puppetlabs/puppetlabs-firewall — pull request #371 by mengesb (2014-06-05 19:44:01+00:00)
Title: Adding support for notrack option

Seems that 'notrack' was not a supported jump target. I've added this, and also modified a few tests to hopefully support good tests for notrack.

Purpose:
NOTRACK is used when you have high volume traffic systems where conntrack would tip the system over. These are usually, but not limited to, DNS systems. Per PowerDNS configuration guidelines (http://doc.powerdns.com/html/recursor-performance.html) you will benefit greatly from setting the following options:

```
# iptables -t raw -I OUTPUT -p udp --dport 53 -j NOTRACK
# iptables -t raw -I OUTPUT -p udp --sport 53 -j NOTRACK
# iptables -t raw -I PREROUTING -p udp --dport 53 -j NOTRACK
# iptables -t raw -I PREROUTING -p udp --sport 53 -j NOTRACK
# iptables -I INPUT -p udp --dport 53 -j ACCEPT
# iptables -I INPUT -p udp --sport 53 -j ACCEPT
# iptables -I OUTPUT -p udp --dport 53 -j ACCEPT

# # optionally
# ip6tables -t raw -I OUTPUT -p udp --dport 53 -j NOTRACK
# ip6tables -t raw -I OUTPUT -p udp --sport 53 -j NOTRACK
# ip6tables -t raw -I PREROUTING -p udp --sport 53 -j NOTRACK
# ip6tables -t raw -I PREROUTING -p udp --dport 53 -j NOTRACK
# ip6tables -I INPUT -p udp --dport 53 -j ACCEPT
# ip6tables -I INPUT -p udp --sport 53 -j ACCEPT
# ip6tables -I OUTPUT -p udp --dport 53 -j ACCEPT
```