I’m experiencing a problem where it keeps trying to apply rules before installing iptables. I’ve read the README and come up with the following code in my site.pp:

###########
# Firewall
###########
resources { 'firewall':
  purge => false,
}

Firewall {
  before  => Class['my_fw::post'],
  require => Class['my_fw::pre'],
}

class { 'firewall': }

class {['my_fw::pre', 'my_fw::post']: }

lookup('classes', Array[String], 'unique').include

# This class is called before the firewall is configured.
class my_fw::pre {
  Firewall {
    require => undef,
  }

  exec { 'reload_xt_recent':
    command     => '/sbin/iptables -F && /sbin/rmmod xt_recent && /sbin/modprobe xt_recent',
    refreshonly => true,
  }

  file { '/etc/modprobe.d/options.conf':
    ensure => file,
  }
  -> file_line { 'set_max_ip_pkt_list_tot':
    line   => 'options xt_recent ip_pkt_list_tot=255',
    path   => '/etc/modprobe.d/options.conf',
    notify => Exec['reload_xt_recent'],
  }
  -> firewallchain { 'INPUT:filter:IPv4':
    ensure => present,
    purge  => true,
    ignore => [
      'f2b-',
    ],
  }
  -> firewallchain { 'OUTPUT:filter:IPv4':
    ensure => present,
    purge  => true,
  }
  -> firewallchain { 'FORWARD:filter:IPv4':
    ensure => present,
    purge  => true,
    ignore => [
      'docker',
      'DOCKER',
      'br-',
    ],
  }
  -> firewall { '008 accept all icmp':
    proto => 'icmp',
    jump  => 'accept',
  }
  -> firewall { '001 accept all to lo interface':
    proto   => 'all',
    iniface => 'lo',
    jump    => 'accept',
  }
  -> firewall { '005 accept related established rules':
    proto => 'all',
    state => ['RELATED', 'ESTABLISHED'],
    jump  => 'accept',
  }

  require profiles::firewall::logchain

  firewall { '001 Drop mss lower than 500':
    proto => 'tcp',
    mss   => '1:500',
    jump  => 'LOGDROP',
  }

  firewall { '000 accept all icmp ipv6':
    proto    => 'ipv6-icmp',
    jump     => 'accept',
    protocol => 'ip6tables',
  }
  -> firewall { '001 accept all to lo interface ipv6':
    proto    => 'all',
    iniface  => 'lo',
    jump     => 'accept',
    protocol => 'ip6tables',
  }
  -> firewall { '002 accept related established rules ipv6':
    proto    => 'all',
    state    => ['RELATED', 'ESTABLISHED'],
    jump     => 'accept',
    protocol => 'ip6tables',
  }

  $office_ips = lookup('office_ips', Hash, 'hash', {})

  create_resources( helpers::firewall::allow_ssh, $office_ips )
}

# This class is called after the firewall is configured.
class my_fw::post {
  firewall { '999 drop all':
    proto  => 'all',
    jump   => 'drop',
    before => undef,
  }
  firewall { '999 drop all ipv6':
    proto    => 'all',
    jump     => 'drop',
    protocol => 'ip6tables',
    before   => undef,
  }
}

###########
# EOFirewall
###########