{"id":24527583,"url":"https://github.com/offlinehacker/puppet-iptables","last_synced_at":"2026-07-05T23:31:26.713Z","repository":{"id":6207870,"uuid":"7438881","full_name":"offlinehacker/puppet-iptables","owner":"offlinehacker","description":"Cross platform puppet iptables/ip6tables module using augeas for rule managment","archived":false,"fork":false,"pushed_at":"2013-01-09T10:08:54.000Z","size":140,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-11-16T05:04:16.400Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Puppet","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/offlinehacker.png","metadata":{"files":{"readme":"README.markdown","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-01-04T10:47:33.000Z","updated_at":"2019-01-09T22:29:03.000Z","dependencies_parsed_at":"2022-09-10T15:31:49.747Z","dependency_job_id":null,"html_url":"https://github.com/offlinehacker/puppet-iptables","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/offlinehacker/puppet-iptables","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/offlinehacker%2Fpuppet-iptables","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/offlinehacker%2Fpuppet-iptables/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/offlinehacker%2Fpuppet-iptables/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/offlinehacker%2Fpuppet-iptables/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/offlinehacker","download_url":"https://codeload.github.com/offlinehacker/puppet-iptables/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/offlinehacker%2Fpuppet-iptables/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35172975,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-05T02:00:06.290Z","response_time":100,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-22T06:19:37.096Z","updated_at":"2026-07-05T23:31:26.694Z","avatar_url":"https://github.com/offlinehacker.png","language":"Puppet","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Puppet iptables/ip6tables module using augeas for rule managment\n\nCross platform puppet iptables/ip6tables module using augeas for \nrule managment\n\nWhat does this mean?\n\n* Is easy and straightforward\n* And advanced at the same time\n* it will preserve all current or later included rules until they \n  don't break the iptables functionality you describe from puppet.\n\nThis module should cover all use cases and, because it's directly\nusing augeas it let's user write rules in augeas format and at the\nsame time keep it simple. Also rule order can simply be preserved.\n\n## Types\n\nThis module provides several types to make configuring iptables \neasier.\n\nThey are splitted in two layers of abstractions:\n\n* Base iptables types\n* Helper iptables types\n\n### Base iptables types\n\nBase types are basic types that manage iptables/ip6tables on\nthe same way. **It is advised not to use them, but usage of helper\ntypes is preffered**.\n\nIf you must use them, because helper types does not fit your needs,\nfirst create config with specified location of your ip table:\n\n    iptables::config {\"my_iptables_config\":\n        path =\u003e /path/to/my/iptables\n    }\n\nNow you can define several tables you wish to use:\n\n    iptables::table {\"my_nat_table\":\n        config =\u003e Iptable::Config[\"my_iptables_config\"],\n        table =\u003e \"nat\"\n    }\n\n    iptables::table {\"my_filter_table\":\n        config =\u003e Iptable::Config[\"my_iptables_config\"],\n        table =\u003e \"filter\"\n    }\n\n    iptables::table {\"my_mangle_table\":\n        config =\u003e Iptable::Config[\"my_iptables_config\"],\n        table =\u003e \"mangle\"\n    }\n\nNow define your chains, where you will put iptable rules:\n\n    iptables::chain { \"my_input_filter_chain\":\n        chain =\u003e \"INPUT\",\n        table =\u003e Iptables::Table[\"my_filter_table\"],\n        policy =\u003e \"DROP\"\n    }\n\n    iptables::chain { \"my_output_filter_chain\":\n        chain =\u003e \"OUTPUT\",\n        table =\u003e Iptables::Table[\"my_filter_table\"],\n        policy =\u003e \"DROP\"\n    }\n\n    iptables::chain { \"my_prerouting_nat_chain\":\n        chain =\u003e \"PREROUTING\",\n        table =\u003e Iptables::Table[\"my_nat_table\"],\n        policy =\u003e \"ACCEPT\"\n    }\n\n    iptables::chain { \"my_postrouting_nat_chain\":\n        chain =\u003e \"POSTROUTING\",\n        table =\u003e Iptables::Table[\"my_nat_table\"],\n        policy =\u003e \"ACCEPT\"\n    }\n\nGreat you are ready to create new rules:\n\n    # Enable DNAT for 192.168.2.10:80\n    iptables::rule { \"forward_port_80_nat\":\n        table =\u003e Iptables::Table[\"my_nat_table\"],\n        chain =\u003e \"PREROUTING\",\n        changes =\u003e [\n                \"set protocol tcp\",\n                \"set input eth0\",\n                \"set match[. = 'tcp'] tcp\",\n                \"set dport 80\",\n                \"set jump DNAT\",\n                \"set to 192.168.1.10\",\n        ],\n    }\n\n    # Accept forwarding connection on port 80\n    iptables::rule { \"forward_port_80_filter\":\n        table =\u003e Iptables::Table[\"my_filter_table\"],\n        chain =\u003e \"FORWARD\",\n        changes =\u003e [\n                \"set protocol tcp\",\n                \"set in-interface eth0\",\n                \"set destination 192.168.1.10\",\n                \"set match[. = 'tcp'] tcp\",\n                \"set dport 80\",\n                \"set match [ . = 'state'] state\",\n                \"set state 'NEW,ESTABLISHED,RELATED'\"\n                \"set jump ACCEPT\",\n        ],\n    }\n\n    # Enable masquerading for server behind nat\n    iptables::rule { \"masquerade\":\n        table =\u003e Iptables::Table[\"my_nat_table\"],\n        chain =\u003e \"POSTROUTING\",\n        changes =\u003e [\n                \"set out-interface eth0\",\n                \"set jump MASQUERADE\",\n        ],\n    }\n\n### Helper iptables types\n\nBecause usage of base iptables types if slow, i created some\nhelper types to make writing iptables more sane. All tables are\nalready there for you and you can easily rewrite code above as\nfollowing:\n\n    class {\"iptables::globals\":\n        iptables_path =\u003e \"/path/to/my/iptables\",\n    }\n\n    iptables::chain::filter { [\"INPUT\", \"OUTPUT\"]:\n        policy =\u003e \"DROP\"\n    }\n\n    iptables::chain::nat { [\"PREROUTING\", \"POSTROUTING\"]:\n        policy =\u003e \"ACCEPT\"\n    }\n\n    # Enable DNAT for 192.168.2.10:80\n    iptables::nat { \"forward_port_80\":\n        chain =\u003e \"PREROUTING\",\n        changes =\u003e [\n                \"set protocol tcp\",\n                \"set input eth0\",\n                \"set match[. = 'tcp'] tcp\",\n                \"set dport 80\",\n                \"set jump DNAT\",\n                \"set to 192.168.1.10\",\n        ],\n    }\n\n    # Accept forwarding connection on port 80\n    iptables::filter { \"forward_port_80\":\n        chain =\u003e \"FORWARD\",\n        changes =\u003e [\n                \"set protocol tcp\",\n                \"set in-interface eth0\",\n                \"set destination 192.168.1.10\",\n                \"set match[. = 'tcp'] tcp\",\n                \"set dport 80\",\n                \"set match [ . = 'state'] state\",\n                \"set state 'NEW,ESTABLISHED,RELATED'\"\n                \"set jump ACCEPT\",\n        ],\n    }\n\n    # Enable masquerading for server behind nat\n    iptables::nat { \"masquerade\":\n        chain =\u003e \"POSTROUTING\",\n        changes =\u003e [\n                \"set out-interface eth0\",\n                \"set jump MASQUERADE\",\n        ],\n    }\n\nPretty straightforward huh? \n\nWell there are also other helper types defined, especially i didn't \nmention ipv6 helper equialents, but you can look them up in helpers.pp file.\n\n## Example\n\nThis is more advanced example of how to use this module in a sane way.