--- /dev/null
+# Firewall configuration for a TPC
+# Inspired by http://ferm.foo-projects.org/download/examples/workstation.ferm
+# File managed by puppet
+
+table filter {
+ chain INPUT {
+ policy DROP;
+
+ # connection tracking
+ #mod state state INVALID DROP;
+ #mod state state (ESTABLISHED RELATED) ACCEPT;
+
+ # allow local connections
+ interface lo ACCEPT;
+
+ # respond to ping
+ #proto icmp icmp-type echo-request ACCEPT;
+
+ # allow SSH connections
+ #proto tcp dport ssh ACCEPT;
+
+ # ident connections are also allowed
+ #proto tcp dport auth ACCEPT;
+
+ # the rest is dropped by the above policy
+ }
+
+ # outgoing connections are not limited
+ chain OUTPUT policy ACCEPT;
+
+ # this is not a router
+ chain FORWARD policy DROP;
+}
-# See http://serverfault.com/questions/579726/docker-shorewall
-class firewall::docker($device = 'eth0') {
- class { 'firewall::forwarding': }
-
- shorewall::masq { "${device}-dock":
- interface => "${device}",
- source => '172.17.0.0/16',
- order => '10',
- }
-
- shorewall::zone { 'dock':
- type => 'ipv4',
- order => '10',
- }
-
- shorewall::policy { 'dock-all':
- sourcezone => 'dock',
- destinationzone => 'all',
- policy => 'ACCEPT',
- order => 10,
- }
-
- shorewall::interface { 'docker0':
- zone => 'dock',
- rfc1918 => false,
- options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+class firewall::docker(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $device = 'eth0',
+) {
+ class { "firewall::implementations::${implementation}::docker":
+ device => $device,
}
}
+++ /dev/null
-class firewall::ferm() {
- include ferm
-}
-class firewall::forwarding {
- augeas { 'ip_forwarding':
- changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING On',
- lens => 'Shellvars.lns',
- incl => '/etc/shorewall/shorewall.conf',
- notify => Service[shorewall];
- }
+class firewall::forwarding(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::forwarding": }
}
--- /dev/null
+class firewall::implementations::ferm() {
+ # Currently conflicting with the stdlib and concat module's versions in use
+ #include ferm
+
+ package { 'ferm':
+ ensure => installed,
+ }
+
+ service { 'ferm':
+ ensure => running,
+ enable => true,
+ require => Package['ferm'],
+ }
+}
--- /dev/null
+# Basic configuration inspired by
+# http://ferm.foo-projects.org/download/examples/workstation.ferm
+class firewall::implementations::ferm::tpc {
+ # Currently conflicting with the stdlib and concat module's versions in use
+ #ferm::rule{ "allow-local-tcp":
+ # chain => 'INPUT',
+ # action => 'ACCEPT',
+ # proto => 'tcp',
+ # interface => 'lo',
+ # ensure => 'present',
+ #}
+
+ # Currently conflicting with the stdlib and concat module's versions in use
+ #ferm::rule{ "allow-local-udp":
+ # chain => 'INPUT',
+ # action => 'ACCEPT',
+ # proto => 'udp',
+ # interface => 'lo',
+ # ensure => 'present',
+ #}
+
+ file { '/etc/ferm/ferm.conf':
+ ensure => present,
+ owner => root,
+ group => adm,
+ mode => '0644',
+ require => Package['ferm'],
+ notify => Service['ferm'],
+ source => [
+ "puppet:///modules/firewall/ferm/ferm.conf.tpc",
+ "puppet:///modules/firewall/ferm/ferm.conf.${::hostname}",
+ "puppet:///modules/site_firewall/ferm/ferm.conf.tpc",
+ "puppet:///modules/site_firewall/ferm/ferm.conf.${::hostname}",
+ ],
+ }
+}
--- /dev/null
+class firewall::implementations::ferm::wifi(
+ $shorewall_local_net = false,
+ $wifi_device = '',
+) {
+}
-class firewall::shorewall(
+class firewall::implementations::shorewall(
$device = lookup('firewall::device', undef, undef, 'eth0'),
$zone = lookup('firewall::zone', undef, undef, '-'),
$local_net = lookup('firewall::local_net', undef, undef, false),
--- /dev/null
+# See http://serverfault.com/questions/579726/docker-shorewall
+class firewall::implementations::shorewall::docker($device = 'eth0') {
+ class { 'firewall::forwarding': }
+
+ shorewall::masq { "${device}-dock":
+ interface => "${device}",
+ source => '172.17.0.0/16',
+ order => '10',
+ }
+
+ shorewall::zone { 'dock':
+ type => 'ipv4',
+ order => '10',
+ }
+
+ shorewall::policy { 'dock-all':
+ sourcezone => 'dock',
+ destinationzone => 'all',
+ policy => 'ACCEPT',
+ order => 10,
+ }
+
+ shorewall::interface { 'docker0':
+ zone => 'dock',
+ rfc1918 => false,
+ options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::forwarding {
+ augeas { 'ip_forwarding':
+ changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING On',
+ lens => 'Shellvars.lns',
+ incl => '/etc/shorewall/shorewall.conf',
+ notify => Service[shorewall];
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::local(
+ $network = lookup('firewall::local::network', undef, undef, '192.168.1.0/24'),
+ $interface = lookup('firewall::local::interface', undef, undef, 'eth0'),
+ $manage_host = lookup('firewall::local::manage_host', undef, undef, true),
+ $manage_interface = lookup('firewall::local::manage_iface', undef, undef, false)
+) {
+
+ if $manage_host {
+ shorewall::host { "$interface-loc":
+ name => "$interface:$network",
+ zone => 'loc',
+ options => '',
+ order => 3,
+ }
+ }
+
+ if $manage_interface {
+ shorewall::interface { "$interface":
+ zone => 'loc',
+ rfc1918 => true,
+ dhcp => true,
+ options => 'routeback',
+ }
+ }
+
+ shorewall::policy { 'loc-all':
+ sourcezone => 'loc',
+ destinationzone => 'all',
+ policy => 'ACCEPT',
+ order => 5,
+ }
+
+ shorewall::policy { 'vm-loc':
+ sourcezone => 'vm',
+ destinationzone => 'loc',
+ policy => 'ACCEPT',
+ order => 6,
+ }
+
+ shorewall::policy { 'fw-loc':
+ sourcezone => '$FW',
+ destinationzone => 'loc',
+ policy => 'ACCEPT',
+ order => 7,
+ }
+
+}
--- /dev/null
+class firewall::implementations::shorewall::mpd {
+ # MPD http stream
+ shorewall::rule { 'mpd-http-stream':
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '8000',
+ order => 200,
+ action => 'ACCEPT';
+ }
+
+ # MPD client access
+ shorewall::rule { 'mpd-daemon':
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '6600',
+ order => 200,
+ action => 'ACCEPT';
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::nas(
+ $ftp = false,
+ $tftp = false,
+ $http = false,
+ $nfsd = false,
+ $rsync = false,
+ $printer = false,
+ $torrent = false,
+ $mpd = false,
+ $samba = false,
+ $dlna = false,
+ $daap = false,
+ $avahi = false
+) {
+
+ if $ftp == true {
+ include shorewall::rules::ftp
+ }
+
+ if $tftp == true {
+ include shorewall::rules::tftp
+ }
+
+ if $http == true {
+ include shorewall::rules::http
+ }
+
+ if $nfsd == true {
+ include shorewall::rules::nfsd
+
+ # Additional ports needed by NFS
+ # Got using rpcinfo -p and netstat -ap
+ shorewall::rule { 'nfs-1':
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '35150,43902,46661,46661,46661,50340,54814,57170,58403,59780',
+ ratelimit => '-',
+ order => 100,
+ }
+
+ shorewall::rule { 'nfs-2':
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '938,38511,43195,53081,53081,53081,38521,45238,52664,52400,60331',
+ ratelimit => '-',
+ order => 100,
+ }
+ }
+
+ if $rsync == true {
+ include shorewall::rules::rsync
+ }
+
+ if $printer == true {
+ include firewall::shorewall::printer
+ }
+
+ if $torrent == true {
+ include firewall::shorewall::torrent
+ }
+
+ if $mpd == true {
+ include firewall::shorewall::mpd
+ }
+
+ if $samba == true {
+ # See http://www.shorewall.net/samba.htm
+ shorewall::rule { 'samba':
+ action => 'SMB/ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => '-',
+ destinationport => '-',
+ ratelimit => '-',
+ order => 100,
+ }
+
+ shorewall::rule { 'netbios-1':
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '137,138,139',
+ ratelimit => '-',
+ order => 100,
+ }
+
+ shorewall::rule { 'netbios-2':
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '137,138,139',
+ ratelimit => '-',
+ order => 100,
+ }
+ }
+
+ if $dlna == true {
+ # DLNA
+ #
+ # https://wiki.archlinux.org/index.php/MiniDLNA
+ # http://netpatia.blogspot.co.uk/2011/03/setup-your-own-dlna-server.html
+ # http://wiki.alpinelinux.org/wiki/IPTV_How_To
+ # http://mediatomb.cc/dokuwiki/faq:faq
+ # http://packages.debian.org/wheezy/djmount
+ # http://packages.debian.org/wheezy/gupnp-tools
+ #
+ # Optional:
+ #
+ # http://www.shorewall.net/UPnP.html
+ #
+ # linux-igd package
+ # /etc/default/linux-igd
+ # /etc/upnpd.conf
+
+ shorewall::rule { "dlna-1":
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp,udp',
+ destinationport => "1900",
+ ratelimit => '-',
+ order => 102,
+ }
+
+ shorewall::rule { "dlna-2":
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp,udp',
+ destinationport => "8200",
+ ratelimit => '-',
+ order => 103,
+ }
+
+ shorewall::rule { "dlna-3":
+ action => 'allowinUPnP',
+ source => 'net',
+ destination => '$FW',
+ order => 104,
+ }
+
+ shorewall::rule { "dlna-4":
