make it easier to override behaviour of the dns rules

diff --git a/manifests/rules/dns.pp b/manifests/rules/dns.pp
index 99311cae377445dd6b1f2643adf0e0bf4a7d61fd..e775eeedaca20ab0ac908cad80f9ddc7520ba172 100644 (file)
--- a/manifests/rules/dns.pp
+++ b/manifests/rules/dns.pp
@@ -1,18 +1,6 @@
+# open dns port
 class shorewall::rules::dns {
-    shorewall::rule {
-        'net-me-tcp_dns':
-                        source          =>      'net',
-                        destination     =>      '$FW',
-                        proto           =>      'tcp',
-                        destinationport =>      '53',
-                        order           =>      240,
-                        action          =>      'ACCEPT';
-        'net-me-udp_dns':
-                        source          =>      'net',
-                        destination     =>      '$FW',
-                        proto           =>      'udp',
-                        destinationport =>      '53',
-                        order           =>      240,
-                        action          =>      'ACCEPT';
-    }
+  shorewall::rules::dns_rules{
+    'net':
+  }
 }

diff --git a/manifests/rules/dns/disable.pp b/manifests/rules/dns/disable.pp
index 36541da416d8391b11cbfaa24c2d7a05d52c872d..7de923bd6523da5d9d9e93abc52854f83ef44034 100644 (file)
--- a/manifests/rules/dns/disable.pp
+++ b/manifests/rules/dns/disable.pp
@@ -1,5 +1,6 @@
+# disable dns acccess
 class shorewall::rules::dns::disable inherits shorewall::rules::dns {
-  Shorewall::Rule['net-me-tcp_dns', 'net-me-udp_dns']{
-        action  => 'DROP',
-    }
+  Shorewall::Rules::Dns_rules['net']{
+    action  => 'DROP',
+  }
 }

diff --git a/manifests/rules/dns_rules.pp b/manifests/rules/dns_rules.pp
new file mode 100644 (file)
index 0000000..abe0eb5
--- /dev/null
+++ b/manifests/rules/dns_rules.pp
@@ -0,0 +1,22 @@
+# open dns port
+define shorewall::rules::dns_rules(
+  $source = $name,
+  $action = 'ACCEPT',
+) {
+  shorewall::rule {
+    "${source}-me-tcp_dns":
+      source          => $source,
+      destination     => '$FW',
+      proto           => 'tcp',
+      destinationport => '53',
+      order           => 240,
+      action          => $action;
+    "${source}-me-udp_dns":
+      source          => $source,
+      destination     => '$FW',
+      proto           => 'udp',
+      destinationport => '53',
+      order           => 240,
+      action          => $action;
+  }
+}