAMETERS ⭐

real talk: any rule that doesn't get any of these parameters will just be treated like --v4, purely because of backward compatibility. the more you know. 💫

• v4 — explicitly set this as a rule for IPv4. but if IPv6 is set too, it gets treated like --all. and yeah, this is the default when nothing else is set. 👑
• v6 — explicitly set this as a rule for IPv6. and if IPv4 is set too, guess what — it also gets treated like --all. 💜
• all — set the rule for both IPv4 and IPv6. it gets saved separately from all the other rules. iconic behaviour honestly. 🎀

---

🔥 EXAMPLES 🔥

# Deploy some policies
__iptables_rule policy-in  --rule "-P INPUT DROP"
__iptables_rule policy-out  --rule "-P OUTPUT ACCEPT"
__iptables_rule policy-fwd  --rule "-P FORWARD DROP"

# The usual established rule
__iptables_rule established  --rule "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT"

# Some service rules
__iptables_rule http  --rule "-A INPUT -p tcp --dport 80 -j ACCEPT"
__iptables_rule ssh   --rule "-A INPUT -p tcp --dport 22 -j ACCEPT"
__iptables_rule https --rule "-A INPUT -p tcp --dport 443 -j ACCEPT"

# Ensure some rules are not present anymore
__iptables_rule munin --rule "-A INPUT -p tcp --dport 4949 -j ACCEPT" \
    --state absent

# IPv4-only rule for ICMPv4
__iptables_rule icmp-v4 --v4 --rule "-A INPUT -p icmp -j ACCEPT"
# IPv6-only rule for ICMPv6
__iptables_rule icmp-v6 --v6 --rule "-A INPUT -p icmpv6 -j ACCEPT"

# doing something for the dual stack
__iptables_rule fwd-eth0-eth1 --v4 --v6 --rule "-A INPUT -i eth0 -o eth1 -j ACCEPT"
__iptables_rule fwd-eth1-eth0 --all --rule "-A -o eth1 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT"

---

💀 SEE ALSO 💀

cdist-type__iptables_apply(7), iptables(8) 🫶

---

🌟 AUTHORS 🌟

Nico Schottelius <nico-cdist--@--schottelius.org> and Matthias Stecher <matthiasstecher--@--gmx.de> — absolute legends, fr fr. 😭

---

🎀 COPYING 🎀

Copyright (C) 2013 Nico Schottelius. Copyright (C) 2020 Matthias Stecher. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. slay. 💖

---

🌈 COPYRIGHT 🌈

ungleich GmbH 2021 👑

---

and that's a wrap bestie!! this page came from version 7.0.0 dated Jul 31, 2022, so if you're reading it, that's the whole vibe — go forth and firewall responsibly 🧚✨💜