+ action => 'forwardUPnP',
+ source => 'net',
+ destination => '$FW',
+ order => 105,
+ }
+
+ # Enable multicast
+ augeas { 'enable_multicast':
+ changes => 'set /files/etc/shorewall/shorewall.conf/MULTICAST Yes',
+ lens => 'Shellvars.lns',
+ incl => '/etc/shorewall/shorewall.conf',
+ notify => Service[shorewall];
+ }
+ }
+
+ if $daap == true {
+ # DAAP
+ shorewall::rule { 'daap-1':
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '3689',
+ order => 300,
+ action => 'ACCEPT';
+ }
+
+ shorewall::rule { 'daap-2':
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '3689',
+ order => 301,
+ action => 'ACCEPT';
+ }
+ }
+
+ if $avahi == true {
+ # Avahi/mDNS
+ shorewall::rule { 'mdns':
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '5353',
+ order => 400,
+ action => 'ACCEPT';
+ }
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::openvpn {
+ shorewall::zone { 'vpn':
+ type => 'ipv4',
+ order => 4,
+ }
+
+ shorewall::interface { 'tun0':
+ zone => 'vpn',
+ }
+
+ shorewall::policy { 'loc-vpn':
+ sourcezone => 'loc',
+ destinationzone => 'vpn',
+ policy => 'ACCEPT',
+ order => 20,
+ }
+
+ shorewall::policy { 'vpn-loc':
+ sourcezone => 'vpn',
+ destinationzone => 'loc',
+ policy => 'ACCEPT',
+ order => 21,
+ }
+
+ shorewall::policy { 'fw-vpn':
+ sourcezone => '$FW',
+ destinationzone => 'vpn',
+ policy => 'ACCEPT',
+ order => 22,
+ }
+
+ shorewall::tunnel { 'openvpn':
+ tunnel_type => 'openvpnclient',
+ zone => 'net',
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::ppp(
+ $interface = 'ppp0',
+ $zone = 'ppp'
+) {
+ shorewall::interface { $interface:
+ zone => $zone,
+ }
+
+ if $zone == 'ppp' {
+ shorewall::zone { 'ppp':
+ type => 'ipv4',
+ order => 4,
+ }
+
+ shorewall::policy { 'loc-ppp':
+ sourcezone => 'loc',
+ destinationzone => $zone,
+ policy => 'ACCEPT',
+ order => 30,
+ }
+
+ shorewall::policy { 'ppp-loc':
+ sourcezone => 'ppp',
+ destinationzone => $zone,
+ policy => 'ACCEPT',
+ order => 31,
+ }
+
+ shorewall::policy { 'fw-ppp':
+ sourcezone => '$FW',
+ destinationzone => $zone,
+ policy => 'ACCEPT',
+ order => 32,
+ }
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::pppoe(
+ $packages = false,
+ $local_dev = false,
+) {
+ # Manage pppoe packages, requires nodo module
+ if $packages == true {
+ include nodo::utils::network::pppoe
+ }
+
+ # Define device in the local zone
+ if $local_dev == true{
+ shorewall::interface { "eth0":
+ zone => 'loc',
+ rfc1918 => false,
+ options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+ }
+ }
+
+ # See http://shorewall.net/two-interface.htm
+ augeas { 'clampmss':
+ changes => 'set /files/etc/shorewall/shorewall.conf/CLAMPMSS Yes',
+ lens => 'Shellvars.lns',
+ incl => '/etc/shorewall/shorewall.conf',
+ notify => Service[shorewall];
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::printer {
+ shorewall::rule { "cups-tcp":
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => "631",
+ ratelimit => '-',
+ order => 200,
+ }
+
+ shorewall::rule { "cups-udp":
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => "631",
+ ratelimit => '-',
+ order => 201,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::redirect::ssh($destinationport) {
+ # When the box is in an internal network and we want to provide
+ # and external access through a shared real IP, we have to
+ # redirect requests coming from another port to port 22.
+ $ip = lookup('firewall::external_ip', undef, undef, $::ipaddress)
+
+ shorewall::rule { "ssh-redirect-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => "fw:$ip:22",
+ proto => 'tcp',
+ destinationport => $destinationport,
+ ratelimit => '-',
+ order => $destinationport,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::gitd($destination, $zone = 'loc', $originaldest = $ipaddress) {
+ shorewall::rule { 'git-daemon-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9418",
+ proto => 'tcp',
+ destinationport => '9418',
+ ratelimit => '-',
+ order => 800,
+ }
+
+ shorewall::rule { 'git-daemon-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:9418",
+ proto => 'tcp',
+ destinationport => '9418',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 801,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::gobby($destination, $zone = 'loc', $originaldest = $ipaddress) {
+ shorewall::rule { 'gobby-route-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:6523",
+ proto => 'tcp',
+ destinationport => '6523',
+ ratelimit => '-',
+ order => 600,
+ }
+
+ shorewall::rule { 'gobby-route-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:6523",
+ proto => 'tcp',
+ destinationport => '6523',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 601,
+ }
+}
--- /dev/null
+# See http://www.shorewall.net/FAQ.htm#faq2
+define firewall::router::hairpinning($order = '5000', $proto = 'tcp', $port = 'www',
+ $external_ip = '$ETH0_IP', $interface = 'eth1',
+ $destination = '192.168.1.100', $source = 'eth1',
+ $source_zone = 'loc', $dest_zone = 'loc',
+ $port_dest = '') {
+ shorewall::masq { "routeback-$name":
+ interface => "$interface:$destination",
+ source => $source,
+ address => $external_ip,
+ proto => $proto,
+ port => $port,
+ order => $order,
+ }
+
+ shorewall::rule { "routeback-$name":
+ action => 'DNAT',
+ source => $source_zone,
+ destination => $port_dest ? {
+ '' => "$dest_zone:$destination",
+ default => "$dest_zone:$destination:$port_dest",
+ },
+ proto => $proto,
+ destinationport => $port,
+ ratelimit => '-',
+ order => $order,
+ originaldest => $external_ip,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::http($destination, $zone = 'loc', $originaldest = $ipaddress) {
+ shorewall::rule { 'http-route-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:80",
+ proto => 'tcp',
+ destinationport => '80',
+ ratelimit => '-',
+ order => 600,
+ }
+
+ shorewall::rule { 'http-route-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:80",
+ proto => 'tcp',
+ destinationport => '80',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 601,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::https($destination, $zone = 'loc', $originaldest = $ipaddress) {
+ shorewall::rule { 'https-route-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:443",
+ proto => 'tcp',
+ destinationport => '443',
+ ratelimit => '-',
+ order => 602,
+ }
+
+ shorewall::rule { 'https-route-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:443",
+ proto => 'tcp',
+ destinationport => '443',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 602,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::icecast($destination, $zone = 'loc', $originaldest = $ipaddress) {
+ shorewall::rule { 'icecast-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:8000",
+ proto => 'tcp',
+ destinationport => '8000',
+ ratelimit => '-',
+ order => 900,
+ }
+
+ shorewall::rule { 'icecast-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:8000",
+ proto => 'tcp',
+ destinationport => '8000',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 901,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::mail($destination, $zone = 'loc', $originaldest = $ipaddress) {
+ shorewall::rule { 'mail-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:25",
+ proto => 'tcp',
+ destinationport => '25',
+ ratelimit => '-',
+ order => 1000,
+ }
+
+ shorewall::rule { 'mail-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:25",
+ proto => 'tcp',
+ destinationport => '25',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 1001,
+ }
+
+ shorewall::rule { 'mail-3':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:993",
+ proto => 'tcp',
+ destinationport => '993',
+ ratelimit => '-',
+ order => 1002,
+ }
+
+ shorewall::rule { 'mail-4':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:993",
+ proto => 'tcp',
+ destinationport => '993',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 1003,
+ }
+
+ shorewall::rule { 'mail-5':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:587",
+ proto => 'tcp',
+ destinationport => '587',
+ ratelimit => '-',
+ order => 1004,
+ }
+
+ shorewall::rule { 'mail-6':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:587",
+ proto => 'tcp',
+ destinationport => '587',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 1005,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::mumble($destination, $zone = 'loc', $originaldest = $::ipaddress) {
+ shorewall::rule { 'mumble-0':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:64738",
+ proto => 'tcp',
+ destinationport => '64738',
+ ratelimit => '-',
+ order => 2300,
+ }
+
+ shorewall::rule { 'mumble-1':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:64738",
+ proto => 'udp',
+ destinationport => '64738',
