Updates some firewall::virtual rules to new kvm scheme

5 files changed, 47 insertions, 29 deletions

diff --git a/manifests/virtual/gitd.pp b/manifests/virtual/gitd.pp
index 23095aa..02c4fb9 100644
--- a/manifests/virtual/gitd.pp
+++ b/manifests/virtual/gitd.pp
@@ -1,18 +1,19 @@
-class firewall::virtual::gitd($destination, $zone = 'fw') {
+class firewall::virtual::gitd($destination) {
   shorewall::rule { 'git-daemon-1':
     action          => 'DNAT',
     source          => 'net',
-    destination     => "$zone:$destination:9418",
+    destination     => "vm:$destination:9418",
     proto           => 'tcp',
     destinationport => '9418',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
     ratelimit       => '-',
     order           => 800,
   }
 
   shorewall::rule { 'git-daemon-2':
     action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:9418",
+    source          => 'vm',
+    destination     => "fw:$destination:9418",
     proto           => 'tcp',
     destinationport => '9418',
     originaldest    => hiera('firewall::external_ip', $::ipaddress),
diff --git a/manifests/virtual/gobby.pp b/manifests/virtual/gobby.pp
index 5554a11..162fe1d 100644
--- a/manifests/virtual/gobby.pp
+++ b/manifests/virtual/gobby.pp
@@ -1,10 +1,22 @@
-class firewall::virtual::gobby($destination, $zone = 'fw') {
+class firewall::virtual::gobby($destination) {
   shorewall::rule { 'gobby-0':
     action          => 'DNAT',
+    source          => 'vm',
+    destination     => "fw:$destination:6523",
+    proto           => 'tcp',
+    destinationport => '6523',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
+    ratelimit       => '-',
+    order           => 2400,
+  }
+
+  shorewall::rule { 'gobby-1':
+    action          => 'DNAT',
     source          => 'net',
-    destination     => "$zone:$destination:6523",
+    destination     => "vm:$destination:6523",
     proto           => 'tcp',
     destinationport => '6523',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
     ratelimit       => '-',
     order           => 2400,
   }
diff --git a/manifests/virtual/http.pp b/manifests/virtual/http.pp
index b1e7faa..efd3dca 100644
--- a/manifests/virtual/http.pp
+++ b/manifests/virtual/http.pp
@@ -1,18 +1,19 @@
-class firewall::virtual::http($destination, $zone = 'vm') {
+class firewall::virtual::http($destination) {
   shorewall::rule { 'http-route-1':
     action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:80",
+    source          => 'vm',
+    destination     => "fw:$destination:80",
     proto           => 'tcp',
     destinationport => '80',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
     ratelimit       => '-',
     order           => 600,
   }
 
   shorewall::rule { 'http-route-2':
     action          => 'DNAT',
-    source          => '$FW',
-    destination     => "fw:$destination:80",
+    source          => 'net',
+    destination     => "vm:$destination:80",
     proto           => 'tcp',
     destinationport => '80',
     originaldest    => hiera('firewall::external_ip', $::ipaddress),
diff --git a/manifests/virtual/https.pp b/manifests/virtual/https.pp
index ea900d8..36e0c9f 100644
--- a/manifests/virtual/https.pp
+++ b/manifests/virtual/https.pp
@@ -1,18 +1,19 @@
-class firewall::virtual::https($destination, $zone = 'vm') {
+class firewall::virtual::https($destination) {
   shorewall::rule { 'https-route-1':
     action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:443",
+    source          => 'vm',
+    destination     => "fw:$destination:443",
     proto           => 'tcp',
     destinationport => '443',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
     ratelimit       => hiera("firewall::ssl_ratelimit", '-'),
     order           => 602,
   }
 
   shorewall::rule { 'https-route-2':
     action          => 'DNAT',
-    source          => '$FW',
-    destination     => "fw:$destination:443",
+    source          => 'net',
+    destination     => "vm:$destination:443",
     proto           => 'tcp',
     destinationport => '443',
     originaldest    => hiera('firewall::external_ip', $::ipaddress),
diff --git a/manifests/virtual/mail.pp b/manifests/virtual/mail.pp
index 83589ce..75eec5f 100644
--- a/manifests/virtual/mail.pp
+++ b/manifests/virtual/mail.pp
@@ -1,18 +1,19 @@
-class firewall::virtual::mail($destination, $zone = 'fw') {
+class firewall::virtual::mail($destination) {
   shorewall::rule { 'mail-1':
     action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:25",
+    source          => 'vm',
+    destination     => "fw:$destination:25",
     proto           => 'tcp',
     destinationport => '25',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
     ratelimit       => '-',
     order           => 1000,
   }
 
   shorewall::rule { 'mail-2':
     action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:25",
+    source          => 'net',
+    destination     => "vm:$destination:25",
     proto           => 'tcp',
     destinationport => '25',
     originaldest    => hiera('firewall::external_ip', $::ipaddress),
@@ -22,18 +23,19 @@ class firewall::virtual::mail($destination, $zone = 'fw') {
 
   shorewall::rule { 'mail-3':
     action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:993",
+    source          => 'vm',
+    destination     => "fw:$destination:993",
     proto           => 'tcp',
     destinationport => '993',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
     ratelimit       => hiera("firewall::ssl_ratelimit", '-'),
     order           => 1002,
   }
 
   shorewall::rule { 'mail-4':
     action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:993",
+    source          => 'net',
+    destination     => "vm:$destination:993",
     proto           => 'tcp',
     destinationport => '993',
     originaldest    => hiera('firewall::external_ip', $::ipaddress),
@@ -43,18 +45,19 @@ class firewall::virtual::mail($destination, $zone = 'fw') {
 
   shorewall::rule { 'mail-5':
     action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:587",
+    source          => 'vm',
+    destination     => "fw:$destination:587",
     proto           => 'tcp',
     destinationport => '587',
+    originaldest    => hiera('firewall::external_ip', $::ipaddress),
     ratelimit       => hiera("firewall::ssl_ratelimit", '-'),
     order           => 1004,
   }
 
   shorewall::rule { 'mail-6':
     action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:587",
+    source          => 'net',
+    destination     => "vm:$destination:587",
     proto           => 'tcp',
     destinationport => '587',
     originaldest    => hiera('firewall::external_ip', $::ipaddress),