firewall { '000 allow packets with valid state':
- state => ['RELATED', 'ESTABLISHED'],
- jump => 'ACCEPT',
+ state => ['RELATED', 'ESTABLISHED'],
+ jump => 'ACCEPT',
}
firewall { '001 allow icmp':
- proto => 'icmp',
- jump => 'ACCEPT',
+ proto => 'icmp',
+ jump => 'ACCEPT',
}
firewall { '002 allow all to lo interface':
- iniface => 'lo',
- jump => 'ACCEPT',
+ iniface => 'lo',
+ jump => 'ACCEPT',
}
firewall { '100 allow http':
- proto => 'tcp',
- dport => '80',
- jump => 'ACCEPT',
+ proto => 'tcp',
+ dport => '80',
+ jump => 'ACCEPT',
}
firewall { '100 allow ssh':
- proto => 'tcp',
- dport => '22',
- jump => 'ACCEPT',
+ proto => 'tcp',
+ dport => '22',
+ jump => 'ACCEPT',
}
firewall { '100 allow mysql from internal':
- proto => 'tcp',
- dport => '3036',
- source => '10.5.5.0/24',
- jump => 'ACCEPT',
+ proto => 'tcp',
+ dport => '3036',
+ source => '10.5.5.0/24',
+ jump => 'ACCEPT',
}
firewall { '999 drop everything else':
- jump => 'DROP',
+ jump => 'DROP',
}
resources { 'firewall':
firewall { '000 allow foo':
- dport => [7061, 7062],
+ dport => [7061, 7062],
action => accept,
- proto => "tcp",
+ proto => 'tcp',
}
firewall { '975 log test':
- state => 'NEW',
+ state => 'NEW',
log_level => 'panic',
- jump => 'LOG'
+ jump => 'LOG'
}
firewall { '001 allow boo':
- action => accept,
- iniface => "eth0",
- sport => "123",
- dport => "123",
- proto => "tcp",
- destination => "1.1.1.0/24",
- source => "2.2.2.0/24",
+ action => accept,
+ iniface => 'eth0',
+ sport => '123',
+ dport => '123',
+ proto => 'tcp',
+ destination => '1.1.1.0/24',
+ source => '2.2.2.0/24',
}
firewall { '100 snat for network foo2':
firewall { '999 bar':
action => accept,
- dport => "1233",
- proto => "tcp",
+ dport => '1233',
+ proto => 'tcp',
}
firewall { '002 foo':
action => drop,
- dport => "1233",
- proto => "tcp",
+ dport => '1233',
+ proto => 'tcp',
}
firewall { '010 icmp':
action => accept,
- proto => "icmp",
- icmp => "echo-reply",
+ proto => 'icmp',
+ icmp => 'echo-reply',
}
firewall { '010 INPUT allow loopback':
- action => accept,
+ action => accept,
iniface => 'lo',
- chain => 'INPUT',
+ chain => 'INPUT',
}
firewall { '005 INPUT disregard DHCP':
action => drop,
- dport => ['bootpc', 'bootps'],
- proto => 'udp'
+ dport => ['bootpc', 'bootps'],
+ proto => 'udp'
}
firewall { '006 INPUT disregard netbios':
action => drop,
- proto => 'udp',
- dport => ['netbios-ns', 'netbios-dgm', 'netbios-ssn'],
+ proto => 'udp',
+ dport => ['netbios-ns', 'netbios-dgm', 'netbios-ssn'],
}
firewall { '006 Disregard CIFS':
action => drop,
- dport => 'microsoft-ds',
- proto => 'tcp'
+ dport => 'microsoft-ds',
+ proto => 'tcp'
}
firewall { '050 INPUT drop invalid':
action => drop,
- state => 'INVALID',
+ state => 'INVALID',
}
firewall { '051 INPUT allow related and established':
action => accept,
- state => ['RELATED', 'ESTABLISHED'],
+ state => ['RELATED', 'ESTABLISHED'],
}
firewall { '053 INPUT allow ICMP':
action => accept,
- icmp => '8',
- proto => 'icmp',
+ icmp => '8',
+ proto => 'icmp',
}
firewall { '055 INPUT allow DNS':
action => accept,
- proto => 'udp',
- sport => 'domain'
+ proto => 'udp',
+ sport => 'domain'
}
firewall { '056 INPUT allow web in and out':
action => accept,
proto => 'tcp',
- port => 80
+ port => 80
}
firewall { '057 INPUT limit NTP':
firewall { '999 FORWARD drop':
action => drop,
- chain => 'FORWARD',
+ chain => 'FORWARD',
}
firewall { '001 OUTPUT allow loopback':
- action => accept,
- chain => 'OUTPUT',
+ action => accept,
+ chain => 'OUTPUT',
outiface => 'lo',
}
firewall { '100 OUTPUT drop invalid':
action => drop,
- chain => 'OUTPUT',
- state => 'INVALID',
+ chain => 'OUTPUT',
+ state => 'INVALID',
}
resources { 'firewall':