A New Firewall Salt State

My evaluation of Salt Stack is going pretty well. I’ve moved my main vps over to it with no ill effect, and was able to transcribe its Puppet manifest almost in its entirety. In many instances, I think the Salt version is more readable, and feels lighter than the Puppet version.

One glaring hole, though, is Salt’s support for firewall configuration. I was using the Puppet Labs firewall module to maintain iptables rules for my vps. That worked pretty well; but all Salt has right now is the ability to append new rules to a chain. The existing iptables state is documented at-risk for deprecation, too, so it’s a bad place to start.

It is expected that this state module, and other system-specific firewall states, may at some point be deprecated in favor of a more generic firewall state.

(Salt does have good support for iptables at the functional layer; it’s just the configuration management part that’s lacking.)

Since the firewall module I used before worked well enough, and I have a bunch of config based on it already, I’ve started reimplementing its interface in a Salt state module.

"100 salt-master":
  firewall_rule:
    - managed
    - protocol: tcp
    - ports: 4505:4506
    - action: accept

I’ve found developing a Salt state to be a pretty simple process so far. I really like how Salt’s effective layers cleanly separate between functionality, state management, and configuration. (My firewall state makes liberal use of the existing iptables module, for example.)

I’ve just published the module so far on github. This module at least recognizes that my existing config exists, and would be able to rebuild it in the proper order (sorted lexically by comment) if necessary. There’s a lot of functionality missing, but it’s a place to start. If anyone else uses it, that will just be an excuse to make it better!