1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
# @api private
# This class handles the configuration file. Avoid modifying private classes.
class ferm::config {
# this is a private class
assert_private("You're not supposed to do that!")
$_ip = join($ferm::ip_versions, ' ')
# copy static files to ferm
# on a long term point of view, we want to package this
file{'/etc/ferm.d':
ensure => 'directory',
}
-> file{'/etc/ferm.d/definitions':
ensure => 'directory',
}
-> file{'/etc/ferm.d/chains':
ensure => 'directory',
}
if $ferm::manage_configfile {
concat{$ferm::configfile:
ensure => 'present',
}
concat::fragment{'ferm_header.conf':
target => $ferm::configfile,
content => epp("${module_name}/ferm_header.conf.epp"),
order => '01',
}
concat::fragment{'ferm.conf':
target => $ferm::configfile,
content => epp(
"${module_name}/ferm.conf.epp", {
'ip' => $_ip,
}
),
order => '50',
}
}
ferm::chain{'INPUT':
policy => $ferm::input_policy,
disable_conntrack => $ferm::disable_conntrack,
log_dropped_packets => $ferm::input_log_dropped_packets,
}
ferm::chain{'FORWARD':
policy => $ferm::forward_policy,
disable_conntrack => $ferm::disable_conntrack,
log_dropped_packets => $ferm::forward_log_dropped_packets,
}
ferm::chain{'OUTPUT':
policy => $ferm::output_policy,
disable_conntrack => $ferm::disable_conntrack,
log_dropped_packets => $ferm::output_log_dropped_packets,
}
}
|
