diff options
author | Silvio Rhatto <rhatto@riseup.net> | 2015-09-11 21:56:50 -0300 |
---|---|---|
committer | Silvio Rhatto <rhatto@riseup.net> | 2015-09-11 21:56:50 -0300 |
commit | 14ced49d32beab8b80c6499b3a02ed1523ab98ae (patch) | |
tree | 22cdf03d732e91e502c5124e9f649d1c972488ce /manifests/virtual | |
parent | 279c52185ec96cd1f8b0c25a1a14b0e537c1c11a (diff) | |
download | puppet-firewall-14ced49d32beab8b80c6499b3a02ed1523ab98ae.tar.gz puppet-firewall-14ced49d32beab8b80c6499b3a02ed1523ab98ae.tar.bz2 |
Use firewall::virtual class names
Diffstat (limited to 'manifests/virtual')
-rw-r--r-- | manifests/virtual/dns.pp | 53 | ||||
-rw-r--r-- | manifests/virtual/gitd.pp | 22 | ||||
-rw-r--r-- | manifests/virtual/gobby.pp | 11 | ||||
-rw-r--r-- | manifests/virtual/http.pp | 22 | ||||
-rw-r--r-- | manifests/virtual/https.pp | 22 | ||||
-rw-r--r-- | manifests/virtual/icecast.pp | 22 | ||||
-rw-r--r-- | manifests/virtual/jabber.pp | 54 | ||||
-rw-r--r-- | manifests/virtual/mail.pp | 64 | ||||
-rw-r--r-- | manifests/virtual/mdns.pp | 11 | ||||
-rw-r--r-- | manifests/virtual/mumble.pp | 22 | ||||
-rw-r--r-- | manifests/virtual/munin.pp | 28 | ||||
-rw-r--r-- | manifests/virtual/puppetmaster.pp | 85 | ||||
-rw-r--r-- | manifests/virtual/rsync.pp | 11 | ||||
-rw-r--r-- | manifests/virtual/ssh.pp | 28 | ||||
-rw-r--r-- | manifests/virtual/tor.pp | 43 | ||||
-rw-r--r-- | manifests/virtual/yacy.pp | 11 |
16 files changed, 509 insertions, 0 deletions
diff --git a/manifests/virtual/dns.pp b/manifests/virtual/dns.pp new file mode 100644 index 0000000..f389929 --- /dev/null +++ b/manifests/virtual/dns.pp @@ -0,0 +1,53 @@ +class firewall::virtual::dns($destination, $zone = 'vm') { + shorewall::rule { 'dns-route-0': + action => 'DNS/ACCEPT', + source => 'net', + destination => '$FW', + proto => '-', + destinationport => '-', + ratelimit => '-', + order => 2000, + } + + shorewall::rule { 'dns-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'tcp', + destinationport => '53', + ratelimit => '-', + order => 2001, + } + + shorewall::rule { 'dns-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'tcp', + destinationport => '53', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2002, + } + + shorewall::rule { 'dns-route-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'udp', + destinationport => '53', + ratelimit => '-', + order => 2003, + } + + shorewall::rule { 'dns-route-4': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'udp', + destinationport => '53', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2004, + } +} diff --git a/manifests/virtual/gitd.pp b/manifests/virtual/gitd.pp new file mode 100644 index 0000000..23095aa --- /dev/null +++ b/manifests/virtual/gitd.pp @@ -0,0 +1,22 @@ +class firewall::virtual::gitd($destination, $zone = 'fw') { + shorewall::rule { 'git-daemon-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9418", + proto => 'tcp', + destinationport => '9418', + ratelimit => '-', + order => 800, + } + + shorewall::rule { 'git-daemon-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9418", + proto => 'tcp', + destinationport => '9418', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 801, + } +} diff --git a/manifests/virtual/gobby.pp b/manifests/virtual/gobby.pp new file mode 100644 index 0000000..5554a11 --- /dev/null +++ b/manifests/virtual/gobby.pp @@ -0,0 +1,11 @@ +class firewall::virtual::gobby($destination, $zone = 'fw') { + shorewall::rule { 'gobby-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:6523", + proto => 'tcp', + destinationport => '6523', + ratelimit => '-', + order => 2400, + } +} diff --git a/manifests/virtual/http.pp b/manifests/virtual/http.pp new file mode 100644 index 0000000..b1e7faa --- /dev/null +++ b/manifests/virtual/http.pp @@ -0,0 +1,22 @@ +class firewall::virtual::http($destination, $zone = 'vm') { + shorewall::rule { 'http-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:80", + proto => 'tcp', + destinationport => '80', + ratelimit => '-', + order => 600, + } + + shorewall::rule { 'http-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:80", + proto => 'tcp', + destinationport => '80', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 601, + } +} diff --git a/manifests/virtual/https.pp b/manifests/virtual/https.pp new file mode 100644 index 0000000..ea900d8 --- /dev/null +++ b/manifests/virtual/https.pp @@ -0,0 +1,22 @@ +class firewall::virtual::https($destination, $zone = 'vm') { + shorewall::rule { 'https-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:443", + proto => 'tcp', + destinationport => '443', + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 602, + } + + shorewall::rule { 'https-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:443", + proto => 'tcp', + destinationport => '443', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 602, + } +} diff --git a/manifests/virtual/icecast.pp b/manifests/virtual/icecast.pp new file mode 100644 index 0000000..1681f18 --- /dev/null +++ b/manifests/virtual/icecast.pp @@ -0,0 +1,22 @@ +class firewall::virtual::icecast($destination, $zone = 'fw') { + shorewall::rule { 'icecast-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + ratelimit => '-', + order => 900, + } + + shorewall::rule { 'icecast-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 901, + } +} diff --git a/manifests/virtual/jabber.pp b/manifests/virtual/jabber.pp new file mode 100644 index 0000000..0bba4e9 --- /dev/null +++ b/manifests/virtual/jabber.pp @@ -0,0 +1,54 @@ +class firewall::virtual::jabber($destination, $zone = 'fw') { + shorewall::rule { 'jabber-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5222", + proto => 'tcp', + destinationport => '5222', + ratelimit => '-', + order => 2200, + } + + shorewall::rule { 'jabber-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:5223", + proto => 'tcp', + destinationport => '5223', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2201, + } + + shorewall::rule { 'jabber-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5269", + proto => 'tcp', + destinationport => '5269', + ratelimit => '-', + order => 2202, + } + + shorewall::rule { 'jabber-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4369", + proto => 'tcp', + destinationport => '4369', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2203, + } + + shorewall::rule { 'jabber-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4370", + proto => 'tcp', + destinationport => '4370:4375', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2204, + } +} diff --git a/manifests/virtual/mail.pp b/manifests/virtual/mail.pp new file mode 100644 index 0000000..83589ce --- /dev/null +++ b/manifests/virtual/mail.pp @@ -0,0 +1,64 @@ +class firewall::virtual::mail($destination, $zone = 'fw') { + shorewall::rule { 'mail-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:25", + proto => 'tcp', + destinationport => '25', + ratelimit => '-', + order => 1000, + } + + shorewall::rule { 'mail-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:25", + proto => 'tcp', + destinationport => '25', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 1001, + } + + shorewall::rule { 'mail-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:993", + proto => 'tcp', + destinationport => '993', + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1002, + } + + shorewall::rule { 'mail-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:993", + proto => 'tcp', + destinationport => '993', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1003, + } + + shorewall::rule { 'mail-5': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:587", + proto => 'tcp', + destinationport => '587', + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1004, + } + + shorewall::rule { 'mail-6': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:587", + proto => 'tcp', + destinationport => '587', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1005, + } +} diff --git a/manifests/virtual/mdns.pp b/manifests/virtual/mdns.pp new file mode 100644 index 0000000..db8ec25 --- /dev/null +++ b/manifests/virtual/mdns.pp @@ -0,0 +1,11 @@ +class firewall::virtual::mdns($destination, $zone = 'fw') { + shorewall::rule { 'mdns-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5353", + proto => 'tcp', + destinationport => '5353', + ratelimit => '-', + order => 2700, + } +} diff --git a/manifests/virtual/mumble.pp b/manifests/virtual/mumble.pp new file mode 100644 index 0000000..45ab393 --- /dev/null +++ b/manifests/virtual/mumble.pp @@ -0,0 +1,22 @@ +class firewall::virtual::mumble($destination, $zone = 'fw') { + shorewall::rule { 'mumble-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:64738", + proto => 'tcp', + destinationport => '64738', + ratelimit => '-', + order => 2300, + } + + shorewall::rule { 'mumble-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:64738", + proto => 'udp', + destinationport => '64738', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2301, + } +} diff --git a/manifests/virtual/munin.pp b/manifests/virtual/munin.pp new file mode 