Allow setting iptables chain policy
diff --git a/README.rst b/README.rst
index 1a2d8e1..19e037c 100644
--- a/README.rst
+++ b/README.rst
@@ -18,6 +18,7 @@
chain:
INPUT:
enabled: true
+ policy: DROP
rule:
httpd:
position: 1
diff --git a/iptables/service.sls b/iptables/service.sls
index f126bd2..ebccf0a 100644
--- a/iptables/service.sls
+++ b/iptables/service.sls
@@ -15,7 +15,14 @@
- pkg: iptables_packages
{%- for chain_name, chain in service.get('chain', {}).iteritems() %}
-
+
+{%- if chain.policy is defined %}
+iptables_{{ chain_name }}_policy:
+ iptables.set_policy:
+ - chain: {{ chain_name }}
+ - policy: {{ chain.policy }}
+{%- endif %}
+
{%- for rule_name, rule in chain.get('rule', {}).iteritems() %}
iptables_{{ chain_name }}_{{ rule_name }}: