title: IPtables management with SaltStack
body: <p>I'm trying to configure a flexible iptables management solution with SaltStack, but I find it harder than I thought it would be.</p>
  
  <p>My main requirement: to be able to have a pillar where I keep a list of IPs, which should be whitelisted for SSH access on all minions. This list of IPs will of course change every now and then: some IPs get added, some IPs are removed. The problem that I'm facing is with the removed IPs - when I remove them from the pillar file, SaltStack doesn't remove the actual whitelisting from the minions.</p>
  
  <p>The only workaround I could find, was to create a new key named "removed-ips" and whenever I want to remove an IP, I would add it there. The second for loop will then remove it. Of course, this is a really nasty workaround, is there a better way of doing it?</p>
  
  <p>/srv/pillar/iptables-default.sls:</p>
  
  <pre><code>iptables-default:
    whitelisted-ips:
      - '55.55.55.55'
      - '66.66.66.66'
      - '77.77.77.77'
    removed-ips:
      - '88.88.88.88'
  </code></pre>
  
  <p>/srv/salt/iptables-default.sls:</p>
  
  <pre><code>{% for ip in salt['pillar.get']('iptables-default:whitelisted-ips') %}
  Whitelist OSF IP {{ip}} for SSH access:
    iptables.append:
      - table: filter
      - family: ipv4
      - chain: INPUT
      - jump: ACCEPT
      - match: state
      - connstate: NEW
      - source: '{{ ip }}'
      - dport: 22
      - proto: tcp
      - save: True
  {% endfor %}
  
  {% for ip in salt['pillar.get']('iptables-default:removed-ips') %}
  Remove old IPs that are not needed anymore:
    iptables.delete:
      - table: filter
      - family: ipv4
      - chain: INPUT
      - jump: ACCEPT
      - match: state
      - connstate: NEW
      - source: {{ ip }}
      - dport: 22
      - proto: tcp
      - save: True
  {% endfor %}
  </code></pre>