<commit_before># Puppet module for firewalling

Uses iptables as a simple firewall.

## Description

To firewall with iptables' help this module cleans up all & reinits with bash scripts. Custom parts are created in custom generated bash script. Also module adds persistency to iptables.
**Note:** Currently module was tested on Debian family.

## Usage

To allow on your managed node these things:
* SSH from home (172.16.58.3)
* web from everywhere (and in 1st order)
* some custom port from some subnet (let it be xenmgm service on port 65000 from subnet 172.16.58.3/24)

Use code like this:

```ruby
iptables::rule {
  "Allow SSH from home":
    port => "ssh", source  => "172.16.58.3";
  "Allow web":
    port => "www", action  => "insert";
  "Allow xenmgm":
    port => "65000", source  => "172.16.58.3/24";
}
```
<commit_msg>Update readme with new use cases<commit_after># Puppet module for firewalling

Uses iptables as a simple firewall.

## Description

To firewall with iptables' help this module cleans up all & reinits with bash scripts. Custom parts are created in custom generated bash script. Also module adds persistency to iptables.
**Note:** Currently module was tested on Debian family.

## Usage

### Default

To allow on your managed node these things:
* SSH from home (172.16.58.3)
* web from everywhere (and in 1st order)
* some custom port from some subnet (let it be xenmgm service on port 65000 from subnet 172.16.58.3/24)

Use code like this:

```ruby
iptables::rule {
  "Allow SSH from home":
    port => "ssh", source  => "172.16.58.3";
  "Allow web":
    port => "www", action  => "insert";
  "Allow xenmgm":
    port => "65000", source  => "172.16.58.3/24";
}
```

### Many sources per rule

When you have a few sources for one port -- you can supply an array:

```ruby
iptables::rule {
  "Allow SSH from home and work":
    port => "ssh", source  => ["172.16.58.3", "192.168.3.11"];
}
```

### Rules priorities / ordering

By conception puppet does not support ordering. If you need some sort of, you
can try to play with rule's names, but it looks awful.

For this case we have plus & minus params. So by default all rules have 0 weight.
If you want to put rule ni front -- use "plus". If you want to make always last --
use minus:

```ruby
iptables::rule {
  "Web will be realy first":
    port => "www", plus => 20;
  "SSH somewhere in the middle":
    port => "ssh";
  "And mysql is always last":
    port => "3306", minus => 30;
}
```
{'fraction_non_alphanumeric': 0.11771844660194175, 'fraction_numerical': 0.04854368932038835, 'mean_word_length': 3.5210237659963437, 'pattern_counts': {'":': 10, '<': 3, '<?xml version=': 0, '>': 22, 'https://': 0, 'lorem ipsum': 0, 'www.': 3, 'xml': 0}, 'pii_count': 10, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6753004', 'n_tokens_mistral': 884, 'n_tokens_neox': 766, 'n_words': 351}