Module: IptablesGenerator

Defined in:
lib/iptables_generator.rb

Class Method Summary collapse

Class Method Details

.allow_established ⇒ Object 



15
16
17
 
# File 'lib/iptables_generator.rb', line 15

def allow_established
  "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n"
end

.allow_ip(ip) ⇒ Object 



27
28
29
 
# File 'lib/iptables_generator.rb', line 27

def allow_ip(ip)
  "-A INPUT -s #{ip} -j ACCEPT\n"
end

.allow_ips(ips) ⇒ Object 



31
32
33
 
# File 'lib/iptables_generator.rb', line 31

def allow_ips(ips)
  ips.map{ |ip| allow_ip(ip) }.join ''
end

.allow_listen(ports, prot = 'tcp', nic = 'all') ⇒ Object

Rule to open a given port(s)



36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 
# File 'lib/iptables_generator.rb', line 36

def allow_listen(ports, prot = 'tcp', nic = 'all')
  if ports.empty?
    return ''
  end

  # -A INPUT -p tcp -m multiport --dport 80,443 -j ACCEPT
  result = "-A INPUT"

  # Did we want a specific nics?
  #TODO: Convert this to an options hash
  if (nic != 'all' )
    result << " -i #{nic}"
  end

  result << " -p #{prot} -m multiport --dport #{ports.join(",")} -j ACCEPT\n"
  result
end

.allow_ping ⇒ Object 



19
20
21
 
# File 'lib/iptables_generator.rb', line 19

def allow_ping
  "-A INPUT -p icmp --icmp-type any -j ACCEPT\n"
end

.allow_ssh ⇒ Object 



23
24
25
 
# File 'lib/iptables_generator.rb', line 23

def allow_ssh
  "-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT\n"
end

.deny_all ⇒ Object 



4
5
6
7
8
9
10
11
12
13
 
# File 'lib/iptables_generator.rb', line 4

def deny_all
# Default to dropping unmatched input, Default to dropping unmatched forward requests, Allow all outgoing requests, Allow everything on loopback
<<EOS_DENY_ALL
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
EOS_DENY_ALL
end