100644 index 0000000..b8bfce1 --- /dev/null +++ b/manifests/virtual/munin.pp @@ -0,0 +1,28 @@ +define firewall::virtual::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') { + shorewall::rule { "munin-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => $order, + } + + shorewall::rule { "munin-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => $order, + } +} diff --git a/manifests/virtual/puppetmaster.pp b/manifests/virtual/puppetmaster.pp new file mode 100644 index 0000000..e54c166 --- /dev/null +++ b/manifests/virtual/puppetmaster.pp @@ -0,0 +1,85 @@ +class firewall::virtual::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'fw') { + shorewall::rule { 'puppetmaster-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'tcp', + destinationport => "$puppetmaster_port", + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 700, + } + + shorewall::rule { 'puppetmaster-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'udp', + destinationport => "$puppetmaster_port", + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 701, + } + + shorewall::rule { 'puppetmaster-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'tcp', + destinationport => "$puppetmaster_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 702, + } + + shorewall::rule { 'puppetmaster-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'udp', + destinationport => "$puppetmaster_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 703, + } + + shorewall::rule { 'puppetmaster-5': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'tcp', + destinationport => "$puppetmaster_nonssl_port", + ratelimit => '-', + order => 704, + } + + shorewall::rule { 'puppetmaster-6': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'udp', + destinationport => "$puppetmaster_nonssl_port", + ratelimit => '-', + order => 705, + } + + shorewall::rule { 'puppetmaster-7': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'tcp', + destinationport => "$puppetmaster_nonssl_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 706, + } + + shorewall::rule { 'puppetmaster-8': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'udp', + destinationport => "$puppetmaster_nonssl_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 707, + } +} diff --git a/manifests/virtual/rsync.pp b/manifests/virtual/rsync.pp new file mode 100644 index 0000000..50df46c --- /dev/null +++ b/manifests/virtual/rsync.pp @@ -0,0 +1,11 @@ +class firewall::virtual::rsync($destination, $zone = 'fw') { + shorewall::rule { 'rsync-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:873", + proto => 'tcp', + destinationport => '873', + ratelimit => '-', + order => 2600, + } +} diff --git a/manifests/virtual/ssh.pp b/manifests/virtual/ssh.pp new file mode 100644 index 0000000..4832b58 --- /dev/null +++ b/manifests/virtual/ssh.pp @@ -0,0 +1,28 @@ +define firewall::virtual::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') { + shorewall::rule { "ssh-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => "2$port_orig", + } + + shorewall::rule { "ssh-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "fw:$destination", + default => "fw:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => "2$port_orig", + } +} diff --git a/manifests/virtual/tor.pp b/manifests/virtual/tor.pp new file mode 100644 index 0000000..4d336c6 --- /dev/null +++ b/manifests/virtual/tor.pp @@ -0,0 +1,43 @@ +class firewall::virtual::tor($destination, $zone = 'fw') { + shorewall::rule { 'tor-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => '9001', + ratelimit => '-', + order => 2100, + } + + shorewall::rule { 'tor-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => '9001', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2101, + } + + shorewall::rule { 'tor-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9030", + proto => 'tcp', + destinationport => '9030', + ratelimit => '-', + order => 2102, + } + + shorewall::rule { 'tor-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9030", + proto => 'tcp', + destinationport => '9030', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2103, + } +} diff --git a/manifests/virtual/yacy.pp b/manifests/virtual/yacy.pp new file mode 100644 index 0000000..173ba13 --- /dev/null +++ b/manifests/virtual/yacy.pp @@ -0,0 +1,11 @@ +class firewall::virtual::yacy($destination, $zone = 'fw') { + shorewall::rule { 'yacy-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8090", + proto => 'tcp', + destinationport => '8090', + ratelimit => '-', + order => 2500, + } +} |