[...]
class iptables {
file { "/etc/sysconfig/iptables":
mode => 0644,
owner => root,
content => "*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
-A INPUT -d 127.0.0.0/255.0.0.0 -i lo -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8006 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 13782 -j ACCEPT
COMMIT"
}
service { iptables:
ensure => running, # make sure the service is running
subscribe => file[""/etc/sysconfig/iptables"] # and restart it if the config changes
}
}