Managing firewalls with PE

Install the puppetlabs-firewall module to manage firewall policies.

Preparing to install into /etc/puppetlabs/puppet/environments/production/modules ...
Notice: Downloading from https://forgeapi.puppetlabs.com ...
Notice: Installing -- do not interrupt ...
/etc/puppetlabs/puppet/environments/production/modules
└── puppetlabs-firewall (v1.6.0)

Create a simple firewall module.

1. From the command line on the Puppet master, navigate to the modules directory:
   cd /etc/puppetlabs/code/environments/production/modules
2. Run mkdir -p my_fw/manifests to create the new module directory and its manifests directory.
3. From the manifests directory, use your text editor to create pre.pp.
4. Edit pre.pp so it contains the following Puppet code.

   class my_firewall::pre {
   
    # Default firewall rules
    firewall { '000 accept all icmp':
      proto   => 'icmp',
      action  => 'accept',
    }
   
    firewall { '001 accept all to lo interface':
      proto   => 'all',
      iniface => 'lo',
      action  => 'accept',
    }
   
    firewall { '002 accept related established rules':
      proto   => 'all',
      state   => ['RELATED', 'ESTABLISHED'],
      action  => 'accept',
    }
   
    # Allow SSH
    firewall { '100 allow ssh access':
      port   => '22',
      proto  => tcp,
      action => accept,
    }
   
   }

   The pre.pp file defines the "pre" group rules that the firewall applies when a service requests access.

5. Save and exit the file.
6. From the manifests directory, use your text editor to create post.pp.
7. Edit post.pp so that it contains the following Puppet code.

   class my_firewall::post {
   
     firewall { "999 drop all other requests":
       action => "drop",
     }
   
   }

   The post.pp file defines the rule for the firewall to drop any requests that haven’t met the rules defined by pre.pp.

8. Save and exit the file.
9. From the manifests directory, use your text editor to create init.pp.
10. Edit the init.pp file so that it contains the following Puppet code.

     class my_firewall {
    
       stage { 'fw_pre':  before  => Stage['main']; }
       stage { 'fw_post': require => Stage['main']; }
    
       class { 'my_fw::pre':
         stage => 'fw_pre',
       }
    
       class { 'my_fw::post':
         stage => 'fw_post',
       }
    
      resources { "firewall":
         purge => true
      }
    
    }

    The init.pp file applies the previous two classes, as well as telling Puppet when to apply the classes in relation to the main stage (which ensures the classes are applied in the correct order).

11. Save and exit the file.

Create a group of nodes that you want to manage firewalls for.

1. In the PE console, click Nodes> Classification, and click Add group. 
2. In the Group name field, name your group, for example firewall_example, and click Add.
3. Click Add membership rules, classes, and variables.
4. On the Rules tab, in the Node name field, enter the name of the PE-managed node you want to add to this group, and click Pin node.

   Repeat this step for any additional nodes you want to add.

   CAUTION: Do not add the Puppet master to this group. Your firewall class does not yet contain rules to allow access to the Puppet master. You will add these rules later when you write a class to open ports for the Puppet master.
5. Commit changes.

Enforce firewall rules by adding the firewall class to the nodes you want to manage.

1. In the console, click Classification, and find and select the firewall_example group.
2. On the Configuration tab, in the Class name field, select my_firewall.
   Tip: You only need to add the main my_firewall class. It contains the other classes from the module.
3. Click Add class.

   The my_firewall class now appears in the list of classes for the firewall_example group.

   When Puppet runs, it configures the nodes using the newly-assigned classes. Wait one or two minutes.

When creating firewall policies, you must allow special access to the Puppet master.

1. From the command line on the Puppet master, navigate to the modules directory:
   cd /etc/puppetlabs/puppet/modules
2. Run mkdir -p privileges/manifests to create the new module directory and its manifests directory.
3. From the manifests directory, use your text editor to create the init.pp file, and edit it so it contains the following Puppet code.

   class my_master {
      include my_firewall
   
     firewall { '100 allow PE Console access':
       port   => '443',
       proto  => tcp,
       action => accept,
     }
   
     firewall { '100 allow Puppet master access':
       port   => '8140',
       proto  => tcp,
       action => accept,
     }
   
     firewall { '100 allow ActiveMQ MCollective access':
       port   => '61613',
       proto  => tcp,
       action => accept,
     }
   
    }

4. Using the console, add my_master class to the Puppet master.
5. Add the Puppet master to the firewall_example group.
6. After Puppet runs, navigate to the Reports page, and click the latest run report for your Puppet master.
7. Click the Events tab.
   You will see three events on this node, indicating that your firewall now allows access to MCollective, the PE console, and the Puppet master.

   Tip: For all firewall configuration needs for your PE installation, refer to the system configuration documentation.

If your infrastructure changes from what you've specified, PE will correct that change.

1. Select an agent node on which you applied the my_firewall class, and run iptables --list.
2. Note that the rules from the my_firewall class have been applied.
3. From the command line, insert a new rule to allow connections to port 8449 by running iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 8449 -j ACCEPT.
4. Run iptables -- list again and note this new rule is now listed.
5. After Puppet runs on the agent node, run iptables -- list on that node once more, and notice that PE has enforced the desired state you specified for the firewall rules.