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 2301,
+ }
+}
--- /dev/null
+define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc',
+ $order = '400', $originaldest = $ipaddress) {
+ shorewall::rule { "munin-$name-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ ratelimit => '-',
+ order => $order,
+ }
+
+ shorewall::rule { "munin-$name-2":
+ action => 'DNAT',
+ source => '$FW',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => $order,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::rsync($destination, $port_orig = '873', $port_dest = '', $zone = 'loc',
+ $originaldest = $ipaddress) {
+ shorewall::rule { "rsync-$name-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ ratelimit => '-',
+ order => "26$port_orig",
+ }
+
+ shorewall::rule { "rsync-$name-2":
+ action => 'DNAT',
+ source => '$FW',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => "26$port_orig",
+ }
+}
--- /dev/null
+define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc',
+ $originaldest = $ipaddress) {
+ shorewall::rule { "ssh-$name-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ ratelimit => '-',
+ order => "2$port_orig",
+ }
+
+ shorewall::rule { "ssh-$name-2":
+ action => 'DNAT',
+ source => '$FW',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => "2$port_orig",
+ }
+}
--- /dev/null
+define firewall::router::tor($destination, $zone = 'loc', $originaldest = $ipaddress) {
+ shorewall::rule { "tor-$name-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9000",
+ proto => 'tcp',
+ destinationport => "9000",
+ ratelimit => '-',
+ order => "29000",
+ }
+
+ shorewall::rule { "tor-$name-2":
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:9000",
+ proto => 'tcp',
+ destinationport => "9000",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => "29000",
+ }
+
+ shorewall::rule { "tor-$name-3":
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9001",
+ proto => 'tcp',
+ destinationport => "9001",
+ ratelimit => '-',
+ order => "29001",
+ }
+
+ shorewall::rule { "tor-$name-4":
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:9001",
+ proto => 'tcp',
+ destinationport => "9001",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => "29001",
+ }
+
+ shorewall::rule { "tor-$name-5":
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9100",
+ proto => 'tcp',
+ destinationport => "9100",
+ ratelimit => '-',
+ order => "29100",
+ }
+
+ shorewall::rule { "tor-$name-6":
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:9100",
+ proto => 'tcp',
+ destinationport => "9100",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => "29100",
+ }
+
+ shorewall::rule { "tor-$name-7":
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9101",
+ proto => 'tcp',
+ destinationport => "9101",
+ ratelimit => '-',
+ order => "29101",
+ }
+
+ shorewall::rule { "tor-$name-8":
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:9101",
+ proto => 'tcp',
+ destinationport => "9101",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => "29101",
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::router::torrent(
+ $destination,
+ $zone = 'loc',
+ $originaldest = $ipaddress,
+ $range = lookup('firewall::torrent::range', undef, undef, '6881:6999')
+) {
+ shorewall::rule { "torrent-tcp-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination",
+ proto => 'tcp',
+ destinationport => "$range",
+ ratelimit => '-',
+ order => 200,
+ }
+
+ shorewall::rule { "torrent-tcp-2":
+ action => 'DNAT',
+ source => 'all',
+ destination => "$zone:$destination",
+ proto => 'tcp',
+ destinationport => "$range",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 200,
+ }
+
+ shorewall::rule { "torrent-udp-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination",
+ proto => 'udp',
+ destinationport => "$range",
+ ratelimit => '-',
+ order => 201,
+ }
+
+ shorewall::rule { "torrent-udp-2":
+ action => 'DNAT',
+ source => 'all',
+ destination => "$zone:$destination",
+ proto => 'udp',
+ destinationport => "6881:6999",
+ originaldest => "$originaldest",
+ ratelimit => '-',
+ order => 201,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::shaping(
+ $device = lookup('firewall::device', undef, undef, 'eth0'),
+ $in_bandwidth = lookup('firewall::in_bandwidth', undef, undef, '1000mbps'),
+ $out_bandwidth = lookup('firewall::out_bandwidth', undef, undef, '1000mbps')
+) {
+ #
+ # Traffic shaping
+ #
+ shorewall::tcdevices { "${device}":
+ in_bandwidth => "$in_bandwidth",
+ out_bandwidth => "$out_bandwidth",
+ }
+
+ shorewall::tcrules { "ssh-tcp":
+ order => "1",
+ source => "0.0.0.0/0",
+ destination => "0.0.0.0/0",
+ protocol => "tcp",
+ ports => "22",
+ }
+
+ shorewall::tcrules { "ssh-udp":
+ order => "1",
+ source => "0.0.0.0/0",
+ destination => "0.0.0.0/0",
+ protocol => "udp",
+ ports => "22",
+ }
+
+ shorewall::tcclasses { "ssh":
+ order => "1",
+ interface => "${device}",
+ rate => "4*full/100",
+ ceil => "full",
+ priority => "1",
+ }
+
+ shorewall::tcclasses { "default":
+ order => "2",
+ interface => "${device}",
+ rate => "6*full/100",
+ ceil => "full",
+ priority => "2",
+ options => "default",
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::torrent(
+ $range = lookup('firewall::torrent::range', undef, undef, '6881:6999')
+) {
+ shorewall::rule { "torrent-tcp":
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => "$range",
+ ratelimit => '-',
+ order => 200,
+ }
+
+ shorewall::rule { "torrent-udp":
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => "$range",
+ ratelimit => '-',
+ order => 201,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::tpc {
+}
--- /dev/null
+class firewall::implementations::shorewall::ups {
+ shorewall::rule { "ups":
+ action => 'ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => "3551",
+ ratelimit => '-',
+ order => 200,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::dns($destination, $zone = 'vm') {
+ shorewall::rule { 'dns-route-0':
+ action => 'DNS/ACCEPT',
+ source => 'net',
+ destination => '$FW',
+ proto => '-',
+ destinationport => '-',
+ ratelimit => '-',
+ order => 2000,
+ }
+
+ shorewall::rule { 'dns-route-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:53",
+ proto => 'tcp',
+ destinationport => '53',
+ ratelimit => '-',
+ order => 2001,
+ }
+
+ shorewall::rule { 'dns-route-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:53",
+ proto => 'tcp',
+ destinationport => '53',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2002,
+ }
+
+ shorewall::rule { 'dns-route-3':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:53",
+ proto => 'udp',
+ destinationport => '53',
+ ratelimit => '-',
+ order => 2003,
+ }
+
+ shorewall::rule { 'dns-route-4':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:53",
+ proto => 'udp',
+ destinationport => '53',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2004,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::gitd($destination) {
+ shorewall::rule { 'git-daemon-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "vm:$destination:9418",
+ proto => 'tcp',
+ destinationport => '9418',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 800,
+ }
+
+ shorewall::rule { 'git-daemon-2':
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:$destination:9418",
+ proto => 'tcp',
+ destinationport => '9418',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 801,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::gobby($destination) {
+ shorewall::rule { 'gobby-0':
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:$destination:6523",
+ proto => 'tcp',
+ destinationport => '6523',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2400,
+ }
+
+ shorewall::rule { 'gobby-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "vm:$destination:6523",
+ proto => 'tcp',
+ destinationport => '6523',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2400,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::http($destination) {
+ shorewall::rule { 'http-route-1':
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:$destination:80",
+ proto => 'tcp',
+ destinationport => '80',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 600,
+ }
+
+ shorewall::rule { 'http-route-2':
+ action => 'DNAT',
+ source => 'net',
+ destination => "vm:$destination:80",
+ proto => 'tcp',
+ destinationport => '80',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 601,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::https($destination) {
+ shorewall::rule { 'https-route-1':
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:$destination:443",
+ proto => 'tcp',
+ destinationport => '443',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
+ order => 602,
+ }
+
+ shorewall::rule { 'https-route-2':
