puppetlabs/puppetlabs-firewall — pull request #224 by carlossg (2013-07-18 19:04:50+00:00)
Title: Rules are purged before all of the new ones are created

I'm having an issue where some wget requests (using wget:fetch definition from maestrodev/wget module) are happening between firewall rules.

Some default rules that are in the CentOS box are deleted, then wget tries to download a file and fails to do dns resolution, then the rest of the firewall rules are applied later on.

Added a system spec to show the problem and expected behavior

This is the sequence of events in this spec. I would expect to have all firewall rules added before old ones are removed to avoid losing connection to the box or some other network issue

Notice: /Firewall[9002 cf9e8bfd0c6419a489cce21f32abed1e]/ensure: removed
Notice: /Firewall[000 accept all icmp]/ensure: created
Notice: /Firewall[9001 cf9e8bfd0c6419a489cce21f32abed1e]/ensure: removed
Notice: /Firewall[001 accept all to lo interface]/ensure: created
Notice: /Firewall[002 accept related established rules]/ensure: created
Notice: /Firewall[500 open up port 22]/ensure: created
Notice: /Firewall[999 drop all]/ensure: created
Notice: Finished catalog run in 0.80 seconds

I tried to work around by adding some 'before' requirements to firewall. I didn't know how to make all wget::fetch definitions depend on all the firewall definitions, so I tried to make firewall run before Package['wget'] as all wget:fetch definitions require that.

```
Firewall {
before => [Class['maestro_nodes::firewall::post'], Package['wget']],
require => Class['maestro_nodes::firewall::pre'],
}
```

```
class maestro_nodes::firewall::post {
firewall { "999 drop all other requests to ${ipaddress}":
proto => 'all',
action => 'drop',
destination => [$ipaddress],
before => Package['wget'], # <---------
}
}
```

```
resources { 'firewall':
purge => true,
before => Package['wget'],
}
```

But it didn't work