@@ -77,24 +77,24 @@ class my_fw::pre {
77
77
78
78
# Default firewall rules
79
79
firewall { '000 accept all icmp':
80
- proto => 'icmp',
81
- action => 'accept',
80
+ proto => 'icmp',
81
+ jump => 'accept',
82
82
}
83
83
-> firewall { '001 accept all to lo interface':
84
84
proto => 'all',
85
85
iniface => 'lo',
86
- action => 'accept',
86
+ jump => 'accept',
87
87
}
88
88
-> firewall { '002 reject local traffic not on loopback interface':
89
89
iniface => '! lo',
90
90
proto => 'all',
91
91
destination => '127.0.0.1/8',
92
- action => 'reject',
92
+ jump => 'reject',
93
93
}
94
94
-> firewall { '003 accept related established rules':
95
95
proto => 'all',
96
96
state => ['RELATED', 'ESTABLISHED'],
97
- action => 'accept',
97
+ jump => 'accept',
98
98
}
99
99
}
100
100
```
@@ -108,7 +108,7 @@ existing connections are not closed.
108
108
class my_fw::post {
109
109
firewall { '999 drop all':
110
110
proto => 'all',
111
- action => 'drop',
111
+ jump => 'drop',
112
112
before => undef,
113
113
}
114
114
}
@@ -218,16 +218,16 @@ Basic accept ICMP request example:
218
218
219
219
``` puppet
220
220
firewall { '000 accept all icmp requests':
221
- proto => 'icmp',
222
- action => 'accept',
221
+ proto => 'icmp',
222
+ jump => 'accept',
223
223
}
224
224
```
225
225
226
226
Drop all:
227
227
228
228
``` puppet
229
229
firewall { '999 drop all other requests':
230
- action => 'drop',
230
+ jump => 'drop',
231
231
}
232
232
```
233
233
@@ -239,7 +239,7 @@ IPv6 rules can be specified using the _ip6tables_ provider:
239
239
firewall { '006 Allow inbound SSH (v6)':
240
240
dport => 22,
241
241
proto => 'tcp',
242
- action => 'accept',
242
+ jump => 'accept',
243
243
protocol => 'ip6tables',
244
244
}
245
245
```
@@ -265,7 +265,7 @@ class profile::apache {
265
265
firewall { '100 allow http and https access':
266
266
dport => [80, 443],
267
267
proto => 'tcp',
268
- action => 'accept',
268
+ jump => 'accept',
269
269
}
270
270
}
271
271
```
@@ -283,14 +283,14 @@ Examples:
283
283
284
284
``` puppet
285
285
firewall { '001 disallow esp protocol':
286
- action => 'accept',
286
+ jump => 'accept',
287
287
proto => '! esp',
288
288
}
289
289
290
290
firewall { '002 drop NEW external website packets with FIN/RST/ACK set and SYN unset':
291
291
chain => 'INPUT',
292
292
state => 'NEW',
293
- action => 'drop',
293
+ jump => 'drop',
294
294
proto => 'tcp',
295
295
sport => ['! http', '443'],
296
296
source => '! 10.0.0.0/8',
@@ -304,7 +304,7 @@ Examples:
304
304
305
305
``` puppet
306
306
firewall { '001 allow local disallow anycast':
307
- action => 'accept',
307
+ jump => 'accept',
308
308
src_type => ['LOCAL', '! ANYCAST'],
309
309
}
310
310
```
@@ -377,7 +377,7 @@ firewallchain { 'MY_CHAIN:filter:IPv4':
377
377
378
378
firewall { '100 my rule':
379
379
chain => 'MY_CHAIN',
380
- action => 'accept',
380
+ jump => 'accept',
381
381
proto => 'tcp',
382
382
dport => 5000,
383
383
}
@@ -471,7 +471,7 @@ firewall_multi { '100 allow http and https access':
471
471
],
472
472
dport => [80, 443],
473
473
proto => 'tcp',
474
- action => 'accept',
474
+ jump => 'accept',
475
475
}
476
476
```
477
477
@@ -572,7 +572,7 @@ firewall { '571 - hop_limit':
572
572
ensure => present,
573
573
proto => 'tcp',
574
574
dport => '571',
575
- action => 'accept ',
575
+ jump => 'ACCEPT ',
576
576
hop_limit => '5',
577
577
provider => 'ip6tables',
578
578
}
@@ -595,7 +595,7 @@ And the second negating access to a range of ports on `iptables`:
595
595
firewall { '560 - negated ports':
596
596
proto => `tcp`,
597
597
sport => ['! 560-570','! 580'],
598
- action => `accept`,
598
+ jump => `accept`,
599
599
}
600
600
```
601
601
0 commit comments