jenkinsci/puppet-jenkins — pull request #66 by totally (2013-11-26 21:15:23+00:00)
Title: Glaring security concerns for default: configure_firewall => true

A base install of Jenkins has no security, and the default option for this module is to actually open the firewall to the internet giving the world access to Jenkins. The default behavior should not be one that effectively exposes a shell into the users system. This is a huge security risk!

This variable's default is not mentioned in the front page readme, and I'm sure people are unknowingly exposing their systems to danger.

If someone is using a already firewall (ie. they have a need to restrict access for whatever reason), they almost certainly do not want to open access directly to Jenkins.