*filter

# Dropping incoming connections that don't have explicit rules below
# TODO: change the REJECT to a DROP once we're happy with settings:
:INPUT REJECT [68:4456]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1628:151823]

# Allow established connections for both public and private connections
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Opening specific whitelisted services:
<% @node[:iptables][:whitelist].each do |port, addresses| %>
  <%# Allow comments: %>
  <% next if port == "_comment" %>
  <% addresses.each do |address| %>
    -A FWR -p tcp -s <%= address %> --dport <%= port %> -j ACCEPT
  <% end %>
<% end %>

# SSH is an exception; if we didn't specify a whitelist, allow all:
<% unless @node[:iptables][:whitelist]["22"] %>
  -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
<% end %>

# Opening ports wide open (likely to be overridden above)
<% @node[:iptables][:open].each do |port| %>
  -A INPUT -p tcp -m tcp --dport <%= port %> -j ACCEPT
<% end %>

# Allow established connections for both public and private connections
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Opening specific whitelisted services:
<% @node[:iptables][:whitelist].each do |port, addresses| %>
  <%# Allow comments: %>
  <% next if port == "_comment" %>
  <% addresses.each do |address| %>
    -A FWR -p tcp -s <%= address %> --dport <%= port %> -j ACCEPT
  <% end %>
<% end %>

# SSH is an exception; if we didn't specify a whitelist, allow all:
<% unless @node[:iptables][:whitelist]["22"] %>
  -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
<% end %>

# Opening ports wide open (likely to be overridden above)
<% @node[:iptables][:open].each do |port| %>
  -A INPUT -p tcp -m tcp --dport <%= port %> -j ACCEPT
<% end %>

Remove header block from template
Remove header block from template
