From 46898aa67967db316f8fc37a2f09edf9e390433d Mon Sep 17 00:00:00 2001
From: 12ww1160 <12ww1160@confdroid.com>
Date: Thu, 9 Apr 2026 14:12:26 +0200
Subject: [PATCH] OP#561 fix fw setting

---
 manifests/firewall/iptables.pp | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/manifests/firewall/iptables.pp b/manifests/firewall/iptables.pp
index a43728e..400b418 100644
--- a/manifests/firewall/iptables.pp
+++ b/manifests/firewall/iptables.pp
@@ -6,7 +6,7 @@
 class confdroid_ssh::firewall::iptables (
 
 ) inherits confdroid_ssh::params {
-  if $ssh_use_firewall {
+  if $ssh_use_firewall == true {
     firewall { "${ssh_fw_order}${ssh_fw_port} allow SSH on port ${ssh_fw_port}":
       ensure => 'present',
       proto  => 'tcp',
@@ -14,5 +14,14 @@ class confdroid_ssh::firewall::iptables (
       dport  => $ssh_fw_port,
       jump   => 'accept',
     }
+  else {
+    firewall { "${ssh_fw_order}${ssh_fw_port} remove SSH on port ${ssh_fw_port}":
+      ensure => 'absent',
+      proto  => 'tcp',
+      source => $ssh_source_range,
+      dport  => $ssh_fw_port,
+      jump   => 'accept',
+      }
+    }
   }
 }