puppetlabs-firewall ordering

gistfile1.pp

# Always persist firewall rules
exec { "persist-firewall":
  command => $operatingsystem ? {
    "debian" => "/sbin/iptables-save > /etc/iptables/rules.v4",
    /(RedHat|CentOS)/ => "/sbin/iptables-save > /etc/sysconfig/iptables",
  },
  refreshonly => true,
}
Firewall {
  notify => Exec["persist-firewall"],
  before => Class["my_soe::fwpost"],
  require => Class["my_soe::fwpre"],
}

# Setup firewall resource
resources { "firewall": purge => true }



# This is in my_soe/manifests/fwpost.pp:

class my_soe::fwpost {
  firewall { "999 drop all":
    proto => "all",
    action => drop,
    before => undef,
  }
}



# This is in my_soe/manifests/fwpre.pp

class my_soe::fwpre {
  Firewall {
    require => undef,
  }

  # Default firewall rules
  firewall { "000 accept all icmp":
    proto => "icmp",
    action => accept,
  }->
  firewall { "001 accept all to lo interface":
    proto => "all",
    iniface => "lo",
    action => accept,
  }->
  firewall { "002 accept related established rules":
    proto => "all",
    state => ["RELATED","ESTABLISHED"],
    action => accept,
  }
}