summaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
authorSilvio Rhatto <rhatto@riseup.net>2016-03-05 11:52:31 -0300
committerSilvio Rhatto <rhatto@riseup.net>2016-03-05 11:52:31 -0300
commit3bc3cca757448549c4973f499932b48aaea6f218 (patch)
tree15c47f94b20b0a30dbb47789d1a3958cea5b3822 /manifests
parent6171b96c76116d1f1723f4ebb45f5b54cc36dad0 (diff)
downloadpuppet-firewall-3bc3cca757448549c4973f499932b48aaea6f218.tar.gz
puppet-firewall-3bc3cca757448549c4973f499932b48aaea6f218.tar.bz2
Make traffic shaping optional
Diffstat (limited to 'manifests')
-rw-r--r--manifests/init.pp44
-rw-r--r--manifests/shaping.pp46
2 files changed, 46 insertions, 44 deletions
diff --git a/manifests/init.pp b/manifests/init.pp
index b6a57c2..48c9df3 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -3,8 +3,6 @@ class firewall(
$device = hiera('firewall::device', 'eth0'),
$zone = hiera('firewall::zone', '-'),
$local_net = hiera('firewall::local_net', false),
- $in_bandwidth = hiera('firewall::in_bandwidth', '1000mbps'),
- $out_bandwidth = hiera('firewall::out_bandwidth', '1000mbps'),
$device_options = hiera('firewall::device_options', 'tcpflags,blacklist,routefilter,nosmurfs,logmartians'),
$vm_address = hiera('firewall::vm_address', '192.168.0.0/24'),
$vm_device = hiera('firewall::vm_device', false)
@@ -67,7 +65,6 @@ class firewall(
}
}
-
shorewall::policy { 'net-all':
sourcezone => 'net',
destinationzone => 'all',
@@ -195,47 +192,6 @@ class firewall(
order => 4,
}
- #
- # Traffic shapping
- #
- shorewall::tcdevices { "${device}":
- in_bandwidth => "$in_bandwidth",
- out_bandwidth => "$out_bandwidth",
- }
-
- shorewall::tcrules { "ssh-tcp":
- order => "1",
- source => "0.0.0.0/0",
- destination => "0.0.0.0/0",
- protocol => "tcp",
- ports => "22",
- }
-
- shorewall::tcrules { "ssh-udp":
- order => "1",
- source => "0.0.0.0/0",
- destination => "0.0.0.0/0",
- protocol => "udp",
- ports => "22",
- }
-
- shorewall::tcclasses { "ssh":
- order => "1",
- interface => "${device}",
- rate => "4*full/100",
- ceil => "full",
- priority => "1",
- }
-
- shorewall::tcclasses { "default":
- order => "2",
- interface => "${device}",
- rate => "6*full/100",
- ceil => "full",
- priority => "2",
- options => "default",
- }
-
if $local_net == true {
class { "firewall::local": }
}
diff --git a/manifests/shaping.pp b/manifests/shaping.pp
new file mode 100644
index 0000000..63bd464
--- /dev/null
+++ b/manifests/shaping.pp
@@ -0,0 +1,46 @@
+class firewall::shaping(
+ $device = hiera('firewall::device', 'eth0'),
+ $in_bandwidth = hiera('firewall::in_bandwidth', '1000mbps'),
+ $out_bandwidth = hiera('firewall::out_bandwidth', '1000mbps')
+) {
+ #
+ # Traffic shaping
+ #
+ shorewall::tcdevices { "${device}":
+ in_bandwidth => "$in_bandwidth",
+ out_bandwidth => "$out_bandwidth",
+ }
+
+ shorewall::tcrules { "ssh-tcp":
+ order => "1",
+ source => "0.0.0.0/0",
+ destination => "0.0.0.0/0",
+ protocol => "tcp",
+ ports => "22",
+ }
+
+ shorewall::tcrules { "ssh-udp":
+ order => "1",
+ source => "0.0.0.0/0",
+ destination => "0.0.0.0/0",
+ protocol => "udp",
+ ports => "22",
+ }
+
+ shorewall::tcclasses { "ssh":
+ order => "1",
+ interface => "${device}",
+ rate => "4*full/100",
+ ceil => "full",
+ priority => "1",
+ }
+
+ shorewall::tcclasses { "default":
+ order => "2",
+ interface => "${device}",
+ rate => "6*full/100",
+ ceil => "full",
+ priority => "2",
+ options => "default",
+ }
+}