\n\n    package { \"iptables-persistent\":\n        ensure =\u003e \"installed\"\n    }\n\n    class {\"iptables::globals\":\n        iptables_path =\u003e \"/etc/iptables/rules.v4\",\n        ip6tables_path =\u003e \"/etc/iptables/rules.v6\"\n    }\n\n    iptables::chain::filter { [\"INPUT\", \"OUTPUT\", \"FORWARD\"]:\n        policy =\u003e \"ACCEPT\"\n    }\n\n    # Chain used for port forwading rules\n    iptables::chain::filter { [\"port_forward\"]:\n        policy =\u003e \"-\"\n    }\n\n    ip6tables::chain::filter { [\"INPUT\", \"OUTPUT\", \"FORWARD\"]:\n        policy =\u003e \"ACCEPT\"\n    }\n\n    # Chain used for port forwading rules\n    ip6tables::chain::filter { [\"port_forward\"]:\n        policy =\u003e \"-\"\n    }\n   \n    iptables::chain::nat { [\"PREROUTING\", \"POSTROUTING\", \"INPUT\", \"OUTPUT\"]:\n        policy =\u003e \"ACCEPT\"\n    }\n\n    # Chain used for port forwading rules\n    iptables::chain::nat { [\"port_forward\"]:\n        policy =\u003e \"-\"\n    }\n\n    # Check user.pp for defintion\n    port_forward { \"port_forward_65500\":\n        interface =\u003e \"eth1\",\n        ip =\u003e \"10.2.0.10\",\n        ip6 =\u003e \"2001:db8:0:2::10\",\n        port =\u003e \"22\"\n    }\n\n    # Check user.pp for defintion\n    port_forward { \"port_forward_80\":\n        interface =\u003e \"eth1\",\n        ip =\u003e \"10.2.0.10\",\n        ip6 =\u003e \"2001:db8:0:2::10\",\n        port =\u003e \"80\"\n    }\n\n    # Check user.pp for defintion\n    port_forward { \"port_forward_443\":\n        interface =\u003e \"eth1\",\n        ip =\u003e \"10.2.0.10\",\n        ip6 =\u003e \"2001:db8:0:2::10\",\n        port =\u003e \"443\"\n    }\n\n    iptables::filter { \"port_forward\":\n        chain =\u003e \"FORWARD\",\n        changes =\u003e [\n                \"set in-interface eth1\",\n                \"set jump port_forward\",\n        ],\n    }\n\n    iptables::nat { \"port_forward\":\n        chain =\u003e \"PREROUTING\",\n        changes =\u003e [\n                \"set in-interface eth1\",\n                \"set jump port_forward\",\n        ],\n    }\n\n    ip6tables::filter { \"port_forward\":\n        chain =\u003e \"FORWARD\",\n        changes =\u003e [\n                \"set in-interface eth1\",\n                \"set jump port_forward\",\n        ],\n    }\n\n    # Enable masquerading for server behind nat\n    iptables::nat { \"masquerade\":\n        chain =\u003e \"POSTROUTING\",\n        changes =\u003e [\n                \"set out-interface eth1\",\n                \"set jump MASQUERADE\",\n        ],\n    }\n\n    # Enable related and establised connections to outside\n    iptables::filter { \"accept_established\":\n        chain =\u003e \"FORWARD\",\n        changes =\u003e [\n                \"set out-interface eth1\",\n                \"set match[ . = 'state'] state\",\n                \"set state 'ESTABLISHED,RELATED'\",\n                \"set jump ACCEPT\",\n        ],\n        require =\u003e [Iptables::Filter[\"port_forward\"]]\n    }\n\n    # Enable related and establised connections to outside\n    ip6tables::filter { \"accept_established\":\n        chain =\u003e \"FORWARD\",\n        changes =\u003e [\n                \"set out-interface eth1\",\n                \"set match[ . = 'state'] state\",\n                \"set state 'ESTABLISHED,RELATED'\",\n                \"set jump ACCEPT\",\n        ],\n        require =\u003e [Ip6tables::Filter[\"port_forward\"]]\n    }\n\n## Contributions welcome!\n\nPlease contribute your code as pull requests if you add or fix code.\nI will try to merge or comment as soon as possible. Thanks! :)\n\n## License\n\n[Apache 2.0 License](http://www.apache.org/licenses/LICENSE-2.0.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fofflinehacker%2Fpuppet-iptables","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fofflinehacker%2Fpuppet-iptables","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fofflinehacker%2Fpuppet-iptables/lists"}