Cannot use parameter -i for OUTPUT

[chaim1221]

Cookbook version: 2.7.0

Chef-client version: 14.7.17

Platform Details: Mac OS X (dom0); CentOS 7 (guest)

Scenario: Allow outbound loopback.

Steps to Reproduce:

firewall_rule 'local loopback' do
   interface 'lo'
   protocol :none
   command :allow
   direction :out
end

Expected Result:

-A OUTPUT -o lo -j ACCEPT

Actual Result:

Cannot use parameter -i with OUTPUT

What should happen is that for an outbound rule, with iptables, the interface is specified with -o.

[chaim1221]

Workaround:

firewall_rule 'local loopback' do
  raw '-A OUTPUT -o lo -j ACCEPT'
  position 51
#   interface 'lo'
#   protocol :none
#   command :allow
#   direction :out
end

[martinb3]

Hi there -- here's what the cookbook is doing:

firewall_rule << "-i #{rule_resource.interface} " if rule_resource.interface
firewall_rule << "-o #{rule_resource.dest_interface} " if rule_resource.dest_interface

If you change interface 'lo' to dest_interface 'lo', it should work. We put those in different resource attributes, since they use different arguments.