Firewall setup for coldfusion9 cookbook

firewall.rb

#
# Cookbook Name:: coldfusion9
# Recipe:: firewall
#
# Copyright 2011, Nathan Mische
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

package "iptables-persistent" do
  action :install
end

# Customize the firewall rules config
template "/etc/iptables/rules" do
  source "rules.erb"
  mode "0644"
  owner "root"
  group "root"
end

service "iptables-persistent" do
	action :restart
end

rules.erb

# Generated by coldfusion9::firewall
*nat
:PREROUTING ACCEPT [25:4925]
:POSTROUTING ACCEPT [14:1528]
:OUTPUT ACCEPT [14:1528]
-A PREROUTING -d <%= node['cf9']['firewall']['dest'] %>/32 -p tcp -m tcp --dport <%= node['cf9']['firewall']['ssl_port'] %> -j REDIRECT --to-ports 9100 
-A PREROUTING -d <%= node['cf9']['firewall']['dest'] %>/32 -p tcp -m tcp --dport <%= node['cf9']['firewall']['http_port'] %> -j REDIRECT --to-ports 8500 
COMMIT

Vagrantfile

  config.vm.provision :chef_solo do |chef|
    chef.cookbooks_path = "chef/cookbooks"
    chef.roles_path = "chef/roles"
    chef.add_role "cfserver"
  
    chef.json = {
      "nfs" => {
        "exports" => [
          "/opt/coldfusion9    *(rw,insecure,all_squash,anonuid=65534,anongid=2)"
        ]
      },
      "cf9" => {
        "trustedcerts" => {
          "whartoncaroot" => "whartonca_root.cer"
        },
        "firewall" => {
          "dest" => "33.33.33.33",
          "http_port" => "80",
          "ssl_port" => "443"
        }
      },
      "mysql" => {
        "server_debian_password" => "vagrant",
        "server_root_password" => "vagrant",
        "server_repl_password" => "vagrant",
        "bind_address" => "0.0.0.0",
        "allow_remote_root" => true
      }
   }
  
  end