+ action => 'DNAT',
+ source => 'net',
+ destination => "vm:$destination:443",
+ proto => 'tcp',
+ destinationport => '443',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
+ order => 602,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::icecast($destination, $zone = 'fw') {
+ shorewall::rule { 'icecast-1':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:8000",
+ proto => 'tcp',
+ destinationport => '8000',
+ ratelimit => '-',
+ order => 900,
+ }
+
+ shorewall::rule { 'icecast-2':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:8000",
+ proto => 'tcp',
+ destinationport => '8000',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 901,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::jabber($destination, $zone = 'fw') {
+ shorewall::rule { 'jabber-0':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:5222",
+ proto => 'tcp',
+ destinationport => '5222',
+ ratelimit => '-',
+ order => 2200,
+ }
+
+ shorewall::rule { 'jabber-1':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:5223",
+ proto => 'tcp',
+ destinationport => '5223',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2201,
+ }
+
+ shorewall::rule { 'jabber-2':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:5269",
+ proto => 'tcp',
+ destinationport => '5269',
+ ratelimit => '-',
+ order => 2202,
+ }
+
+ shorewall::rule { 'jabber-3':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:4369",
+ proto => 'tcp',
+ destinationport => '4369',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2203,
+ }
+
+ shorewall::rule { 'jabber-4':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:4370",
+ proto => 'tcp',
+ destinationport => '4370:4375',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2204,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::mail($destination) {
+ shorewall::rule { 'mail-1':
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:$destination:25",
+ proto => 'tcp',
+ destinationport => '25',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 1000,
+ }
+
+ shorewall::rule { 'mail-2':
+ action => 'DNAT',
+ source => 'net',
+ destination => "vm:$destination:25",
+ proto => 'tcp',
+ destinationport => '25',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 1001,
+ }
+
+ shorewall::rule { 'mail-3':
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:$destination:993",
+ proto => 'tcp',
+ destinationport => '993',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
+ order => 1002,
+ }
+
+ shorewall::rule { 'mail-4':
+ action => 'DNAT',
+ source => 'net',
+ destination => "vm:$destination:993",
+ proto => 'tcp',
+ destinationport => '993',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
+ order => 1003,
+ }
+
+ shorewall::rule { 'mail-5':
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:$destination:587",
+ proto => 'tcp',
+ destinationport => '587',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
+ order => 1004,
+ }
+
+ shorewall::rule { 'mail-6':
+ action => 'DNAT',
+ source => 'net',
+ destination => "vm:$destination:587",
+ proto => 'tcp',
+ destinationport => '587',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
+ order => 1005,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::mdns($destination, $zone = 'fw') {
+ shorewall::rule { 'mdns-0':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:5353",
+ proto => 'tcp',
+ destinationport => '5353',
+ ratelimit => '-',
+ order => 2700,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::mumble($destination, $zone = 'fw') {
+ shorewall::rule { 'mumble-0':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:64738",
+ proto => 'tcp',
+ destinationport => '64738',
+ ratelimit => '-',
+ order => 2300,
+ }
+
+ shorewall::rule { 'mumble-1':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "$zone:$destination:64738",
+ proto => 'udp',
+ destinationport => '64738',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2301,
+ }
+}
--- /dev/null
+define firewall::virtual::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') {
+ shorewall::rule { "munin-$name-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ ratelimit => '-',
+ order => $order,
+ }
+
+ shorewall::rule { "munin-$name-2":
+ action => 'DNAT',
+ source => '$FW',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => $order,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::rsync($destination, $zone = 'fw') {
+ shorewall::rule { 'rsync-0':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:873",
+ proto => 'tcp',
+ destinationport => '873',
+ ratelimit => '-',
+ order => 2600,
+ }
+}
--- /dev/null
+define firewall::virtual::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') {
+ shorewall::rule { "ssh-$name-1":
+ action => 'DNAT',
+ source => 'net',
+ destination => $port_dest ? {
+ '' => "$zone:$destination",
+ default => "$zone:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ ratelimit => '-',
+ order => "2$port_orig",
+ }
+
+ shorewall::rule { "ssh-$name-2":
+ action => 'DNAT',
+ source => '$FW',
+ destination => $port_dest ? {
+ '' => "fw:$destination",
+ default => "fw:$destination:$port_dest",
+ },
+ proto => 'tcp',
+ destinationport => "$port_orig",
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => "2$port_orig",
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::tor($destination, $zone = 'vm') {
+ shorewall::rule { 'tor-0':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9000",
+ proto => 'tcp',
+ destinationport => '9000',
+ ratelimit => '-',
+ order => 2100,
+ }
+
+ shorewall::rule { 'tor-1':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:9000",
+ proto => 'tcp',
+ destinationport => '9000',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2101,
+ }
+
+ shorewall::rule { 'tor-2':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9001",
+ proto => 'tcp',
+ destinationport => '9001',
+ ratelimit => '-',
+ order => 2102,
+ }
+
+ shorewall::rule { 'tor-3':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:9001",
+ proto => 'tcp',
+ destinationport => '9001',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2103,
+ }
+
+ shorewall::rule { 'tor-4':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9100",
+ proto => 'tcp',
+ destinationport => '9100',
+ ratelimit => '-',
+ order => 2104,
+ }
+
+ shorewall::rule { 'tor-5':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:9100",
+ proto => 'tcp',
+ destinationport => '9100',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2105,
+ }
+
+ shorewall::rule { 'tor-6':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:9101",
+ proto => 'tcp',
+ destinationport => '9101',
+ ratelimit => '-',
+ order => 2106,
+ }
+
+ shorewall::rule { 'tor-7':
+ action => 'DNAT',
+ source => '$FW',
+ destination => "fw:$destination:9101",
+ proto => 'tcp',
+ destinationport => '9101',
+ originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
+ ratelimit => '-',
+ order => 2107,
+ }
+}
--- /dev/null
+define firewall::virtual::web(
+ $destination
+) {
+ shorewall::rule { "web-route-${name}-1":
+ action => 'DNAT',
+ source => 'vm',
+ destination => "fw:${destination}:80",
+ proto => 'tcp',
+ destinationport => '80',
+ originaldest => $destination,
+ ratelimit => '-',
+ order => 600,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::virtual::yacy($destination, $zone = 'fw') {
+ shorewall::rule { 'yacy-0':
+ action => 'DNAT',
+ source => 'net',
+ destination => "$zone:$destination:8090",
+ proto => 'tcp',
+ destinationport => '8090',
+ ratelimit => '-',
+ order => 2500,
+ }
+}
--- /dev/null
+class firewall::implementations::shorewall::wifi (
+ $shorewall_local_net = false,
+ $wifi_device = '',
+) {
+ $rfc1918 = $shorewall_local_net ? {
+ true => true,
+ false => false,
+ default => false,
+ }
+
+ # Default device depends if madwifi or
+ # built-in kernel driver is being used
+ $wifi_default_device = $lsbdistcodename ? {
+ 'lenny' => 'ath0',
+ default => 'wlan0',
+ }
+
+ $wifi_dev = $wifi_device ? {
+ '' => $wifi_default_device,
+ default => $wifi_device,
+ }
+
+ #
+ # Interfaces
+ #
+ shorewall::interface { "$wifi_dev":
+ zone => '-',
+ rfc1918 => $rfc1918,
+ }
+
+ #
+ # Hosts
+ #
+ shorewall::host { "$wifi_dev-subnet":
+ name => "$wifi_dev:192.168.0.0/24",
+ zone => 'vm',
+ options => '',
+ order => 1,
+ }
+
+ shorewall::host { "$wifi_dev":
+ name => "$wifi_dev:0.0.0.0/0",
+ zone => 'net',
+ options => '',
+ order => 2,
+ }
+
+ shorewall::masq { "$wifi_dev":
+ interface => "$wifi_dev:!192.168.0.0/24",
+ source => '192.168.0.0/24',
+ order => 1,
+ }
+}
class firewall(
$implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
) {
- class { "firewall::${implementation}": }
+ class { "firewall::implementations::${implementation}": }
}
class firewall::local(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
$network = lookup('firewall::local::network', undef, undef, '192.168.1.0/24'),
$interface = lookup('firewall::local::interface', undef, undef, 'eth0'),
$manage_host = lookup('firewall::local::manage_host', undef, undef, true),
$manage_interface = lookup('firewall::local::manage_iface', undef, undef, false)
) {
- if $manage_host {
- shorewall::host { "$interface-loc":
- name => "$interface:$network",
- zone => 'loc',
- options => '',
- order => 3,
- }
+ class { "firewall::implementations::${implementation}::local":
+ network => $network,
+ interface => $interface,
+ manage_host => $manage_host,
+ manage_interface => $manage_interface,
}
-
- if $manage_interface {
- shorewall::interface { "$interface":
- zone => 'loc',
- rfc1918 => true,
- dhcp => true,
- options => 'routeback',
- }
- }
-
- shorewall::policy { 'loc-all':
- sourcezone => 'loc',
- destinationzone => 'all',
- policy => 'ACCEPT',
- order => 5,
- }
-
- shorewall::policy { 'vm-loc':
- sourcezone => 'vm',
- destinationzone => 'loc',
- policy => 'ACCEPT',
- order => 6,
- }
-
- shorewall::policy { 'fw-loc':
- sourcezone => '$FW',
- destinationzone => 'loc',
- policy => 'ACCEPT',
- order => 7,
- }
-
}
-class firewall::mpd {
- # MPD http stream
- shorewall::rule { 'mpd-http-stream':
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '8000',
- order => 200,
- action => 'ACCEPT';
- }
-
- # MPD client access
- shorewall::rule { 'mpd-daemon':
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '6600',
- order => 200,
- action => 'ACCEPT';
- }
+class firewall::mpd(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::mpd": }
}
class firewall::nas(
- $ftp = false,
- $tftp = false,
- $http = false,
- $nfsd = false,
- $rsync = false,
- $printer = false,
- $torrent = false,
- $mpd = false,
- $samba = false,
- $dlna = false,
- $daap = false,
- $avahi = false
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $ftp = false,
+ $tftp = false,
+ $http = false,
+ $nfsd = false,
+ $rsync = false,
+ $printer = false,
+ $torrent = false,
+ $mpd = false,
+ $samba = false,
+ $dlna = false,
+ $daap = false,
+ $avahi = false
) {
- if $ftp == true {
- include shorewall::rules::ftp
- }
-
- if $tftp == true {
- include shorewall::rules::tftp
- }
-
- if $http == true {
- include shorewall::rules::http
- }
-
- if $nfsd == true {
- include shorewall::rules::nfsd
-
- # Additional ports needed by NFS
- # Got using rpcinfo -p and netstat -ap
- shorewall::rule { 'nfs-1':
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '35150,43902,46661,46661,46661,50340,54814,57170,58403,59780',
- ratelimit => '-',
- order => 100,
- }
-
- shorewall::rule { 'nfs-2':
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => '938,38511,43195,53081,53081,53081,38521,45238,52664,52400,60331',
- ratelimit => '-',
- order => 100,
- }
- }
-
- if $rsync == true {
- include shorewall::rules::rsync
- }
-
- if $printer == true {
- include firewall::printer
- }
-
- if $torrent == true {
- include firewall::torrent
- }
-
- if $mpd == true {
- include firewall::mpd
- }
-
- if $samba == true {
- # See http://www.shorewall.net/samba.htm
- shorewall::rule { 'samba':
- action => 'SMB/ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => '-',
- destinationport => '-',
- ratelimit => '-',
- order => 100,
- }
-
- shorewall::rule { 'netbios-1':
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '137,138,139',
- ratelimit => '-',
- order => 100,
- }
-
- shorewall::rule { 'netbios-2':
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => '137,138,139',
- ratelimit => '-',
- order => 100,
- }
- }
-
- if $dlna == true {
- # DLNA
- #
- # https://wiki.archlinux.org/index.php/MiniDLNA
- # http://netpatia.blogspot.co.uk/2011/03/setup-your-own-dlna-server.html
- # http://wiki.alpinelinux.org/wiki/IPTV_How_To
- # http://mediatomb.cc/dokuwiki/faq:faq
- # http://packages.debian.org/wheezy/djmount
- # http://packages.debian.org/wheezy/gupnp-tools
- #
- # Optional:
- #
- # http://www.shorewall.net/UPnP.html
- #
- # linux-igd package
- # /etc/default/linux-igd
- # /etc/upnpd.conf
-
- shorewall::rule { "dlna-1":
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'tcp,udp',
- destinationport => "1900",
- ratelimit => '-',
- order => 102,
- }
-
- shorewall::rule { "dlna-2":
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'tcp,udp',
- destinationport => "8200",
- ratelimit => '-',
- order => 103,
- }
-
- shorewall::rule { "dlna-3":
- action => 'allowinUPnP',
- source => 'net',
- destination => '$FW',
- order => 104,
- }
-
- shorewall::rule { "dlna-4":
- action => 'forwardUPnP',
- source => 'net',
- destination => '$FW',
- order => 105,
- }
-
- # Enable multicast
- augeas { 'enable_multicast':
- changes => 'set /files/etc/shorewall/shorewall.conf/MULTICAST Yes',
- lens => 'Shellvars.lns',
- incl => '/etc/shorewall/shorewall.conf',
- notify => Service[shorewall];
- }
- }
-
- if $daap == true {
- # DAAP
- shorewall::rule { 'daap-1':
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '3689',
- order => 300,
- action => 'ACCEPT';
- }
-
- shorewall::rule { 'daap-2':
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => '3689',
- order => 301,
- action => 'ACCEPT';
- }
- }
-
- if $avahi == true {
- # Avahi/mDNS
- shorewall::rule { 'mdns':
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => '5353',
- order => 400,
- action => 'ACCEPT';
- }
+ class { "firewall::implementations::${implementation}::nas":
+ ftp => $ftp,
+ tftp => $tftp,
+ http => $http,
+ nfsd => $nfsd,
+ rsync => $rsync,
+ printer => $printer,
+ torrent => $torrent,
+ mpd => $mpd,
+ samba => $samba,
+ dlna => $dlna,
+ daap => $daap,
+ avahi => $avahi,
}
}
-class firewall::openvpn {
- shorewall::zone { 'vpn':
- type => 'ipv4',
- order => 4,
- }
-
- shorewall::interface { 'tun0':
- zone => 'vpn',
- }
-
- shorewall::policy { 'loc-vpn':
- sourcezone => 'loc',
- destinationzone => 'vpn',
- policy => 'ACCEPT',
- order => 20,
- }
-
- shorewall::policy { 'vpn-loc':
- sourcezone => 'vpn',
- destinationzone => 'loc',
- policy => 'ACCEPT',
- order => 21,
- }
-
- shorewall::policy { 'fw-vpn':
- sourcezone => '$FW',
- destinationzone => 'vpn',
- policy => 'ACCEPT',
- order => 22,
- }
-
- shorewall::tunnel { 'openvpn':
- tunnel_type => 'openvpnclient',
- zone => 'net',
- }
+class firewall::openvpn(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::openvpn": }
}
class firewall::ppp(
- $interface = 'ppp0',
- $zone = 'ppp'
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $interface = 'ppp0',
+ $zone = 'ppp'
) {
- shorewall::interface { $interface:
- zone => $zone,
- }
-
- if $zone == 'ppp' {
- shorewall::zone { 'ppp':
- type => 'ipv4',
- order => 4,
- }
-
- shorewall::policy { 'loc-ppp':
- sourcezone => 'loc',
- destinationzone => $zone,
- policy => 'ACCEPT',
- order => 30,
- }
-
- shorewall::policy { 'ppp-loc':
- sourcezone => 'ppp',
- destinationzone => $zone,
- policy => 'ACCEPT',
- order => 31,
- }
-
- shorewall::policy { 'fw-ppp':
- sourcezone => '$FW',
- destinationzone => $zone,
- policy => 'ACCEPT',
- order => 32,
- }
+ class { "firewall::implementations::${implementation}::ppp":
+ interface => $interface,
+ zone => $zone,
}
}
class firewall::pppoe(
- $packages = false,
- $local_dev = false,
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $packages = false,
+ $local_dev = false,
) {
- # Manage pppoe packages, requires nodo module
- if $packages == true {
- include nodo::utils::network::pppoe
- }
-
- # Define device in the local zone
- if $local_dev == true{
- shorewall::interface { "eth0":
- zone => 'loc',
- rfc1918 => false,
- options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
- }
- }
-
- # See http://shorewall.net/two-interface.htm
- augeas { 'clampmss':
- changes => 'set /files/etc/shorewall/shorewall.conf/CLAMPMSS Yes',
- lens => 'Shellvars.lns',
- incl => '/etc/shorewall/shorewall.conf',
- notify => Service[shorewall];
+ class { "firewall::implementations::${implementation}::pppoe":
+ packages => $packages,
+ local_dev => $local_dev,
}
}
-class firewall::printer {
- shorewall::rule { "cups-tcp":
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => "631",
- ratelimit => '-',
- order => 200,
- }
-
- shorewall::rule { "cups-udp":
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => "631",
- ratelimit => '-',
- order => 201,
- }
+class firewall::printer(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::printer": }
}
-class firewall::redirect::ssh($destinationport) {
- # When the box is in an internal network and we want to provide
- # and external access through a shared real IP, we have to
- # redirect requests coming from another port to port 22.
- $ip = lookup('firewall::external_ip', undef, undef, $::ipaddress)
-
- shorewall::rule { "ssh-redirect-1":
- action => 'DNAT',
- source => 'net',
- destination => "fw:$ip:22",
- proto => 'tcp',
- destinationport => $destinationport,
- ratelimit => '-',
- order => $destinationport,
+class firewall::redirect::ssh(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destinationport,
+) {
+ class { "firewall::implementations::${implementation}::redirect::ssh":
+ destinationport = $destinationport,
}
}
-class firewall::router::gitd($destination, $zone = 'loc', $originaldest = $ipaddress) {
- shorewall::rule { 'git-daemon-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9418",
- proto => 'tcp',
- destinationport => '9418',
- ratelimit => '-',
- order => 800,
- }
-
- shorewall::rule { 'git-daemon-2':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:9418",
- proto => 'tcp',
- destinationport => '9418',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 801,
+class firewall::router::gitd(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $ipaddress,
+) {
+ class { "firewall::implementations::${implementation}::router::gitd":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
-class firewall::router::gobby($destination, $zone = 'loc', $originaldest = $ipaddress) {
- shorewall::rule { 'gobby-route-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:6523",
- proto => 'tcp',
- destinationport => '6523',
- ratelimit => '-',
- order => 600,
- }
-
- shorewall::rule { 'gobby-route-2':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:6523",
- proto => 'tcp',
- destinationport => '6523',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 601,
+class firewall::router::gobby(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+ class { "firewall::implementations::${implementation}::router::gobby":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
# See http://www.shorewall.net/FAQ.htm#faq2
-define firewall::router::hairpinning($order = '5000', $proto = 'tcp', $port = 'www',
- $external_ip = '$ETH0_IP', $interface = 'eth1',
- $destination = '192.168.1.100', $source = 'eth1',
- $source_zone = 'loc', $dest_zone = 'loc',
- $port_dest = '') {
- shorewall::masq { "routeback-$name":
- interface => "$interface:$destination",
- source => $source,
- address => $external_ip,
- proto => $proto,
- port => $port,
- order => $order,
- }
-
- shorewall::rule { "routeback-$name":
- action => 'DNAT',
- source => $source_zone,
- destination => $port_dest ? {
- '' => "$dest_zone:$destination",
- default => "$dest_zone:$destination:$port_dest",
- },
- proto => $proto,
- destinationport => $port,
- ratelimit => '-',
- order => $order,
- originaldest => $external_ip,
+define firewall::router::hairpinning(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $order = '5000',
+ $proto = 'tcp',
+ $port = 'www',
+ $external_ip = '$ETH0_IP',
+ $interface = 'eth1',
+ $destination = '192.168.1.100',
+ $source = 'eth1',
+ $source_zone = 'loc',
+ $dest_zone = 'loc',
+ $port_dest = ''
+) {
+ class { "firewall::implementations::${implementation}::router::hairpinning":
+ order => $order,
+ proto => $proto,
+ port => $port,
+ external_ip => $external_ip,
+ interface => $interface,
+ destination => $destination,
+ source => $source,
+ source_zone => $source_zone,
+ dest_zone => $dest_zone,
+ port_dest => $port_dest,
}
}
-class firewall::router::http($destination, $zone = 'loc', $originaldest = $ipaddress) {
- shorewall::rule { 'http-route-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:80",
- proto => 'tcp',
- destinationport => '80',
- ratelimit => '-',
- order => 600,
- }
-
- shorewall::rule { 'http-route-2':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:80",
- proto => 'tcp',
- destinationport => '80',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 601,
+class firewall::router::http(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+ class { "firewall::implementations::${implementation}::router::http":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
-class firewall::router::https($destination, $zone = 'loc', $originaldest = $ipaddress) {
- shorewall::rule { 'https-route-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:443",
- proto => 'tcp',
- destinationport => '443',
- ratelimit => '-',
- order => 602,
- }
-
- shorewall::rule { 'https-route-2':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:443",
- proto => 'tcp',
- destinationport => '443',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 602,
+class firewall::router::https(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+ class { "firewall::implementations::${implementation}::router::https":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
-class firewall::router::icecast($destination, $zone = 'loc', $originaldest = $ipaddress) {
- shorewall::rule { 'icecast-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:8000",
- proto => 'tcp',
- destinationport => '8000',
- ratelimit => '-',
- order => 900,
- }
-
- shorewall::rule { 'icecast-2':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:8000",
- proto => 'tcp',
- destinationport => '8000',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 901,
+class firewall::router::icecast(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+ class { "firewall::implementations::${implementation}::router::icecast":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
-class firewall::router::mail($destination, $zone = 'loc', $originaldest = $ipaddress) {
- shorewall::rule { 'mail-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:25",
- proto => 'tcp',
- destinationport => '25',
- ratelimit => '-',
- order => 1000,
- }
-
- shorewall::rule { 'mail-2':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:25",
- proto => 'tcp',
- destinationport => '25',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 1001,
- }
-
- shorewall::rule { 'mail-3':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:993",
- proto => 'tcp',
- destinationport => '993',
- ratelimit => '-',
- order => 1002,
- }
-
- shorewall::rule { 'mail-4':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:993",
- proto => 'tcp',
- destinationport => '993',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 1003,
- }
-
- shorewall::rule { 'mail-5':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:587",
- proto => 'tcp',
- destinationport => '587',
- ratelimit => '-',
- order => 1004,
- }
-
- shorewall::rule { 'mail-6':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:587",
- proto => 'tcp',
- destinationport => '587',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 1005,
+class firewall::router::mail(i
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+ class { "firewall::implementations::${implementation}::router::mail":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
-class firewall::router::mumble($destination, $zone = 'loc', $originaldest = $::ipaddress) {
- shorewall::rule { 'mumble-0':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:64738",
- proto => 'tcp',
- destinationport => '64738',
- ratelimit => '-',
- order => 2300,
- }
-
- shorewall::rule { 'mumble-1':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:64738",
- proto => 'udp',
- destinationport => '64738',
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 2301,
+class firewall::router::mumble(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $::ipaddress
+) {
+ class { "firewall::implementations::${implementation}::router::mumble":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
-define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc',
- $order = '400', $originaldest = $ipaddress) {
- shorewall::rule { "munin-$name-1":
- action => 'DNAT',
- source => 'net',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- ratelimit => '-',
- order => $order,
- }
-
- shorewall::rule { "munin-$name-2":
- action => 'DNAT',
- source => '$FW',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => $order,
+define firewall::router::munin(
+ $destination,
+ $port_orig,
+ $port_dest = '',
+ $zone = 'loc',
+ $order = '400',
+ $originaldest = $ipaddress
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::router::munin":
+ destination => $destination,
+ port_orig => $port_orig,
+ port_dest => $port_dest,
+ zone => $zone,
+ order => $order,
+ originaldest => $originaldest,
}
}
-class firewall::router::rsync($destination, $port_orig = '873', $port_dest = '', $zone = 'loc',
- $originaldest = $ipaddress) {
- shorewall::rule { "rsync-$name-1":
- action => 'DNAT',
- source => 'net',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- ratelimit => '-',
- order => "26$port_orig",
- }
-
- shorewall::rule { "rsync-$name-2":
- action => 'DNAT',
- source => '$FW',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => "26$port_orig",
+class firewall::router::rsync(
+ $destination,
+ $port_orig = '873',
+ $port_dest = '',
+ $zone = 'loc',
+ $originaldest = $ipaddress
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::router::rsync":
+ destination => $destination,
+ port_orig => $port_orig,
+ port_dest => $port_dest,
+ zone => $zone,
+ order => $order,
+ originaldest => $originaldest,
}
}
-define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc',
- $originaldest = $ipaddress) {
- shorewall::rule { "ssh-$name-1":
- action => 'DNAT',
- source => 'net',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- ratelimit => '-',
- order => "2$port_orig",
- }
-
- shorewall::rule { "ssh-$name-2":
- action => 'DNAT',
- source => '$FW',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => "2$port_orig",
+define firewall::router::ssh(
+ $destination,
+ $port_orig = '22',
+ $port_dest = '',
+ $zone = 'loc',
+ $originaldest = $ipaddress,
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::router::ssh":
+ destination => $destination,
+ port_orig => $port_orig,
+ port_dest => $port_dest,
+ zone => $zone,
+ order => $order,
+ originaldest => $originaldest,
}
}
-define firewall::router::tor($destination, $zone = 'loc', $originaldest = $ipaddress) {
- shorewall::rule { "tor-$name-1":
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9000",
- proto => 'tcp',
- destinationport => "9000",
- ratelimit => '-',
- order => "29000",
- }
-
- shorewall::rule { "tor-$name-2":
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:9000",
- proto => 'tcp',
- destinationport => "9000",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => "29000",
- }
-
- shorewall::rule { "tor-$name-3":
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9001",
- proto => 'tcp',
- destinationport => "9001",
- ratelimit => '-',
- order => "29001",
- }
-
- shorewall::rule { "tor-$name-4":
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:9001",
- proto => 'tcp',
- destinationport => "9001",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => "29001",
- }
-
- shorewall::rule { "tor-$name-5":
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9100",
- proto => 'tcp',
- destinationport => "9100",
- ratelimit => '-',
- order => "29100",
- }
-
- shorewall::rule { "tor-$name-6":
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:9100",
- proto => 'tcp',
- destinationport => "9100",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => "29100",
- }
-
- shorewall::rule { "tor-$name-7":
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9101",
- proto => 'tcp',
- destinationport => "9101",
- ratelimit => '-',
- order => "29101",
- }
-
- shorewall::rule { "tor-$name-8":
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:9101",
- proto => 'tcp',
- destinationport => "9101",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => "29101",
+define firewall::router::tor(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+ class { "firewall::implementations::${implementation}::router::tor":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
}
}
class firewall::router::torrent(
$destination,
- $zone = 'loc',
- $originaldest = $ipaddress,
- $range = lookup('firewall::torrent::range', undef, undef, '6881:6999')
+ $zone = 'loc',
+ $originaldest = $ipaddress,
+ $range = lookup('firewall::torrent::range', undef, undef, '6881:6999')
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
) {
- shorewall::rule { "torrent-tcp-1":
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination",
- proto => 'tcp',
- destinationport => "$range",
- ratelimit => '-',
- order => 200,
- }
-
- shorewall::rule { "torrent-tcp-2":
- action => 'DNAT',
- source => 'all',
- destination => "$zone:$destination",
- proto => 'tcp',
- destinationport => "$range",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 200,
- }
-
- shorewall::rule { "torrent-udp-1":
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination",
- proto => 'udp',
- destinationport => "$range",
- ratelimit => '-',
- order => 201,
- }
-
- shorewall::rule { "torrent-udp-2":
- action => 'DNAT',
- source => 'all',
- destination => "$zone:$destination",
- proto => 'udp',
- destinationport => "6881:6999",
- originaldest => "$originaldest",
- ratelimit => '-',
- order => 201,
+ class { "firewall::implementations::${implementation}::router::torrent":
+ destination => $destination,
+ zone => $zone,
+ originaldest => $originaldest,
+ range => $range,
}
}
class firewall::shaping(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
$device = lookup('firewall::device', undef, undef, 'eth0'),
$in_bandwidth = lookup('firewall::in_bandwidth', undef, undef, '1000mbps'),
$out_bandwidth = lookup('firewall::out_bandwidth', undef, undef, '1000mbps')
) {
- #
- # Traffic shaping
- #
- shorewall::tcdevices { "${device}":
- in_bandwidth => "$in_bandwidth",
- out_bandwidth => "$out_bandwidth",
- }
-
- shorewall::tcrules { "ssh-tcp":
- order => "1",
- source => "0.0.0.0/0",
- destination => "0.0.0.0/0",
- protocol => "tcp",
- ports => "22",
- }
-
- shorewall::tcrules { "ssh-udp":
- order => "1",
- source => "0.0.0.0/0",
- destination => "0.0.0.0/0",
- protocol => "udp",
- ports => "22",
- }
-
- shorewall::tcclasses { "ssh":
- order => "1",
- interface => "${device}",
- rate => "4*full/100",
- ceil => "full",
- priority => "1",
- }
-
- shorewall::tcclasses { "default":
- order => "2",
- interface => "${device}",
- rate => "6*full/100",
- ceil => "full",
- priority => "2",
- options => "default",
+ class { "firewall::implementations::${implementation}::shaping":
+ device => $device,
+ in_bandwidth => $in_bandwidth,
+ out_bandwidth => $out_bandwidth,
}
}
class firewall::torrent(
- $range = lookup('firewall::torrent::range', undef, undef, '6881:6999')
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $range = lookup('firewall::torrent::range', undef, undef, '6881:6999')
) {
- shorewall::rule { "torrent-tcp":
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => "$range",
- ratelimit => '-',
- order => 200,
- }
-
- shorewall::rule { "torrent-udp":
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => "$range",
- ratelimit => '-',
- order => 201,
+ class { "firewall::implementations::${implementation}::torrent":
+ range => $range,
}
}
--- /dev/null
+class firewall::tpc(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::tpc": }
+}
-class firewall::ups {
- shorewall::rule { "ups":
- action => 'ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => "3551",
- ratelimit => '-',
- order => 200,
- }
+class firewall::ups(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::ups": }
}
-class firewall::virtual::dns($destination, $zone = 'vm') {
- shorewall::rule { 'dns-route-0':
- action => 'DNS/ACCEPT',
- source => 'net',
- destination => '$FW',
- proto => '-',
- destinationport => '-',
- ratelimit => '-',
- order => 2000,
- }
-
- shorewall::rule { 'dns-route-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:53",
- proto => 'tcp',
- destinationport => '53',
- ratelimit => '-',
- order => 2001,
- }
-
- shorewall::rule { 'dns-route-2':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:53",
- proto => 'tcp',
- destinationport => '53',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2002,
- }
-
- shorewall::rule { 'dns-route-3':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:53",
- proto => 'udp',
- destinationport => '53',
- ratelimit => '-',
- order => 2003,
- }
-
- shorewall::rule { 'dns-route-4':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:53",
- proto => 'udp',
- destinationport => '53',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2004,
+class firewall::virtual::dns(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'vm'
+) {
+ class { "firewall::implementations::${implementation}::virtual::dns":
+ destination => $destination,
+ zone => $zone,
}
}
-class firewall::virtual::gitd($destination) {
- shorewall::rule { 'git-daemon-1':
- action => 'DNAT',
- source => 'net',
- destination => "vm:$destination:9418",
- proto => 'tcp',
- destinationport => '9418',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 800,
- }
-
- shorewall::rule { 'git-daemon-2':
- action => 'DNAT',
- source => 'vm',
- destination => "fw:$destination:9418",
- proto => 'tcp',
- destinationport => '9418',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 801,
+class firewall::virtual::gitd(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination
+) {
+ class { "firewall::implementations::${implementation}::virtual::gitd":
+ destination => $destination,
}
}
-class firewall::virtual::gobby($destination) {
- shorewall::rule { 'gobby-0':
- action => 'DNAT',
- source => 'vm',
- destination => "fw:$destination:6523",
- proto => 'tcp',
- destinationport => '6523',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2400,
- }
-
- shorewall::rule { 'gobby-1':
- action => 'DNAT',
- source => 'net',
- destination => "vm:$destination:6523",
- proto => 'tcp',
- destinationport => '6523',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2400,
+class firewall::virtual::gobby(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination
+) {
+ class { "firewall::implementations::${implementation}::virtual::gobby":
+ destination => $destination,
}
}
-class firewall::virtual::http($destination) {
- shorewall::rule { 'http-route-1':
- action => 'DNAT',
- source => 'vm',
- destination => "fw:$destination:80",
- proto => 'tcp',
- destinationport => '80',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 600,
- }
-
- shorewall::rule { 'http-route-2':
- action => 'DNAT',
- source => 'net',
- destination => "vm:$destination:80",
- proto => 'tcp',
- destinationport => '80',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 601,
+class firewall::virtual::http(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination
+) {
+ class { "firewall::implementations::${implementation}::virtual::http":
+ destination => $destination,
}
}
-class firewall::virtual::https($destination) {
- shorewall::rule { 'https-route-1':
- action => 'DNAT',
- source => 'vm',
- destination => "fw:$destination:443",
- proto => 'tcp',
- destinationport => '443',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
- order => 602,
- }
-
- shorewall::rule { 'https-route-2':
- action => 'DNAT',
- source => 'net',
- destination => "vm:$destination:443",
- proto => 'tcp',
- destinationport => '443',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
- order => 602,
+class firewall::virtual::https(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination
+) {
+ class { "firewall::implementations::${implementation}::virtual::https":
+ destination => $destination,
}
}
-class firewall::virtual::icecast($destination, $zone = 'fw') {
- shorewall::rule { 'icecast-1':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:8000",
- proto => 'tcp',
- destinationport => '8000',
- ratelimit => '-',
- order => 900,
- }
-
- shorewall::rule { 'icecast-2':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:8000",
- proto => 'tcp',
- destinationport => '8000',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 901,
+class firewall::virtual::icecast(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'fw'
+) {
+ class { "firewall::implementations::${implementation}::virtual::icecast":
+ destination => $destination,
+ zone => $zone,
}
}
-class firewall::virtual::jabber($destination, $zone = 'fw') {
- shorewall::rule { 'jabber-0':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:5222",
- proto => 'tcp',
- destinationport => '5222',
- ratelimit => '-',
- order => 2200,
- }
-
- shorewall::rule { 'jabber-1':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:5223",
- proto => 'tcp',
- destinationport => '5223',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2201,
- }
-
- shorewall::rule { 'jabber-2':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:5269",
- proto => 'tcp',
- destinationport => '5269',
- ratelimit => '-',
- order => 2202,
- }
-
- shorewall::rule { 'jabber-3':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:4369",
- proto => 'tcp',
- destinationport => '4369',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2203,
- }
-
- shorewall::rule { 'jabber-4':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:4370",
- proto => 'tcp',
- destinationport => '4370:4375',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2204,
+class firewall::virtual::jabber(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'fw'
+) {
+ class { "firewall::implementations::${implementation}::virtual::jabber":
+ destination => $destination,
+ zone => $zone,
}
}
-class firewall::virtual::mail($destination) {
- shorewall::rule { 'mail-1':
- action => 'DNAT',
- source => 'vm',
- destination => "fw:$destination:25",
- proto => 'tcp',
- destinationport => '25',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 1000,
- }
-
- shorewall::rule { 'mail-2':
- action => 'DNAT',
- source => 'net',
- destination => "vm:$destination:25",
- proto => 'tcp',
- destinationport => '25',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 1001,
- }
-
- shorewall::rule { 'mail-3':
- action => 'DNAT',
- source => 'vm',
- destination => "fw:$destination:993",
- proto => 'tcp',
- destinationport => '993',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
- order => 1002,
- }
-
- shorewall::rule { 'mail-4':
- action => 'DNAT',
- source => 'net',
- destination => "vm:$destination:993",
- proto => 'tcp',
- destinationport => '993',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
- order => 1003,
- }
-
- shorewall::rule { 'mail-5':
- action => 'DNAT',
- source => 'vm',
- destination => "fw:$destination:587",
- proto => 'tcp',
- destinationport => '587',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
- order => 1004,
- }
-
- shorewall::rule { 'mail-6':
- action => 'DNAT',
- source => 'net',
- destination => "vm:$destination:587",
- proto => 'tcp',
- destinationport => '587',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'),
- order => 1005,
+class firewall::virtual::mail(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination
+) {
+ class { "firewall::implementations::${implementation}::virtual::mail":
+ destination => $destination,
}
}
-class firewall::virtual::mdns($destination, $zone = 'fw') {
- shorewall::rule { 'mdns-0':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:5353",
- proto => 'tcp',
- destinationport => '5353',
- ratelimit => '-',
- order => 2700,
+class firewall::virtual::mdns(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'fw'
+) {
+ class { "firewall::implementations::${implementation}::virtual::mdns":
+ destination => $destination,
+ zone => $zone,
}
}
-class firewall::virtual::mumble($destination, $zone = 'fw') {
- shorewall::rule { 'mumble-0':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:64738",
- proto => 'tcp',
- destinationport => '64738',
- ratelimit => '-',
- order => 2300,
- }
-
- shorewall::rule { 'mumble-1':
- action => 'DNAT',
- source => '$FW',
- destination => "$zone:$destination:64738",
- proto => 'udp',
- destinationport => '64738',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2301,
+class firewall::virtual::mumble(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'fw'
+) {
+ class { "firewall::implementations::${implementation}::virtual::mumble":
+ destination => $destination,
+ zone => $zone,
}
}
-define firewall::virtual::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') {
- shorewall::rule { "munin-$name-1":
- action => 'DNAT',
- source => 'net',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- ratelimit => '-',
- order => $order,
- }
-
- shorewall::rule { "munin-$name-2":
- action => 'DNAT',
- source => '$FW',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => $order,
+define firewall::virtual::munin(
+ $destination,
+ $port_orig,
+ $port_dest = '',
+ $order = '400',
+ $zone = 'fw'
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::virtual::munin":
+ destination => $destination,
+ port_orig => $port_orig,
+ port_dest => $port_dest,
+ order => $order,
+ zone => $zone,
}
}
-class firewall::virtual::rsync($destination, $zone = 'fw') {
- shorewall::rule { 'rsync-0':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:873",
- proto => 'tcp',
- destinationport => '873',
- ratelimit => '-',
- order => 2600,
+class firewall::virtual::rsync(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'fw'
+) {
+ class { "firewall::implementations::${implementation}::virtual::rsync":
+ destination => $destination,
+ zone => $zone,
}
}
-define firewall::virtual::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') {
- shorewall::rule { "ssh-$name-1":
- action => 'DNAT',
- source => 'net',
- destination => $port_dest ? {
- '' => "$zone:$destination",
- default => "$zone:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- ratelimit => '-',
- order => "2$port_orig",
- }
-
- shorewall::rule { "ssh-$name-2":
- action => 'DNAT',
- source => '$FW',
- destination => $port_dest ? {
- '' => "fw:$destination",
- default => "fw:$destination:$port_dest",
- },
- proto => 'tcp',
- destinationport => "$port_orig",
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => "2$port_orig",
+define firewall::virtual::ssh(
+ $destination,
+ $port_orig = '22',
+ $port_dest = '',
+ $zone = 'vm'
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+ class { "firewall::implementations::${implementation}::virtual::ssh":
+ destination => $destination,
+ port_orig => $port_orig,
+ port_dest => $port_dest,
+ zone => $zone,
}
}
-class firewall::virtual::tor($destination, $zone = 'vm') {
- shorewall::rule { 'tor-0':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9000",
- proto => 'tcp',
- destinationport => '9000',
- ratelimit => '-',
- order => 2100,
- }
-
- shorewall::rule { 'tor-1':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:9000",
- proto => 'tcp',
- destinationport => '9000',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2101,
- }
-
- shorewall::rule { 'tor-2':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9001",
- proto => 'tcp',
- destinationport => '9001',
- ratelimit => '-',
- order => 2102,
- }
-
- shorewall::rule { 'tor-3':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:9001",
- proto => 'tcp',
- destinationport => '9001',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2103,
- }
-
- shorewall::rule { 'tor-4':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9100",
- proto => 'tcp',
- destinationport => '9100',
- ratelimit => '-',
- order => 2104,
- }
-
- shorewall::rule { 'tor-5':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:9100",
- proto => 'tcp',
- destinationport => '9100',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2105,
- }
-
- shorewall::rule { 'tor-6':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:9101",
- proto => 'tcp',
- destinationport => '9101',
- ratelimit => '-',
- order => 2106,
- }
-
- shorewall::rule { 'tor-7':
- action => 'DNAT',
- source => '$FW',
- destination => "fw:$destination:9101",
- proto => 'tcp',
- destinationport => '9101',
- originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress),
- ratelimit => '-',
- order => 2107,
+class firewall::virtual::tor(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'vm'
+) {
+ class { "firewall::implementations::${implementation}::virtual::tor":
+ destination => $destination,
+ zone => $zone,
}
}
define firewall::virtual::web(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
$destination
) {
- shorewall::rule { "web-route-${name}-1":
- action => 'DNAT',
- source => 'vm',
- destination => "fw:${destination}:80",
- proto => 'tcp',
- destinationport => '80',
- originaldest => $destination,
- ratelimit => '-',
- order => 600,
+ class { "firewall::implementations::${implementation}::virtual::web":
+ destination => $destination,
}
}
-class firewall::virtual::yacy($destination, $zone = 'fw') {
- shorewall::rule { 'yacy-0':
- action => 'DNAT',
- source => 'net',
- destination => "$zone:$destination:8090",
- proto => 'tcp',
- destinationport => '8090',
- ratelimit => '-',
- order => 2500,
+class firewall::virtual::yacy(
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+ $destination, $zone = 'fw'
+) {
+ class { "firewall::implementations::${implementation}::virtual::yacy":
+ destination => $destination,
+ zone => $zone,
}
}
class firewall::wifi (
+ $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
$shorewall_local_net = false,
$wifi_device = '',
) {
- $rfc1918 = $shorewall_local_net ? {
- true => true,
- false => false,
- default => false,
- }
-
- # Default device depends if madwifi or
- # built-in kernel driver is being used
- $wifi_default_device = $lsbdistcodename ? {
- 'lenny' => 'ath0',
- default => 'wlan0',
- }
-
- $wifi_dev = $wifi_device ? {
- '' => $wifi_default_device,
- default => $wifi_device,
- }
-
- #
- # Interfaces
- #
- shorewall::interface { "$wifi_dev":
- zone => '-',
- rfc1918 => $rfc1918,
- }
-
- #
- # Hosts
- #
- shorewall::host { "$wifi_dev-subnet":
- name => "$wifi_dev:192.168.0.0/24",
- zone => 'vm',
- options => '',
- order => 1,
- }
-
- shorewall::host { "$wifi_dev":
- name => "$wifi_dev:0.0.0.0/0",
- zone => 'net',
- options => '',
- order => 2,
- }
-
- shorewall::masq { "$wifi_dev":
- interface => "$wifi_dev:!192.168.0.0/24",
- source => '192.168.0.0/24',
- order => 1,
+ class { "firewall::implementations::${implementation}::wifi":
+ shorewall_local_net => $shorewall_local_net,
+ wifi_device => $wifi_device,
}
}
projects / puppet-firewall.git / commitdiff