class pantin::iptables(
	String $ruleset = undef,
	Array[Integer] $tcp_ports = [],
	Array[Integer] $udp_ports = [],
) {
	$ipv4 = $facts['networking']['ip']
	$ipv6 = $facts['networking']['ip6']
	package { 'iptables-persistent':
		ensure => present,
	} ->
	file { '/etc/iptables/rules.v4':
		mode => '0644',
		content => template("pantin/etc/iptables/${ruleset}.v4.erb"),
	} ->
	file { '/etc/iptables/rules.v6':
		mode => '0644',
		content => template("pantin/etc/iptables/${ruleset}.v6.erb"),
	} ->
	service { 'netfilter-persistent':
		ensure => running,
		enable => true,
		stop => 'rc-service netfilter-persistent flush',
		# The checksum below is when the ruleset is empty, with all
		# policies set to ACCEPT.
		status => '[ "`(iptables-save && ip6tables-save) 2>&1 | grep -v ^# | cksum`" != "703614838 364" ]',
		subscribe => File[
			'/etc/iptables/rules.v4',
			'/etc/iptables/rules.v6',
		],
	}
}
