Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've created a server box using Vagrant and Chef and everything is up and running correctly. However, when the box is installed from scratch the default iptables rules are in place and so I need to disable the firewall in order to access my web server.

(This is a local VM btw so I don't care about firewall security).

On launching the VM I ssh to it and flush the iptables, which works fine. But what I would prefer is to run a shell script when the machine is created to do this.

Even better I would like configure the iptables using a recipe but I don't see a supported cookbook.


share|improve this question
up vote 9 down vote accepted

One way to set the firewall rules in CentOS is to replace the /etc/sysconfig/iptables entirely by using a template in the recipe.

Say you want to adjust the routing because you are setting up an Apache web server ("apache2") cookbook. Create the file cookbooks/apache2/templates/default/iptables.erb with following content:

# Firewall configuration created and managed by Chef
# Do not edit manually
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Be sure and have a line return after the COMMIT.

Then call the template in your recipe, and afterward restart the iptables service.

# Load firewall rules we know works
template "/etc/sysconfig/iptables" do
  # path "/etc/sysconfig/iptables"
  source "iptables.erb"
  owner "root"
  group "root"
  mode 00600
  # notifies :restart, resources(:service => "iptables")

execute "service iptables restart" do
  user "root"
  command "service iptables restart"

When you run vagrant up, you will see the following output (excerpt).

INFO: Processing template[/etc/sysconfig/iptables] action create (bpif_apache2::default line 40)
INFO: template[/etc/sysconfig/iptables] backed up to /var/chef/backup/etc/sysconfig/iptables.chef-20130312055953
INFO: template[/etc/sysconfig/iptables] updated content
INFO: template[/etc/sysconfig/iptables] owner changed to 0
INFO: template[/etc/sysconfig/iptables] group changed to 0
INFO: template[/etc/sysconfig/iptables] mode changed to 600
INFO: Processing execute[service iptables restart] action run (bpif_apache2::default line 49)
INFO: execute[service iptables restart] ran successfully

The following links helped me grok and finally solve this problem.

FWIW, Opscode seems to be to find the firewalls in CentOS a bit of a challenge, too, as per their apache2 cookbook README (Feb 23, 2013):

The easiest but certainly not ideal way to deal with IPtables is to flush all rules. Opscode does provide an iptables cookbook but is migrating from the approach used there to a more robust solution utilizing a general "firewall" LWRP that would have an "iptables" provider. Alternately, you can use ufw, with Opscode's ufw and firewall cookbooks to set up rules. See those cookbooks' READMEs for documentation.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .