1 files changed, 5 insertions, 1 deletions
diff --git a/manifests/chain.pp b/manifests/chain.pp
index 10cc9c1..1be7e83 100644
--- a/manifests/chain.pp
+++ b/manifests/chain.pp
@@ -73,6 +73,10 @@ define ferm::chain (
   }
 
   # make sure the generated snippet is actually included
+  # the ordering here is hacked. We might end up with multiple blocks for the same filter+chain.
+  # This happens if we add ipset matches. We suffix this ordering with `bbb`. This allows us to
+  # insert ipset matches before other rules by adding `-aaa` or
+  # insert them at the end by ordering them with `-ccc`.
   concat::fragment{"${table}-${chain}-config-include":
     target  => $ferm::configfile,
     content => epp(
@@ -83,7 +87,7 @@ define ferm::chain (
         'filename' => $filename,
       }
     ),
-    order   => "${table}-${chain}",
+    order   => "${table}-${chain}-bbb",
     require => Concat[$filename],
   }
 }