module for a simple blocking firewall

modules/utilities/unix/firewall/default_client_firewall/default_client_firewall.pp

@@ -0,0 +1,84 @@
+######################################################
+##### Purge all existing firewall rules (if any) #####
+######################################################
+resources { 'firewall':
+  purge => true,
+}
+
+#####################################################
+##### Default rules defined before custom rules #####
+#####################################################
+class pre {
+  Firewall {
+    require => undef,
+  }
+  # Default firewall rules
+  firewall { '000 accept all icmp':
+    proto  => 'icmp',
+    action => 'accept',
+  }->
+  firewall { '001 accept all to lo interface':
+    proto   => 'all',
+    iniface => 'lo',
+    action  => 'accept',
+  }->
+  firewall { '002 reject local traffic not on loopback interface':
+    iniface     => '! lo',
+    proto       => 'all',
+    destination => '127.0.0.1/8',
+    action      => 'reject',
+  }->
+  firewall { '003 accept related established rules':
+    proto  => 'all',
+    state  => ['RELATED', 'ESTABLISHED'],
+    action => 'accept',
+  }
+}
+
+######################################################
+##### Custom rules defined between default rules #####
+######################################################
+
+# firewall { '004 ssh':
+#   proto  => 'all',
+#   state  => ['RELATED', 'ESTABLISHED'],
+#   action => 'accept',
+# }
+
+# firewall { '004 custom rule example':
+#   proto  => 'all',
+#   state  => ['RELATED', 'ESTABLISHED'],
+#   action => 'accept',
+# }
+#
+# firewall { '005 custom rule example':
+#   proto  => 'all',
+#   state  => ['RELATED', 'ESTABLISHED'],
+#   action => 'accept',
+# }
+#
+# firewall { '006 custom rule example':
+#   proto  => 'all',
+#   state  => ['RELATED', 'ESTABLISHED'],
+#   action => 'drop',
+# }
+
+####################################################
+##### Default rules defined after custom rules #####
+####################################################
+class post {
+  firewall { '999 drop all':
+    proto  => 'all',
+    action => 'drop',
+    before => undef,
+  }
+}
+
+Firewall {
+  before  => Class['post'],
+  require => Class['pre'],
+}
+
+class { ['pre', 'post']: }
+
+class { 'firewall': }

modules/utilities/unix/firewall/default_client_firewall/secgen_metadata.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+
+<utility xmlns="http://www.github/cliffe/SecGen/utility"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://www.github/cliffe/SecGen/utility">
+  <name>iptables firewall config for clients</name>
+  <author>Z. Cliffe Schreuders</author>
+  <author>Jason Keighley</author>
+
+
+
+  <module_license>Apache v2</module_license>
+  <description>Filters out any new incoming connections, except for SSH.</description>
+
+  <type>firewall</type>
+  <platform>linux</platform>
+
+  <!--optional details-->
+  <reference>https://forge.puppet.com/puppetlabs/firewall</reference>
+  <software_name></software_name>
+  <software_license>Apache v2</software_license>
+
+  <!--import puppet module-->
+  <requires>
+    <module_path>utilities/unix/firewall/firewall</module_path>
+  </requires>
+
+</utility>

modules/utilities/unix/firewall/firewall/firewall.pp

@@ -1,78 +1 @@
-######################################################
-##### Purge all existing firewall rules (if any) #####
-######################################################
-resources { 'firewall':
-  purge => true,
-}
-
-#####################################################
-##### Default rules defined before custom rules #####
-#####################################################
-class pre {
-  Firewall {
-    require => undef,
-  }
-  # Default firewall rules
-  firewall { '000 accept all icmp':
-    proto  => 'icmp',
-    action => 'accept',
-  }->
-  firewall { '001 accept all to lo interface':
-    proto   => 'all',
-    iniface => 'lo',
-    action  => 'accept',
-  }->
-  firewall { '002 reject local traffic not on loopback interface':
-    iniface     => '! lo',
-    proto       => 'all',
-    destination => '127.0.0.1/8',
-    action      => 'reject',
-  }->
-  firewall { '003 accept related established rules':
-    proto  => 'all',
-    state  => ['RELATED', 'ESTABLISHED'],
-    action => 'accept',
-  }
-}
-
-######################################################
-##### Custom rules defined between default rules #####
-######################################################
-
-# firewall { '004 custom rule example':
-#   proto  => 'all',
-#   state  => ['RELATED', 'ESTABLISHED'],
-#   action => 'accept',
-# }
-#
-# firewall { '005 custom rule example':
-#   proto  => 'all',
-#   state  => ['RELATED', 'ESTABLISHED'],
-#   action => 'accept',
-# }
-#
-# firewall { '006 custom rule example':
-#   proto  => 'all',
-#   state  => ['RELATED', 'ESTABLISHED'],
-#   action => 'drop',
-# }
-
-####################################################
-##### Default rules defined after custom rules #####
-####################################################
-class post {
-  firewall { '999 drop all':
-    proto  => 'all',
-    action => 'drop',
-    before => undef,
-  }
-}
-
-Firewall {
-  before  => Class['post'],
-  require => Class['pre'],
-}
-
-class { ['pre', 'post']: }
-
-class { 'firewall': }
+# just the puppet module

modules/utilities/unix/firewall/firewall/secgen_metadata.xml

@@ -24,10 +24,8 @@
   <software_name></software_name>
   <software_license>Apache v2</software_license>
 
-  <!--Cannot co-exist with other iptables installations-->
-
   <requires>
     <type>update</type>
   </requires>
 
-</utility>
+</utility>