zulip/puppet/zulip_ops/files/iptables/trailer


# Drop everything else
-A INPUT   -j LOGDROP
-A FORWARD -j LOGDROP

COMMIT
puppet: Use concat fragments to place port allows next to services. This means that services will only open their ports if they are actually run, without having to clutter rules.v4 with a log of `if` statements. This does not go as far as using `puppetlabs/firewall`[1] because that would represent an additional DSL to learn; raw IPtables sections can easily be inserted into the generated iptables file via `concat::fragment` (either inline, or as a separate file), but config can be centralized next to the appropriate service. [1] https://forge.puppet.com/modules/puppetlabs/firewall 2021-05-25 04:12:28 +02:00
			`# Drop everything else`
			`-A INPUT -j LOGDROP`
			`-A FORWARD -j LOGDROP`

			`COMMIT`