puppetlabs-firewall & rate limit

[Ciro Iriarte]

Hi!, anybody know if it's possible to create a rule equivalent to this with puppetlabs' firewall module?:

iptables -I INPUT -i eth0 -p <PROTO> --dport <PORT> -m hashlimit --hashlimit-mode srcip \

  --hashlimit-srcmask 32 --hashlimit-above 100/s                        \

  --hashlimit-burst 100 --hashlimit-name=bad -j DROP

I've seen some references of rate limiting, but no example on the documentation.

Regards,

Ciro

[Juan Sierra Pons]

> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/49ede11f-80b9-468f-82fa-403ae63f5b21%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

Hi,

In this cases what I usually do is create the desired state manually
and then use Puppet RAL to get the puppetized version.

1.- Create the iptables rules you want on the command line
2.- use "puppet resource firewall" to get the puppet code

Eg:
[...]
puppet resource firewall
firewall { '000 accept all icmp':
ensure => 'present',
action => 'accept',
chain => 'INPUT',
isfragment => 'false',
proto => 'icmp',
random => 'false',
rdest => 'false',
reap => 'false',
rsource => 'false',
rttl => 'false',
socket => 'false',
table => 'filter',
}
firewall { '103 allow https':
ensure => 'present',
action => 'accept',
chain => 'INPUT',
isfragment => 'false',
port => ['443'],
proto => 'tcp',
random => 'false',
rdest => 'false',
reap => 'false',
rsource => 'false',
rttl => 'false',
socket => 'false',
table => 'filter',
}
[...]

Best regards
--------------------------------------------------------------------------------------
Juan Sierra Pons ju...@elsotanillo.net
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE
--------------------------------------------------------------------------------------

[Ciro Iriarte]

Thanks for the suggestion!, seems to be working as the resource was created, but the rule seems little weird, would that be correct? O_o

Command:

iptables -I INPUT -i eth0 -p udp --dport 53 -m hashlimit --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-above 100/s --hashlimit-burst 100 --hashlimit-name=bad-client -j DROP

Resource generated:

firewall { '9001 b869ac85751524ce9edb979d29058969':

  ensure     => 'present',

  action     => 'drop',

  chain      => '--hashlimit-mode',

  dport      => ['bad-client'],

  iniface    => 'srcip',

  isfragment => 'false',

  proto      => '--hashlimit-name',

[Juan Sierra Pons]

Hi,

I haven't used a similar rule on IPtables, so I don't know if the puppet one created is equivalent.

So next step i think would be check different iptables output from the same rule. The one created by the command line and the one created by puppet. The steps would be

1.- Flush the iptables table

2.- Create the rule by command line

3.- Save the output of "iptables -L"
4.- Flush the iptables table

5.- Create the the rule again using puppet

puppet apply -e '

firewall { '9001 b869ac85751524ce9edb979d29058969':

  ensure     => 'present',

  action     => 'drop',

  chain      => '--hashlimit-mode',

  dport      => ['bad-client'],

  iniface    => 'srcip',

  isfragment => 'false',

  proto      => '--hashlimit-name',

  random     => 'false',

  rdest      => 'false',

  reap       => 'false',

  rsource    => 'false',

  rttl       => 'false',

  socket     => 'false',

  table      => 'filter',

}
'
6.- Save the output of "iptables -L"

7.- Compare both outputs to see if both ways generate the same output

Hope it helps

Best regards

--------------------------------------------------------------------------------------
Juan Sierra Pons                                 ju...@elsotanillo.net