feat(chain) add variable to specify chain

manifests/agent.pp

@@ -3,6 +3,8 @@
 # @param zabbix_package_state The state of the package that needs to be installed: present or latest.
 # @param zabbix_package_agent The name of the agent package that we manage
 # @param manage_firewall When true, it will create iptables rules.
+# @param use_firewall_chain When true, it will create iptables rules in a chain.
+# @param firewall_priority Set the number to use for the firewall rule.
 # @param manage_repo When true, it will create repository for installing the agent.
 # @param manage_choco
 #   When true on windows, it will use chocolatey to install the agent.
@@ -144,6 +146,8 @@
   Optional[Stdlib::Windowspath] $zabbix_package_source = undef,
   Boolean $manage_choco                                = $zabbix::params::manage_choco,
   Boolean $manage_firewall                             = $zabbix::params::manage_firewall,
+  Boolean $use_firewall_chain                          = $zabbix::params::use_firewall_chain,
+  Integer $firewall_priority                           = $zabbix::params::firewall_priority,
   Boolean $manage_repo                                 = $zabbix::params::manage_repo,
   Boolean $manage_resources                            = $zabbix::params::manage_resources,
   $monitored_by_proxy                                  = $zabbix::params::monitored_by_proxy,
@@ -386,13 +390,28 @@
 
   # Manage firewall
   if $manage_firewall {
+    if $use_firewall_chain {
+      firewallchain { 'ZABBIX_AGENT:filter:IPv4':
+        ensure => present,
+        purge => true,
+      }
+      firewall { "${firewall_priority} zabbix-agent":
+        chain => 'INPUT',
+        jump  => 'ZABBIX_AGENT',
+      }
+    }
+    $chain = $use_firewall_chain ? {
+      true                    => 'ZABBIX_AGENT',
+      default                 => 'INPUT'
+    }
     $servers = split($server, ',')
     $servers.each |$_server| {
-      firewall { "150 zabbix-agent from ${_server}":
+      firewall { "${firewall_priority} zabbix-agent from ${_server}":
         dport  => $listenport,
         proto  => 'tcp',
-        action => 'accept',
+        jump => 'accept',
         source => $_server,
+        chain => $chain,
         state  => [
           'NEW',
           'RELATED',

manifests/javagateway.pp

@@ -68,7 +68,7 @@
     firewall { '152 zabbix-javagateway':
       dport  => $listenport,
       proto  => 'tcp',
-      action => 'accept',
+      jump => 'accept',
       state  => ['NEW','RELATED', 'ESTABLISHED'],
     }
   }

manifests/params.pp

@@ -150,6 +150,8 @@
   $manage_service                           = true
   $default_vhost                            = false
   $manage_firewall                          = false
+  $use_firewall_chain                       = false
+  $firewall_priority                        = 150
   $manage_apt                               = true
   $repo_location                            = undef
   $unsupported_repo_location                = undef

manifests/proxy.pp

@@ -521,7 +521,7 @@
     firewall { '151 zabbix-proxy':
       dport  => $listenport,
       proto  => 'tcp',
-      action => 'accept',
+      jump => 'accept',
       state  => [
         'NEW',
         'RELATED',

manifests/server.pp

@@ -462,7 +462,7 @@
     firewall { '151 zabbix-server':
       dport  => $listenport,
       proto  => 'tcp',
-      action => 'accept',
+      jump => 'accept',
       state  => [
         'NEW',
         'RELATED',