Add iptables module and rules to puppet.

Change-Id: I3ed4896dd13f0de26c287a34f8a8e858d21a4634

manifests/site.pp

@@ -49,6 +49,10 @@ node "gerrit.openstack.org" {
     canonicalweburl => "https://review.openstack.org/",
     email => "review@openstack.org",
   }
+
+  class { 'iptables':
+    public_tcp_ports => [80, 443, 29418]
+  }    
 }
 
 node "gerrit-dev.openstack.org" {
@@ -57,6 +61,10 @@ node "gerrit-dev.openstack.org" {
     canonicalweburl => "https://review-dev.openstack.org/",
     email => "review-dev@openstack.org",
   }
+
+  class { 'iptables':
+    public_tcp_ports => [80, 443, 29418]
+  }    
 }
 
 node "docs.openstack.org" {

modules/iptables/manifests/init.pp

@@ -0,0 +1,41 @@
+#http://projects.puppetlabs.com/projects/1/wiki/Module_Iptables_Patterns
+
+class iptables($rules='', $public_tcp_ports=[], $public_udp_ports=[]) {
+  package {
+    "iptables-persistent": ensure => present;
+  }
+
+  service { "iptables-persistent":
+    require => Package["iptables-persistent"],
+
+    # Because there is no running process for this service, the normal status
+    # checks fail.  Because puppet then thinks the service has been manually
+    # stopped, it won't restart it.  This fake status command will trick puppet
+    # into thinking the service is *always* running (which in a way it is, as
+    # iptables is part of the kernel.)
+    hasstatus => true,
+    status => "true",
+    
+    # Under Debian, the "restart" parameter does not reload the rules, so tell
+    # Puppet to fall back to stop/start, which does work.
+    hasrestart => false,
+    
+  }
+
+  file { "/etc/iptables":
+      ensure => directory
+  }
+
+  file {
+    "/etc/iptables/rules":
+      owner   => "root",
+      group   => "root",
+      mode    => 640,
+      content => template('iptables/rules.erb'),
+      require => [Package["iptables-persistent"], File["/etc/iptables"]],
+      
+      # When this file is updated, make sure the rules get reloaded.
+      notify  => Service["iptables-persistent"],
+      ;
+  }
+}

modules/iptables/templates/rules.erb

@@ -0,0 +1,27 @@
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:openstack-INPUT - [0:0]
+-A INPUT -j openstack-INPUT
+-A FORWARD -j openstack-INPUT
+-A openstack-INPUT -i lo -j ACCEPT
+-A openstack-INPUT -p icmp --icmp-type any -j ACCEPT
+#-A openstack-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
+-A openstack-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+# SSH from anywhere
+-A openstack-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
+# SNMP from openstack cacti
+-A openstack-INPUT -m udp -p udp --dport 161 -s 50.57.120.246 -j ACCEPT
+# Public TCP ports
+<% public_tcp_ports.each do |port| -%>
+-A openstack-INPUT -m state --state NEW -m tcp -p tcp --dport <%= port %> -j ACCEPT
+<% end -%>
+# Public UDP ports
+<% public_udp_ports.each do |port| -%>
+-A openstack-INPUT -m udp -p udp --dport <%= port %> -j ACCEPT
+<% end -%>
+# Per-host rules
+<%= rules %>
+-A openstack-INPUT -j REJECT --reject-with icmp-host-prohibited
+COMMIT