Mine

[...]


iptables.gbsm (this is the class of server i'm testing on)

control:

        AddInstallable = ( modifiedService_iptables )

files:

        /etc/sysconfig/iptables mode=0644
                                owner=root
                                group=root
                                action=fixall

editfiles:

        any::
                { /etc/sysconfig/iptables
                        AutoCreate
                        BeginGroupIfNoLineMatching "^#CFEngine EditFiles iptables.gbsm v1.000$"
                                EmptyEntireFilePlease
                                Append "*filter"
                                Append ":INPUT DROP [0:0]"
                                Append ":FORWARD DROP [0:0]"
                                Append "-A INPUT -d 127.0.0.0/255.0.0.0 -i lo -j ACCEPT "
                                Append "-A INPUT -m state --state ESTABLISHED -j ACCEPT "
                                Append "-A INPUT -p icmp -j ACCEPT"
                                Append "-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT "
                                Append "-A INPUT -p tcp -m state --state NEW -m tcp --dport 8006 -j ACCEPT "
                                Append "-A INPUT -p tcp -m state --state NEW -m tcp --dport 13782 -j ACCEPT "
                                Append "COMMIT"
                        EndGroup
                        DefineClasses modifiedService_iptables
                }

alerts:
     modifiedService_iptables::
          "The iptables has been modified, restarting iptables"

shellcommands:
     modifiedService_iptables::
        "/sbin/service iptables restart"