Skip to content

Instantly share code, notes, and snippets.

@UtahDave
Created March 21, 2013 22:38
Show Gist options
  • Save UtahDave/5217462 to your computer and use it in GitHub Desktop.
Save UtahDave/5217462 to your computer and use it in GitHub Desktop.
An example of using the Salt peer interface to query web server IP addresses and add them to an iptables config.
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
{% for ipaddr in ipaddrs %}
-A INPUT -p tcp -s {{ ipaddr[0] }} --sport 1024:65535 -d {{ dbserver }} --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -s {{ dbserver }} --sport 3306 -d {{ ipaddr[0] }} --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
{% endfor %}
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
/etc/sysconfig/iptables:
file.managed:
- source: salt://dbserver/iptables
- user: root
- group: root
- mode: 600
- template: jinja
- dbserver: {{ salt['publish.publish']('dbserver', 'network.ip_addrs', 'eth1')['dbserver'].pop() }}
- ipaddrs: {{ salt['publish.publish']('*web*', 'network.ip_addrs', 'eth1').values() }}
@retr0h
Copy link

retr0h commented Apr 12, 2013

UtahDave, you are the awesomes! Even better don't have to write a custom state, and can access it right in a sls. If you ever go to the OpenStack summits, I owe u a beer or three :)

@auser
Copy link

auser commented Jul 21, 2013

retr0h! Are you using saltstack these days?

@cowmix
Copy link

cowmix commented Oct 22, 2013

OMG.. This example makes me want to cry..

THANK YOU.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment