diff options
95 files changed, 1955 insertions, 1403 deletions
diff --git a/files/ferm/ferm.conf.tpc b/files/ferm/ferm.conf.tpc new file mode 100644 index 0000000..8a1017e --- /dev/null +++ b/files/ferm/ferm.conf.tpc @@ -0,0 +1,33 @@ +# Firewall configuration for a TPC +# Inspired by http://ferm.foo-projects.org/download/examples/workstation.ferm +# File managed by puppet + +table filter { + chain INPUT { + policy DROP; + + # connection tracking + #mod state state INVALID DROP; + #mod state state (ESTABLISHED RELATED) ACCEPT; + + # allow local connections + interface lo ACCEPT; + + # respond to ping + #proto icmp icmp-type echo-request ACCEPT; + + # allow SSH connections + #proto tcp dport ssh ACCEPT; + + # ident connections are also allowed + #proto tcp dport auth ACCEPT; + + # the rest is dropped by the above policy + } + + # outgoing connections are not limited + chain OUTPUT policy ACCEPT; + + # this is not a router + chain FORWARD policy DROP; +} diff --git a/manifests/docker.pp b/manifests/docker.pp index 5cc1e68..3f96b0e 100644 --- a/manifests/docker.pp +++ b/manifests/docker.pp @@ -1,28 +1,8 @@ -# See http://serverfault.com/questions/579726/docker-shorewall -class firewall::docker($device = 'eth0') { - class { 'firewall::forwarding': } - - shorewall::masq { "${device}-dock": - interface => "${device}", - source => '172.17.0.0/16', - order => '10', - } - - shorewall::zone { 'dock': - type => 'ipv4', - order => '10', - } - - shorewall::policy { 'dock-all': - sourcezone => 'dock', - destinationzone => 'all', - policy => 'ACCEPT', - order => 10, - } - - shorewall::interface { 'docker0': - zone => 'dock', - rfc1918 => false, - options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians', +class firewall::docker( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $device = 'eth0', +) { + class { "firewall::implementations::${implementation}::docker": + device => $device, } } diff --git a/manifests/ferm.pp b/manifests/ferm.pp deleted file mode 100644 index 7dffff3..0000000 --- a/manifests/ferm.pp +++ /dev/null @@ -1,3 +0,0 @@ -class firewall::ferm() { - include ferm -} diff --git a/manifests/forwarding.pp b/manifests/forwarding.pp index 603fcc6..f14fa70 100644 --- a/manifests/forwarding.pp +++ b/manifests/forwarding.pp @@ -1,8 +1,5 @@ -class firewall::forwarding { - augeas { 'ip_forwarding': - changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING On', - lens => 'Shellvars.lns', - incl => '/etc/shorewall/shorewall.conf', - notify => Service[shorewall]; - } +class firewall::forwarding( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::forwarding": } } diff --git a/manifests/implementations/ferm.pp b/manifests/implementations/ferm.pp new file mode 100644 index 0000000..5c4096e --- /dev/null +++ b/manifests/implementations/ferm.pp @@ -0,0 +1,14 @@ +class firewall::implementations::ferm() { + # Currently conflicting with the stdlib and concat module's versions in use + #include ferm + + package { 'ferm': + ensure => installed, + } + + service { 'ferm': + ensure => running, + enable => true, + require => Package['ferm'], + } +} diff --git a/manifests/implementations/ferm/tpc.pp b/manifests/implementations/ferm/tpc.pp new file mode 100644 index 0000000..b36c83f --- /dev/null +++ b/manifests/implementations/ferm/tpc.pp @@ -0,0 +1,36 @@ +# Basic configuration inspired by +# http://ferm.foo-projects.org/download/examples/workstation.ferm +class firewall::implementations::ferm::tpc { + # Currently conflicting with the stdlib and concat module's versions in use + #ferm::rule{ "allow-local-tcp": + # chain => 'INPUT', + # action => 'ACCEPT', + # proto => 'tcp', + # interface => 'lo', + # ensure => 'present', + #} + + # Currently conflicting with the stdlib and concat module's versions in use + #ferm::rule{ "allow-local-udp": + # chain => 'INPUT', + # action => 'ACCEPT', + # proto => 'udp', + # interface => 'lo', + # ensure => 'present', + #} + + file { '/etc/ferm/ferm.conf': + ensure => present, + owner => root, + group => adm, + mode => '0644', + require => Package['ferm'], + notify => Service['ferm'], + source => [ + "puppet:///modules/firewall/ferm/ferm.conf.tpc", + "puppet:///modules/firewall/ferm/ferm.conf.${::hostname}", + "puppet:///modules/site_firewall/ferm/ferm.conf.tpc", + "puppet:///modules/site_firewall/ferm/ferm.conf.${::hostname}", + ], + } +} diff --git a/manifests/implementations/ferm/wifi.pp b/manifests/implementations/ferm/wifi.pp new file mode 100644 index 0000000..fef0f64 --- /dev/null +++ b/manifests/implementations/ferm/wifi.pp @@ -0,0 +1,5 @@ +class firewall::implementations::ferm::wifi( + $shorewall_local_net = false, + $wifi_device = '', +) { +} diff --git a/manifests/shorewall.pp b/manifests/implementations/shorewall.pp index eb56dc0..b26a887 100644 --- a/manifests/shorewall.pp +++ b/manifests/implementations/shorewall.pp @@ -1,4 +1,4 @@ -class firewall::shorewall( +class firewall::implementations::shorewall( $device = lookup('firewall::device', undef, undef, 'eth0'), $zone = lookup('firewall::zone', undef, undef, '-'), $local_net = lookup('firewall::local_net', undef, undef, false), diff --git a/manifests/implementations/shorewall/docker.pp b/manifests/implementations/shorewall/docker.pp new file mode 100644 index 0000000..92a720b --- /dev/null +++ b/manifests/implementations/shorewall/docker.pp @@ -0,0 +1,28 @@ +# See http://serverfault.com/questions/579726/docker-shorewall +class firewall::implementations::shorewall::docker($device = 'eth0') { + class { 'firewall::forwarding': } + + shorewall::masq { "${device}-dock": + interface => "${device}", + source => '172.17.0.0/16', + order => '10', + } + + shorewall::zone { 'dock': + type => 'ipv4', + order => '10', + } + + shorewall::policy { 'dock-all': + sourcezone => 'dock', + destinationzone => 'all', + policy => 'ACCEPT', + order => 10, + } + + shorewall::interface { 'docker0': + zone => 'dock', + rfc1918 => false, + options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians', + } +} diff --git a/manifests/implementations/shorewall/forwarding.pp b/manifests/implementations/shorewall/forwarding.pp new file mode 100644 index 0000000..edc44f3 --- /dev/null +++ b/manifests/implementations/shorewall/forwarding.pp @@ -0,0 +1,8 @@ +class firewall::implementations::shorewall::forwarding { + augeas { 'ip_forwarding': + changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING On', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + } +} diff --git a/manifests/implementations/shorewall/local.pp b/manifests/implementations/shorewall/local.pp new file mode 100644 index 0000000..5a3ab63 --- /dev/null +++ b/manifests/implementations/shorewall/local.pp @@ -0,0 +1,47 @@ +class firewall::implementations::shorewall::local( + $network = lookup('firewall::local::network', undef, undef, '192.168.1.0/24'), + $interface = lookup('firewall::local::interface', undef, undef, 'eth0'), + $manage_host = lookup('firewall::local::manage_host', undef, undef, true), + $manage_interface = lookup('firewall::local::manage_iface', undef, undef, false) +) { + + if $manage_host { + shorewall::host { "$interface-loc": + name => "$interface:$network", + zone => 'loc', + options => '', + order => 3, + } + } + + if $manage_interface { + shorewall::interface { "$interface": + zone => 'loc', + rfc1918 => true, + dhcp => true, + options => 'routeback', + } + } + + shorewall::policy { 'loc-all': + sourcezone => 'loc', + destinationzone => 'all', + policy => 'ACCEPT', + order => 5, + } + + shorewall::policy { 'vm-loc': + sourcezone => 'vm', + destinationzone => 'loc', + policy => 'ACCEPT', + order => 6, + } + + shorewall::policy { 'fw-loc': + sourcezone => '$FW', + destinationzone => 'loc', + policy => 'ACCEPT', + order => 7, + } + +} diff --git a/manifests/implementations/shorewall/mpd.pp b/manifests/implementations/shorewall/mpd.pp new file mode 100644 index 0000000..b3e17eb --- /dev/null +++ b/manifests/implementations/shorewall/mpd.pp @@ -0,0 +1,21 @@ +class firewall::implementations::shorewall::mpd { + # MPD http stream + shorewall::rule { 'mpd-http-stream': + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '8000', + order => 200, + action => 'ACCEPT'; + } + + # MPD client access + shorewall::rule { 'mpd-daemon': + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '6600', + order => 200, + action => 'ACCEPT'; + } +} diff --git a/manifests/implementations/shorewall/nas.pp b/manifests/implementations/shorewall/nas.pp new file mode 100644 index 0000000..4cc8e4f --- /dev/null +++ b/manifests/implementations/shorewall/nas.pp @@ -0,0 +1,196 @@ +class firewall::implementations::shorewall::nas( + $ftp = false, + $tftp = false, + $http = false, + $nfsd = false, + $rsync = false, + $printer = false, + $torrent = false, + $mpd = false, + $samba = false, + $dlna = false, + $daap = false, + $avahi = false +) { + + if $ftp == true { + include shorewall::rules::ftp + } + + if $tftp == true { + include shorewall::rules::tftp + } + + if $http == true { + include shorewall::rules::http + } + + if $nfsd == true { + include shorewall::rules::nfsd + + # Additional ports needed by NFS + # Got using rpcinfo -p and netstat -ap + shorewall::rule { 'nfs-1': + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '35150,43902,46661,46661,46661,50340,54814,57170,58403,59780', + ratelimit => '-', + order => 100, + } + + shorewall::rule { 'nfs-2': + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '938,38511,43195,53081,53081,53081,38521,45238,52664,52400,60331', + ratelimit => '-', + order => 100, + } + } + + if $rsync == true { + include shorewall::rules::rsync + } + + if $printer == true { + include firewall::shorewall::printer + } + + if $torrent == true { + include firewall::shorewall::torrent + } + + if $mpd == true { + include firewall::shorewall::mpd + } + + if $samba == true { + # See http://www.shorewall.net/samba.htm + shorewall::rule { 'samba': + action => 'SMB/ACCEPT', + source => 'net', + destination => '$FW', + proto => '-', + destinationport => '-', + ratelimit => '-', + order => 100, + } + + shorewall::rule { 'netbios-1': + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '137,138,139', + ratelimit => '-', + order => 100, + } + + shorewall::rule { 'netbios-2': + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '137,138,139', + ratelimit => '-', + order => 100, + } + } + + if $dlna == true { + # DLNA + # + # https://wiki.archlinux.org/index.php/MiniDLNA + # http://netpatia.blogspot.co.uk/2011/03/setup-your-own-dlna-server.html + # http://wiki.alpinelinux.org/wiki/IPTV_How_To + # http://mediatomb.cc/dokuwiki/faq:faq + # http://packages.debian.org/wheezy/djmount + # http://packages.debian.org/wheezy/gupnp-tools + # + # Optional: + # + # http://www.shorewall.net/UPnP.html + # + # linux-igd package + # /etc/default/linux-igd + # /etc/upnpd.conf + + shorewall::rule { "dlna-1": + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'tcp,udp', + destinationport => "1900", + ratelimit => '-', + order => 102, + } + + shorewall::rule { "dlna-2": + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'tcp,udp', + destinationport => "8200", + ratelimit => '-', + order => 103, + } + + shorewall::rule { "dlna-3": + action => 'allowinUPnP', + source => 'net', + destination => '$FW', + order => 104, + } + + shorewall::rule { "dlna-4": + action => 'forwardUPnP', + source => 'net', + destination => '$FW', + order => 105, + } + + # Enable multicast + augeas { 'enable_multicast': + changes => 'set /files/etc/shorewall/shorewall.conf/MULTICAST Yes', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + } + } + + if $daap == true { + # DAAP + shorewall::rule { 'daap-1': + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '3689', + order => 300, + action => 'ACCEPT'; + } + + shorewall::rule { 'daap-2': + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '3689', + order => 301, + action => 'ACCEPT'; + } + } + + if $avahi == true { + # Avahi/mDNS + shorewall::rule { 'mdns': + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '5353', + order => 400, + action => 'ACCEPT'; + } + } +} diff --git a/manifests/implementations/shorewall/openvpn.pp b/manifests/implementations/shorewall/openvpn.pp new file mode 100644 index 0000000..c137946 --- /dev/null +++ b/manifests/implementations/shorewall/openvpn.pp @@ -0,0 +1,36 @@ +class firewall::implementations::shorewall::openvpn { + shorewall::zone { 'vpn': + type => 'ipv4', + order => 4, + } + + shorewall::interface { 'tun0': + zone => 'vpn', + } + + shorewall::policy { 'loc-vpn': + sourcezone => 'loc', + destinationzone => 'vpn', + policy => 'ACCEPT', + order => 20, + } + + shorewall::policy { 'vpn-loc': + sourcezone => 'vpn', + destinationzone => 'loc', + policy => 'ACCEPT', + order => 21, + } + + shorewall::policy { 'fw-vpn': + sourcezone => '$FW', + destinationzone => 'vpn', + policy => 'ACCEPT', + order => 22, + } + + shorewall::tunnel { 'openvpn': + tunnel_type => 'openvpnclient', + zone => 'net', + } +} diff --git a/manifests/implementations/shorewall/ppp.pp b/manifests/implementations/shorewall/ppp.pp new file mode 100644 index 0000000..ba32c74 --- /dev/null +++ b/manifests/implementations/shorewall/ppp.pp @@ -0,0 +1,36 @@ +class firewall::implementations::shorewall::ppp( + $interface = 'ppp0', + $zone = 'ppp' +) { + shorewall::interface { $interface: + zone => $zone, + } + + if $zone == 'ppp' { + shorewall::zone { 'ppp': + type => 'ipv4', + order => 4, + } + + shorewall::policy { 'loc-ppp': + sourcezone => 'loc', + destinationzone => $zone, + policy => 'ACCEPT', + order => 30, + } + + shorewall::policy { 'ppp-loc': + sourcezone => 'ppp', + destinationzone => $zone, + policy => 'ACCEPT', + order => 31, + } + + shorewall::policy { 'fw-ppp': + sourcezone => '$FW', + destinationzone => $zone, + policy => 'ACCEPT', + order => 32, + } + } +} diff --git a/manifests/implementations/shorewall/pppoe.pp b/manifests/implementations/shorewall/pppoe.pp new file mode 100644 index 0000000..c07fb9a --- /dev/null +++ b/manifests/implementations/shorewall/pppoe.pp @@ -0,0 +1,26 @@ +class firewall::implementations::shorewall::pppoe( + $packages = false, + $local_dev = false, +) { + # Manage pppoe packages, requires nodo module + if $packages == true { + include nodo::utils::network::pppoe + } + + # Define device in the local zone + if $local_dev == true{ + shorewall::interface { "eth0": + zone => 'loc', + rfc1918 => false, + options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians', + } + } + + # See http://shorewall.net/two-interface.htm + augeas { 'clampmss': + changes => 'set /files/etc/shorewall/shorewall.conf/CLAMPMSS Yes', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + } +} diff --git a/manifests/implementations/shorewall/printer.pp b/manifests/implementations/shorewall/printer.pp new file mode 100644 index 0000000..a094d69 --- /dev/null +++ b/manifests/implementations/shorewall/printer.pp @@ -0,0 +1,21 @@ +class firewall::implementations::shorewall::printer { + shorewall::rule { "cups-tcp": + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => "631", + ratelimit => '-', + order => 200, + } + + shorewall::rule { "cups-udp": + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => "631", + ratelimit => '-', + order => 201, + } +} diff --git a/manifests/implementations/shorewall/redirect.pp b/manifests/implementations/shorewall/redirect.pp new file mode 100644 index 0000000..b494e08 --- /dev/null +++ b/manifests/implementations/shorewall/redirect.pp @@ -0,0 +1,16 @@ +class firewall::implementations::shorewall::redirect::ssh($destinationport) { + # When the box is in an internal network and we want to provide + # and external access through a shared real IP, we have to + # redirect requests coming from another port to port 22. + $ip = lookup('firewall::external_ip', undef, undef, $::ipaddress) + + shorewall::rule { "ssh-redirect-1": + action => 'DNAT', + source => 'net', + destination => "fw:$ip:22", + proto => 'tcp', + destinationport => $destinationport, + ratelimit => '-', + order => $destinationport, + } +} diff --git a/manifests/implementations/shorewall/router/gitd.pp b/manifests/implementations/shorewall/router/gitd.pp new file mode 100644 index 0000000..34ef1d7 --- /dev/null +++ b/manifests/implementations/shorewall/router/gitd.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::router::gitd($destination, $zone = 'loc', $originaldest = $ipaddress) { + shorewall::rule { 'git-daemon-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9418", + proto => 'tcp', + destinationport => '9418', + ratelimit => '-', + order => 800, + } + + shorewall::rule { 'git-daemon-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9418", + proto => 'tcp', + destinationport => '9418', + originaldest => "$originaldest", + ratelimit => '-', + order => 801, + } +} diff --git a/manifests/implementations/shorewall/router/gobby.pp b/manifests/implementations/shorewall/router/gobby.pp new file mode 100644 index 0000000..8c41e29 --- /dev/null +++ b/manifests/implementations/shorewall/router/gobby.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::router::gobby($destination, $zone = 'loc', $originaldest = $ipaddress) { + shorewall::rule { 'gobby-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:6523", + proto => 'tcp', + destinationport => '6523', + ratelimit => '-', + order => 600, + } + + shorewall::rule { 'gobby-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:6523", + proto => 'tcp', + destinationport => '6523', + originaldest => "$originaldest", + ratelimit => '-', + order => 601, + } +} diff --git a/manifests/implementations/shorewall/router/hairpinning.pp b/manifests/implementations/shorewall/router/hairpinning.pp new file mode 100644 index 0000000..21a8d9d --- /dev/null +++ b/manifests/implementations/shorewall/router/hairpinning.pp @@ -0,0 +1,29 @@ +# See http://www.shorewall.net/FAQ.htm#faq2 +define firewall::router::hairpinning($order = '5000', $proto = 'tcp', $port = 'www', + $external_ip = '$ETH0_IP', $interface = 'eth1', + $destination = '192.168.1.100', $source = 'eth1', + $source_zone = 'loc', $dest_zone = 'loc', + $port_dest = '') { + shorewall::masq { "routeback-$name": + interface => "$interface:$destination", + source => $source, + address => $external_ip, + proto => $proto, + port => $port, + order => $order, + } + + shorewall::rule { "routeback-$name": + action => 'DNAT', + source => $source_zone, + destination => $port_dest ? { + '' => "$dest_zone:$destination", + default => "$dest_zone:$destination:$port_dest", + }, + proto => $proto, + destinationport => $port, + ratelimit => '-', + order => $order, + originaldest => $external_ip, + } +} diff --git a/manifests/implementations/shorewall/router/http.pp b/manifests/implementations/shorewall/router/http.pp new file mode 100644 index 0000000..9766bb1 --- /dev/null +++ b/manifests/implementations/shorewall/router/http.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::router::http($destination, $zone = 'loc', $originaldest = $ipaddress) { + shorewall::rule { 'http-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:80", + proto => 'tcp', + destinationport => '80', + ratelimit => '-', + order => 600, + } + + shorewall::rule { 'http-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:80", + proto => 'tcp', + destinationport => '80', + originaldest => "$originaldest", + ratelimit => '-', + order => 601, + } +} diff --git a/manifests/implementations/shorewall/router/https.pp b/manifests/implementations/shorewall/router/https.pp new file mode 100644 index 0000000..b937fa1 --- /dev/null +++ b/manifests/implementations/shorewall/router/https.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::router::https($destination, $zone = 'loc', $originaldest = $ipaddress) { + shorewall::rule { 'https-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:443", + proto => 'tcp', + destinationport => '443', + ratelimit => '-', + order => 602, + } + + shorewall::rule { 'https-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:443", + proto => 'tcp', + destinationport => '443', + originaldest => "$originaldest", + ratelimit => '-', + order => 602, + } +} diff --git a/manifests/implementations/shorewall/router/icecast.pp b/manifests/implementations/shorewall/router/icecast.pp new file mode 100644 index 0000000..43c25e7 --- /dev/null +++ b/manifests/implementations/shorewall/router/icecast.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::router::icecast($destination, $zone = 'loc', $originaldest = $ipaddress) { + shorewall::rule { 'icecast-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + ratelimit => '-', + order => 900, + } + + shorewall::rule { 'icecast-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + originaldest => "$originaldest", + ratelimit => '-', + order => 901, + } +} diff --git a/manifests/implementations/shorewall/router/mail.pp b/manifests/implementations/shorewall/router/mail.pp new file mode 100644 index 0000000..840311d --- /dev/null +++ b/manifests/implementations/shorewall/router/mail.pp @@ -0,0 +1,64 @@ +class firewall::implementations::shorewall::router::mail($destination, $zone = 'loc', $originaldest = $ipaddress) { + shorewall::rule { 'mail-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:25", + proto => 'tcp', + destinationport => '25', + ratelimit => '-', + order => 1000, + } + + shorewall::rule { 'mail-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:25", + proto => 'tcp', + destinationport => '25', + originaldest => "$originaldest", + ratelimit => '-', + order => 1001, + } + + shorewall::rule { 'mail-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:993", + proto => 'tcp', + destinationport => '993', + ratelimit => '-', + order => 1002, + } + + shorewall::rule { 'mail-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:993", + proto => 'tcp', + destinationport => '993', + originaldest => "$originaldest", + ratelimit => '-', + order => 1003, + } + + shorewall::rule { 'mail-5': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:587", + proto => 'tcp', + destinationport => '587', + ratelimit => '-', + order => 1004, + } + + shorewall::rule { 'mail-6': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:587", + proto => 'tcp', + destinationport => '587', + originaldest => "$originaldest", + ratelimit => '-', + order => 1005, + } +} diff --git a/manifests/implementations/shorewall/router/mumble.pp b/manifests/implementations/shorewall/router/mumble.pp new file mode 100644 index 0000000..63f5635 --- /dev/null +++ b/manifests/implementations/shorewall/router/mumble.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::router::mumble($destination, $zone = 'loc', $originaldest = $::ipaddress) { + shorewall::rule { 'mumble-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:64738", + proto => 'tcp', + destinationport => '64738', + ratelimit => '-', + order => 2300, + } + + shorewall::rule { 'mumble-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:64738", + proto => 'udp', + destinationport => '64738', + originaldest => "$originaldest", + ratelimit => '-', + order => 2301, + } +} diff --git a/manifests/implementations/shorewall/router/munin.pp b/manifests/implementations/shorewall/router/munin.pp new file mode 100644 index 0000000..7ca136d --- /dev/null +++ b/manifests/implementations/shorewall/router/munin.pp @@ -0,0 +1,29 @@ +define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc', + $order = '400', $originaldest = $ipaddress) { + shorewall::rule { "munin-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => $order, + } + + shorewall::rule { "munin-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => "$originaldest", + ratelimit => '-', + order => $order, + } +} diff --git a/manifests/implementations/shorewall/router/rsync.pp b/manifests/implementations/shorewall/router/rsync.pp new file mode 100644 index 0000000..1488fa9 --- /dev/null +++ b/manifests/implementations/shorewall/router/rsync.pp @@ -0,0 +1,29 @@ +class firewall::implementations::shorewall::router::rsync($destination, $port_orig = '873', $port_dest = '', $zone = 'loc', + $originaldest = $ipaddress) { + shorewall::rule { "rsync-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => "26$port_orig", + } + + shorewall::rule { "rsync-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => "$originaldest", + ratelimit => '-', + order => "26$port_orig", + } +} diff --git a/manifests/implementations/shorewall/router/ssh.pp b/manifests/implementations/shorewall/router/ssh.pp new file mode 100644 index 0000000..a37b61f --- /dev/null +++ b/manifests/implementations/shorewall/router/ssh.pp @@ -0,0 +1,29 @@ +define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc', + $originaldest = $ipaddress) { + shorewall::rule { "ssh-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => "2$port_orig", + } + + shorewall::rule { "ssh-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => "$originaldest", + ratelimit => '-', + order => "2$port_orig", + } +} diff --git a/manifests/implementations/shorewall/router/tor.pp b/manifests/implementations/shorewall/router/tor.pp new file mode 100644 index 0000000..cf5cc58 --- /dev/null +++ b/manifests/implementations/shorewall/router/tor.pp @@ -0,0 +1,85 @@ +define firewall::router::tor($destination, $zone = 'loc', $originaldest = $ipaddress) { + shorewall::rule { "tor-$name-1": + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9000", + proto => 'tcp', + destinationport => "9000", + ratelimit => '-', + order => "29000", + } + + shorewall::rule { "tor-$name-2": + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9000", + proto => 'tcp', + destinationport => "9000", + originaldest => "$originaldest", + ratelimit => '-', + order => "29000", + } + + shorewall::rule { "tor-$name-3": + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => "9001", + ratelimit => '-', + order => "29001", + } + + shorewall::rule { "tor-$name-4": + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => "9001", + originaldest => "$originaldest", + ratelimit => '-', + order => "29001", + } + + shorewall::rule { "tor-$name-5": + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9100", + proto => 'tcp', + destinationport => "9100", + ratelimit => '-', + order => "29100", + } + + shorewall::rule { "tor-$name-6": + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9100", + proto => 'tcp', + destinationport => "9100", + originaldest => "$originaldest", + ratelimit => '-', + order => "29100", + } + + shorewall::rule { "tor-$name-7": + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9101", + proto => 'tcp', + destinationport => "9101", + ratelimit => '-', + order => "29101", + } + + shorewall::rule { "tor-$name-8": + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9101", + proto => 'tcp', + destinationport => "9101", + originaldest => "$originaldest", + ratelimit => '-', + order => "29101", + } +} diff --git a/manifests/implementations/shorewall/router/torrent.pp b/manifests/implementations/shorewall/router/torrent.pp new file mode 100644 index 0000000..7ca7e1e --- /dev/null +++ b/manifests/implementations/shorewall/router/torrent.pp @@ -0,0 +1,48 @@ +class firewall::implementations::shorewall::router::torrent( + $destination, + $zone = 'loc', + $originaldest = $ipaddress, + $range = lookup('firewall::torrent::range', undef, undef, '6881:6999') +) { + shorewall::rule { "torrent-tcp-1": + action => 'DNAT', + source => 'net', + destination => "$zone:$destination", + proto => 'tcp', + destinationport => "$range", + ratelimit => '-', + order => 200, + } + + shorewall::rule { "torrent-tcp-2": + action => 'DNAT', + source => 'all', + destination => "$zone:$destination", + proto => 'tcp', + destinationport => "$range", + originaldest => "$originaldest", + ratelimit => '-', + order => 200, + } + + shorewall::rule { "torrent-udp-1": + action => 'DNAT', + source => 'net', + destination => "$zone:$destination", + proto => 'udp', + destinationport => "$range", + ratelimit => '-', + order => 201, + } + + shorewall::rule { "torrent-udp-2": + action => 'DNAT', + source => 'all', + destination => "$zone:$destination", + proto => 'udp', + destinationport => "6881:6999", + originaldest => "$originaldest", + ratelimit => '-', + order => 201, + } +} diff --git a/manifests/implementations/shorewall/shaping.pp b/manifests/implementations/shorewall/shaping.pp new file mode 100644 index 0000000..fd86b6e --- /dev/null +++ b/manifests/implementations/shorewall/shaping.pp @@ -0,0 +1,46 @@ +class firewall::implementations::shorewall::shaping( + $device = lookup('firewall::device', undef, undef, 'eth0'), + $in_bandwidth = lookup('firewall::in_bandwidth', undef, undef, '1000mbps'), + $out_bandwidth = lookup('firewall::out_bandwidth', undef, undef, '1000mbps') +) { + # + # Traffic shaping + # + shorewall::tcdevices { "${device}": + in_bandwidth => "$in_bandwidth", + out_bandwidth => "$out_bandwidth", + } + + shorewall::tcrules { "ssh-tcp": + order => "1", + source => "0.0.0.0/0", + destination => "0.0.0.0/0", + protocol => "tcp", + ports => "22", + } + + shorewall::tcrules { "ssh-udp": + order => "1", + source => "0.0.0.0/0", + destination => "0.0.0.0/0", + protocol => "udp", + ports => "22", + } + + shorewall::tcclasses { "ssh": + order => "1", + interface => "${device}", + rate => "4*full/100", + ceil => "full", + priority => "1", + } + + shorewall::tcclasses { "default": + order => "2", + interface => "${device}", + rate => "6*full/100", + ceil => "full", + priority => "2", + options => "default", + } +} diff --git a/manifests/implementations/shorewall/torrent.pp b/manifests/implementations/shorewall/torrent.pp new file mode 100644 index 0000000..4463aab --- /dev/null +++ b/manifests/implementations/shorewall/torrent.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::torrent( + $range = lookup('firewall::torrent::range', undef, undef, '6881:6999') +) { + shorewall::rule { "torrent-tcp": + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => "$range", + ratelimit => '-', + order => 200, + } + + shorewall::rule { "torrent-udp": + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => "$range", + ratelimit => '-', + order => 201, + } +} diff --git a/manifests/implementations/shorewall/tpc.pp b/manifests/implementations/shorewall/tpc.pp new file mode 100644 index 0000000..db7a75d --- /dev/null +++ b/manifests/implementations/shorewall/tpc.pp @@ -0,0 +1,2 @@ +class firewall::implementations::shorewall::tpc { +} diff --git a/manifests/implementations/shorewall/ups.pp b/manifests/implementations/shorewall/ups.pp new file mode 100644 index 0000000..caff195 --- /dev/null +++ b/manifests/implementations/shorewall/ups.pp @@ -0,0 +1,11 @@ +class firewall::implementations::shorewall::ups { + shorewall::rule { "ups": + action => 'ACCEPT', + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => "3551", + ratelimit => '-', + order => 200, + } +} diff --git a/manifests/implementations/shorewall/virtual/dns.pp b/manifests/implementations/shorewall/virtual/dns.pp new file mode 100644 index 0000000..51f9f3f --- /dev/null +++ b/manifests/implementations/shorewall/virtual/dns.pp @@ -0,0 +1,53 @@ +class firewall::implementations::shorewall::virtual::dns($destination, $zone = 'vm') { + shorewall::rule { 'dns-route-0': + action => 'DNS/ACCEPT', + source => 'net', + destination => '$FW', + proto => '-', + destinationport => '-', + ratelimit => '-', + order => 2000, + } + + shorewall::rule { 'dns-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'tcp', + destinationport => '53', + ratelimit => '-', + order => 2001, + } + + shorewall::rule { 'dns-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'tcp', + destinationport => '53', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2002, + } + + shorewall::rule { 'dns-route-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'udp', + destinationport => '53', + ratelimit => '-', + order => 2003, + } + + shorewall::rule { 'dns-route-4': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'udp', + destinationport => '53', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2004, + } +} diff --git a/manifests/implementations/shorewall/virtual/gitd.pp b/manifests/implementations/shorewall/virtual/gitd.pp new file mode 100644 index 0000000..2464fee --- /dev/null +++ b/manifests/implementations/shorewall/virtual/gitd.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::gitd($destination) { + shorewall::rule { 'git-daemon-1': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:9418", + proto => 'tcp', + destinationport => '9418', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 800, + } + + shorewall::rule { 'git-daemon-2': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:9418", + proto => 'tcp', + destinationport => '9418', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 801, + } +} diff --git a/manifests/implementations/shorewall/virtual/gobby.pp b/manifests/implementations/shorewall/virtual/gobby.pp new file mode 100644 index 0000000..671d5e5 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/gobby.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::gobby($destination) { + shorewall::rule { 'gobby-0': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:6523", + proto => 'tcp', + destinationport => '6523', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2400, + } + + shorewall::rule { 'gobby-1': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:6523", + proto => 'tcp', + destinationport => '6523', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2400, + } +} diff --git a/manifests/implementations/shorewall/virtual/http.pp b/manifests/implementations/shorewall/virtual/http.pp new file mode 100644 index 0000000..0095a3e --- /dev/null +++ b/manifests/implementations/shorewall/virtual/http.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::http($destination) { + shorewall::rule { 'http-route-1': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:80", + proto => 'tcp', + destinationport => '80', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 600, + } + + shorewall::rule { 'http-route-2': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:80", + proto => 'tcp', + destinationport => '80', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 601, + } +} diff --git a/manifests/implementations/shorewall/virtual/https.pp b/manifests/implementations/shorewall/virtual/https.pp new file mode 100644 index 0000000..f278e90 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/https.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::https($destination) { + shorewall::rule { 'https-route-1': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:443", + proto => 'tcp', + destinationport => '443', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 602, + } + + shorewall::rule { 'https-route-2': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:443", + proto => 'tcp', + destinationport => '443', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 602, + } +} diff --git a/manifests/implementations/shorewall/virtual/icecast.pp b/manifests/implementations/shorewall/virtual/icecast.pp new file mode 100644 index 0000000..c7bb0cc --- /dev/null +++ b/manifests/implementations/shorewall/virtual/icecast.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::virtual::icecast($destination, $zone = 'fw') { + shorewall::rule { 'icecast-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + ratelimit => '-', + order => 900, + } + + shorewall::rule { 'icecast-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 901, + } +} diff --git a/manifests/implementations/shorewall/virtual/jabber.pp b/manifests/implementations/shorewall/virtual/jabber.pp new file mode 100644 index 0000000..14a111e --- /dev/null +++ b/manifests/implementations/shorewall/virtual/jabber.pp @@ -0,0 +1,54 @@ +class firewall::implementations::shorewall::virtual::jabber($destination, $zone = 'fw') { + shorewall::rule { 'jabber-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5222", + proto => 'tcp', + destinationport => '5222', + ratelimit => '-', + order => 2200, + } + + shorewall::rule { 'jabber-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:5223", + proto => 'tcp', + destinationport => '5223', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2201, + } + + shorewall::rule { 'jabber-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5269", + proto => 'tcp', + destinationport => '5269', + ratelimit => '-', + order => 2202, + } + + shorewall::rule { 'jabber-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4369", + proto => 'tcp', + destinationport => '4369', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2203, + } + + shorewall::rule { 'jabber-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4370", + proto => 'tcp', + destinationport => '4370:4375', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2204, + } +} diff --git a/manifests/implementations/shorewall/virtual/mail.pp b/manifests/implementations/shorewall/virtual/mail.pp new file mode 100644 index 0000000..4eaa07a --- /dev/null +++ b/manifests/implementations/shorewall/virtual/mail.pp @@ -0,0 +1,67 @@ +class firewall::implementations::shorewall::virtual::mail($destination) { + shorewall::rule { 'mail-1': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:25", + proto => 'tcp', + destinationport => '25', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 1000, + } + + shorewall::rule { 'mail-2': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:25", + proto => 'tcp', + destinationport => '25', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 1001, + } + + shorewall::rule { 'mail-3': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:993", + proto => 'tcp', + destinationport => '993', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1002, + } + + shorewall::rule { 'mail-4': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:993", + proto => 'tcp', + destinationport => '993', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1003, + } + + shorewall::rule { 'mail-5': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:587", + proto => 'tcp', + destinationport => '587', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1004, + } + + shorewall::rule { 'mail-6': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:587", + proto => 'tcp', + destinationport => '587', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1005, + } +} diff --git a/manifests/implementations/shorewall/virtual/mdns.pp b/manifests/implementations/shorewall/virtual/mdns.pp new file mode 100644 index 0000000..b41e414 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/mdns.pp @@ -0,0 +1,11 @@ +class firewall::implementations::shorewall::virtual::mdns($destination, $zone = 'fw') { + shorewall::rule { 'mdns-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5353", + proto => 'tcp', + destinationport => '5353', + ratelimit => '-', + order => 2700, + } +} diff --git a/manifests/implementations/shorewall/virtual/mumble.pp b/manifests/implementations/shorewall/virtual/mumble.pp new file mode 100644 index 0000000..d90ec30 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/mumble.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::virtual::mumble($destination, $zone = 'fw') { + shorewall::rule { 'mumble-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:64738", + proto => 'tcp', + destinationport => '64738', + ratelimit => '-', + order => 2300, + } + + shorewall::rule { 'mumble-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:64738", + proto => 'udp', + destinationport => '64738', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2301, + } +} diff --git a/manifests/implementations/shorewall/virtual/munin.pp b/manifests/implementations/shorewall/virtual/munin.pp new file mode 100644 index 0000000..79514c6 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/munin.pp @@ -0,0 +1,28 @@ +define firewall::virtual::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') { + shorewall::rule { "munin-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => $order, + } + + shorewall::rule { "munin-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => $order, + } +} diff --git a/manifests/implementations/shorewall/virtual/rsync.pp b/manifests/implementations/shorewall/virtual/rsync.pp new file mode 100644 index 0000000..357e937 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/rsync.pp @@ -0,0 +1,11 @@ +class firewall::implementations::shorewall::virtual::rsync($destination, $zone = 'fw') { + shorewall::rule { 'rsync-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:873", + proto => 'tcp', + destinationport => '873', + ratelimit => '-', + order => 2600, + } +} diff --git a/manifests/implementations/shorewall/virtual/ssh.pp b/manifests/implementations/shorewall/virtual/ssh.pp new file mode 100644 index 0000000..7ad93fc --- /dev/null +++ b/manifests/implementations/shorewall/virtual/ssh.pp @@ -0,0 +1,28 @@ +define firewall::virtual::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') { + shorewall::rule { "ssh-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => "2$port_orig", + } + + shorewall::rule { "ssh-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "fw:$destination", + default => "fw:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => "2$port_orig", + } +} diff --git a/manifests/implementations/shorewall/virtual/tor.pp b/manifests/implementations/shorewall/virtual/tor.pp new file mode 100644 index 0000000..2e96cbe --- /dev/null +++ b/manifests/implementations/shorewall/virtual/tor.pp @@ -0,0 +1,85 @@ +class firewall::implementations::shorewall::virtual::tor($destination, $zone = 'vm') { + shorewall::rule { 'tor-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9000", + proto => 'tcp', + destinationport => '9000', + ratelimit => '-', + order => 2100, + } + + shorewall::rule { 'tor-1': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9000", + proto => 'tcp', + destinationport => '9000', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2101, + } + + shorewall::rule { 'tor-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => '9001', + ratelimit => '-', + order => 2102, + } + + shorewall::rule { 'tor-3': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9001", + proto => 'tcp', + destinationport => '9001', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2103, + } + + shorewall::rule { 'tor-4': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9100", + proto => 'tcp', + destinationport => '9100', + ratelimit => '-', + order => 2104, + } + + shorewall::rule { 'tor-5': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9100", + proto => 'tcp', + destinationport => '9100', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2105, + } + + shorewall::rule { 'tor-6': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9101", + proto => 'tcp', + destinationport => '9101', + ratelimit => '-', + order => 2106, + } + + shorewall::rule { 'tor-7': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9101", + proto => 'tcp', + destinationport => '9101', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2107, + } +} diff --git a/manifests/implementations/shorewall/virtual/web.pp b/manifests/implementations/shorewall/virtual/web.pp new file mode 100644 index 0000000..06bf993 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/web.pp @@ -0,0 +1,14 @@ +define firewall::virtual::web( + $destination +) { + shorewall::rule { "web-route-${name}-1": + action => 'DNAT', + source => 'vm', + destination => "fw:${destination}:80", + proto => 'tcp', + destinationport => '80', + originaldest => $destination, + ratelimit => '-', + order => 600, + } +} diff --git a/manifests/implementations/shorewall/virtual/yacy.pp b/manifests/implementations/shorewall/virtual/yacy.pp new file mode 100644 index 0000000..0a791f9 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/yacy.pp @@ -0,0 +1,11 @@ +class firewall::implementations::shorewall::virtual::yacy($destination, $zone = 'fw') { + shorewall::rule { 'yacy-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8090", + proto => 'tcp', + destinationport => '8090', + ratelimit => '-', + order => 2500, + } +} diff --git a/manifests/implementations/shorewall/wifi.pp b/manifests/implementations/shorewall/wifi.pp new file mode 100644 index 0000000..d7bcf9a --- /dev/null +++ b/manifests/implementations/shorewall/wifi.pp @@ -0,0 +1,53 @@ +class firewall::implementations::shorewall::wifi ( + $shorewall_local_net = false, + $wifi_device = '', +) { + $rfc1918 = $shorewall_local_net ? { + true => true, + false => false, + default => false, + } + + # Default device depends if madwifi or + # built-in kernel driver is being used + $wifi_default_device = $lsbdistcodename ? { + 'lenny' => 'ath0', + default => 'wlan0', + } + + $wifi_dev = $wifi_device ? { + '' => $wifi_default_device, + default => $wifi_device, + } + + # + # Interfaces + # + shorewall::interface { "$wifi_dev": + zone => '-', + rfc1918 => $rfc1918, + } + + # + # Hosts + # + shorewall::host { "$wifi_dev-subnet": + name => "$wifi_dev:192.168.0.0/24", + zone => 'vm', + options => '', + order => 1, + } + + shorewall::host { "$wifi_dev": + name => "$wifi_dev:0.0.0.0/0", + zone => 'net', + options => '', + order => 2, + } + + shorewall::masq { "$wifi_dev": + interface => "$wifi_dev:!192.168.0.0/24", + source => '192.168.0.0/24', + order => 1, + } +} diff --git a/manifests/init.pp b/manifests/init.pp index fced69a..7a55a23 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -2,5 +2,5 @@ class firewall( $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), ) { - class { "firewall::${implementation}": } + class { "firewall::implementations::${implementation}": } } diff --git a/manifests/local.pp b/manifests/local.pp index a44b9b8..7f0faf4 100644 --- a/manifests/local.pp +++ b/manifests/local.pp @@ -1,47 +1,15 @@ class firewall::local( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), $network = lookup('firewall::local::network', undef, undef, '192.168.1.0/24'), $interface = lookup('firewall::local::interface', undef, undef, 'eth0'), $manage_host = lookup('firewall::local::manage_host', undef, undef, true), $manage_interface = lookup('firewall::local::manage_iface', undef, undef, false) ) { - if $manage_host { - shorewall::host { "$interface-loc": - name => "$interface:$network", - zone => 'loc', - options => '', - order => 3, - } + class { "firewall::implementations::${implementation}::local": + network => $network, + interface => $interface, + manage_host => $manage_host, + manage_interface => $manage_interface, } - - if $manage_interface { - shorewall::interface { "$interface": - zone => 'loc', - rfc1918 => true, - dhcp => true, - options => 'routeback', - } - } - - shorewall::policy { 'loc-all': - sourcezone => 'loc', - destinationzone => 'all', - policy => 'ACCEPT', - order => 5, - } - - shorewall::policy { 'vm-loc': - sourcezone => 'vm', - destinationzone => 'loc', - policy => 'ACCEPT', - order => 6, - } - - shorewall::policy { 'fw-loc': - sourcezone => '$FW', - destinationzone => 'loc', - policy => 'ACCEPT', - order => 7, - } - } diff --git a/manifests/mpd.pp b/manifests/mpd.pp index 5724952..8e61440 100644 --- a/manifests/mpd.pp +++ b/manifests/mpd.pp @@ -1,21 +1,5 @@ -class firewall::mpd { - # MPD http stream - shorewall::rule { 'mpd-http-stream': - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '8000', - order => 200, - action => 'ACCEPT'; - } - - # MPD client access - shorewall::rule { 'mpd-daemon': - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '6600', - order => 200, - action => 'ACCEPT'; - } +class firewall::mpd( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::mpd": } } diff --git a/manifests/nas.pp b/manifests/nas.pp index 8857cad..94b4470 100644 --- a/manifests/nas.pp +++ b/manifests/nas.pp @@ -1,196 +1,31 @@ class firewall::nas( - $ftp = false, - $tftp = false, - $http = false, - $nfsd = false, - $rsync = false, - $printer = false, - $torrent = false, - $mpd = false, - $samba = false, - $dlna = false, - $daap = false, - $avahi = false + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $ftp = false, + $tftp = false, + $http = false, + $nfsd = false, + $rsync = false, + $printer = false, + $torrent = false, + $mpd = false, + $samba = false, + $dlna = false, + $daap = false, + $avahi = false ) { - if $ftp == true { - include shorewall::rules::ftp - } - - if $tftp == true { - include shorewall::rules::tftp - } - - if $http == true { - include shorewall::rules::http - } - - if $nfsd == true { - include shorewall::rules::nfsd - - # Additional ports needed by NFS - # Got using rpcinfo -p and netstat -ap - shorewall::rule { 'nfs-1': - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '35150,43902,46661,46661,46661,50340,54814,57170,58403,59780', - ratelimit => '-', - order => 100, - } - - shorewall::rule { 'nfs-2': - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => '938,38511,43195,53081,53081,53081,38521,45238,52664,52400,60331', - ratelimit => '-', - order => 100, - } - } - - if $rsync == true { - include shorewall::rules::rsync - } - - if $printer == true { - include firewall::printer - } - - if $torrent == true { - include firewall::torrent - } - - if $mpd == true { - include firewall::mpd - } - - if $samba == true { - # See http://www.shorewall.net/samba.htm - shorewall::rule { 'samba': - action => 'SMB/ACCEPT', - source => 'net', - destination => '$FW', - proto => '-', - destinationport => '-', - ratelimit => '-', - order => 100, - } - - shorewall::rule { 'netbios-1': - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '137,138,139', - ratelimit => '-', - order => 100, - } - - shorewall::rule { 'netbios-2': - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => '137,138,139', - ratelimit => '-', - order => 100, - } - } - - if $dlna == true { - # DLNA - # - # https://wiki.archlinux.org/index.php/MiniDLNA - # http://netpatia.blogspot.co.uk/2011/03/setup-your-own-dlna-server.html - # http://wiki.alpinelinux.org/wiki/IPTV_How_To - # http://mediatomb.cc/dokuwiki/faq:faq - # http://packages.debian.org/wheezy/djmount - # http://packages.debian.org/wheezy/gupnp-tools - # - # Optional: - # - # http://www.shorewall.net/UPnP.html - # - # linux-igd package - # /etc/default/linux-igd - # /etc/upnpd.conf - - shorewall::rule { "dlna-1": - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'tcp,udp', - destinationport => "1900", - ratelimit => '-', - order => 102, - } - - shorewall::rule { "dlna-2": - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'tcp,udp', - destinationport => "8200", - ratelimit => '-', - order => 103, - } - - shorewall::rule { "dlna-3": - action => 'allowinUPnP', - source => 'net', - destination => '$FW', - order => 104, - } - - shorewall::rule { "dlna-4": - action => 'forwardUPnP', - source => 'net', - destination => '$FW', - order => 105, - } - - # Enable multicast - augeas { 'enable_multicast': - changes => 'set /files/etc/shorewall/shorewall.conf/MULTICAST Yes', - lens => 'Shellvars.lns', - incl => '/etc/shorewall/shorewall.conf', - notify => Service[shorewall]; - } - } - - if $daap == true { - # DAAP - shorewall::rule { 'daap-1': - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '3689', - order => 300, - action => 'ACCEPT'; - } - - shorewall::rule { 'daap-2': - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => '3689', - order => 301, - action => 'ACCEPT'; - } - } - - if $avahi == true { - # Avahi/mDNS - shorewall::rule { 'mdns': - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => '5353', - order => 400, - action => 'ACCEPT'; - } + class { "firewall::implementations::${implementation}::nas": + ftp => $ftp, + tftp => $tftp, + http => $http, + nfsd => $nfsd, + rsync => $rsync, + printer => $printer, + torrent => $torrent, + mpd => $mpd, + samba => $samba, + dlna => $dlna, + daap => $daap, + avahi => $avahi, } } diff --git a/manifests/openvpn.pp b/manifests/openvpn.pp index 2d3e6d1..a65390c 100644 --- a/manifests/openvpn.pp +++ b/manifests/openvpn.pp @@ -1,36 +1,5 @@ -class firewall::openvpn { - shorewall::zone { 'vpn': - type => 'ipv4', - order => 4, - } - - shorewall::interface { 'tun0': - zone => 'vpn', - } - - shorewall::policy { 'loc-vpn': - sourcezone => 'loc', - destinationzone => 'vpn', - policy => 'ACCEPT', - order => 20, - } - - shorewall::policy { 'vpn-loc': - sourcezone => 'vpn', - destinationzone => 'loc', - policy => 'ACCEPT', - order => 21, - } - - shorewall::policy { 'fw-vpn': - sourcezone => '$FW', - destinationzone => 'vpn', - policy => 'ACCEPT', - order => 22, - } - - shorewall::tunnel { 'openvpn': - tunnel_type => 'openvpnclient', - zone => 'net', - } +class firewall::openvpn( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::openvpn": } } diff --git a/manifests/ppp.pp b/manifests/ppp.pp index e9ce789..33972e3 100644 --- a/manifests/ppp.pp +++ b/manifests/ppp.pp @@ -1,36 +1,10 @@ class firewall::ppp( - $interface = 'ppp0', - $zone = 'ppp' + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $interface = 'ppp0', + $zone = 'ppp' ) { - shorewall::interface { $interface: - zone => $zone, - } - - if $zone == 'ppp' { - shorewall::zone { 'ppp': - type => 'ipv4', - order => 4, - } - - shorewall::policy { 'loc-ppp': - sourcezone => 'loc', - destinationzone => $zone, - policy => 'ACCEPT', - order => 30, - } - - shorewall::policy { 'ppp-loc': - sourcezone => 'ppp', - destinationzone => $zone, - policy => 'ACCEPT', - order => 31, - } - - shorewall::policy { 'fw-ppp': - sourcezone => '$FW', - destinationzone => $zone, - policy => 'ACCEPT', - order => 32, - } + class { "firewall::implementations::${implementation}::ppp": + interface => $interface, + zone => $zone, } } diff --git a/manifests/pppoe.pp b/manifests/pppoe.pp index a771d48..93db814 100644 --- a/manifests/pppoe.pp +++ b/manifests/pppoe.pp @@ -1,26 +1,10 @@ class firewall::pppoe( - $packages = false, - $local_dev = false, + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $packages = false, + $local_dev = false, ) { - # Manage pppoe packages, requires nodo module - if $packages == true { - include nodo::utils::network::pppoe - } - - # Define device in the local zone - if $local_dev == true{ - shorewall::interface { "eth0": - zone => 'loc', - rfc1918 => false, - options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians', - } - } - - # See http://shorewall.net/two-interface.htm - augeas { 'clampmss': - changes => 'set /files/etc/shorewall/shorewall.conf/CLAMPMSS Yes', - lens => 'Shellvars.lns', - incl => '/etc/shorewall/shorewall.conf', - notify => Service[shorewall]; + class { "firewall::implementations::${implementation}::pppoe": + packages => $packages, + local_dev => $local_dev, } } diff --git a/manifests/printer.pp b/manifests/printer.pp index b44f65a..87a5942 100644 --- a/manifests/printer.pp +++ b/manifests/printer.pp @@ -1,21 +1,5 @@ -class firewall::printer { - shorewall::rule { "cups-tcp": - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => "631", - ratelimit => '-', - order => 200, - } - - shorewall::rule { "cups-udp": - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => "631", - ratelimit => '-', - order => 201, - } +class firewall::printer( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::printer": } } diff --git a/manifests/redirect.pp b/manifests/redirect.pp index dee9a98..de50f86 100644 --- a/manifests/redirect.pp +++ b/manifests/redirect.pp @@ -1,16 +1,8 @@ -class firewall::redirect::ssh($destinationport) { - # When the box is in an internal network and we want to provide - # and external access through a shared real IP, we have to - # redirect requests coming from another port to port 22. - $ip = lookup('firewall::external_ip', undef, undef, $::ipaddress) - - shorewall::rule { "ssh-redirect-1": - action => 'DNAT', - source => 'net', - destination => "fw:$ip:22", - proto => 'tcp', - destinationport => $destinationport, - ratelimit => '-', - order => $destinationport, +class firewall::redirect::ssh( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destinationport, +) { + class { "firewall::implementations::${implementation}::redirect::ssh": + destinationport = $destinationport, } } diff --git a/manifests/router/gitd.pp b/manifests/router/gitd.pp index ee54cea..f866c75 100644 --- a/manifests/router/gitd.pp +++ b/manifests/router/gitd.pp @@ -1,22 +1,10 @@ -class firewall::router::gitd($destination, $zone = 'loc', $originaldest = $ipaddress) { - shorewall::rule { 'git-daemon-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9418", - proto => 'tcp', - destinationport => '9418', - ratelimit => '-', - order => 800, - } - - shorewall::rule { 'git-daemon-2': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9418", - proto => 'tcp', - destinationport => '9418', - originaldest => "$originaldest", - ratelimit => '-', - order => 801, +class firewall::router::gitd( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $ipaddress, +) { + class { "firewall::implementations::${implementation}::router::gitd": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/gobby.pp b/manifests/router/gobby.pp index 3d648ef..9e1932f 100644 --- a/manifests/router/gobby.pp +++ b/manifests/router/gobby.pp @@ -1,22 +1,10 @@ -class firewall::router::gobby($destination, $zone = 'loc', $originaldest = $ipaddress) { - shorewall::rule { 'gobby-route-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:6523", - proto => 'tcp', - destinationport => '6523', - ratelimit => '-', - order => 600, - } - - shorewall::rule { 'gobby-route-2': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:6523", - proto => 'tcp', - destinationport => '6523', - originaldest => "$originaldest", - ratelimit => '-', - order => 601, +class firewall::router::gobby( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $ipaddress +) { + class { "firewall::implementations::${implementation}::router::gobby": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/hairpinning.pp b/manifests/router/hairpinning.pp index 21a8d9d..96fac1e 100644 --- a/manifests/router/hairpinning.pp +++ b/manifests/router/hairpinning.pp @@ -1,29 +1,27 @@ # See http://www.shorewall.net/FAQ.htm#faq2 -define firewall::router::hairpinning($order = '5000', $proto = 'tcp', $port = 'www', - $external_ip = '$ETH0_IP', $interface = 'eth1', - $destination = '192.168.1.100', $source = 'eth1', - $source_zone = 'loc', $dest_zone = 'loc', - $port_dest = '') { - shorewall::masq { "routeback-$name": - interface => "$interface:$destination", - source => $source, - address => $external_ip, - proto => $proto, - port => $port, - order => $order, - } - - shorewall::rule { "routeback-$name": - action => 'DNAT', - source => $source_zone, - destination => $port_dest ? { - '' => "$dest_zone:$destination", - default => "$dest_zone:$destination:$port_dest", - }, - proto => $proto, - destinationport => $port, - ratelimit => '-', - order => $order, - originaldest => $external_ip, +define firewall::router::hairpinning( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $order = '5000', + $proto = 'tcp', + $port = 'www', + $external_ip = '$ETH0_IP', + $interface = 'eth1', + $destination = '192.168.1.100', + $source = 'eth1', + $source_zone = 'loc', + $dest_zone = 'loc', + $port_dest = '' +) { + class { "firewall::implementations::${implementation}::router::hairpinning": + order => $order, + proto => $proto, + port => $port, + external_ip => $external_ip, + interface => $interface, + destination => $destination, + source => $source, + source_zone => $source_zone, + dest_zone => $dest_zone, + port_dest => $port_dest, } } diff --git a/manifests/router/http.pp b/manifests/router/http.pp index 8833116..6b4eb90 100644 --- a/manifests/router/http.pp +++ b/manifests/router/http.pp @@ -1,22 +1,10 @@ -class firewall::router::http($destination, $zone = 'loc', $originaldest = $ipaddress) { - shorewall::rule { 'http-route-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:80", - proto => 'tcp', - destinationport => '80', - ratelimit => '-', - order => 600, - } - - shorewall::rule { 'http-route-2': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:80", - proto => 'tcp', - destinationport => '80', - originaldest => "$originaldest", - ratelimit => '-', - order => 601, +class firewall::router::http( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $ipaddress +) { + class { "firewall::implementations::${implementation}::router::http": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/https.pp b/manifests/router/https.pp index 064c694..d683761 100644 --- a/manifests/router/https.pp +++ b/manifests/router/https.pp @@ -1,22 +1,10 @@ -class firewall::router::https($destination, $zone = 'loc', $originaldest = $ipaddress) { - shorewall::rule { 'https-route-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:443", - proto => 'tcp', - destinationport => '443', - ratelimit => '-', - order => 602, - } - - shorewall::rule { 'https-route-2': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:443", - proto => 'tcp', - destinationport => '443', - originaldest => "$originaldest", - ratelimit => '-', - order => 602, +class firewall::router::https( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $ipaddress +) { + class { "firewall::implementations::${implementation}::router::https": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/icecast.pp b/manifests/router/icecast.pp index cb98e6a..b0c01b9 100644 --- a/manifests/router/icecast.pp +++ b/manifests/router/icecast.pp @@ -1,22 +1,10 @@ -class firewall::router::icecast($destination, $zone = 'loc', $originaldest = $ipaddress) { - shorewall::rule { 'icecast-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:8000", - proto => 'tcp', - destinationport => '8000', - ratelimit => '-', - order => 900, - } - - shorewall::rule { 'icecast-2': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:8000", - proto => 'tcp', - destinationport => '8000', - originaldest => "$originaldest", - ratelimit => '-', - order => 901, +class firewall::router::icecast( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $ipaddress +) { + class { "firewall::implementations::${implementation}::router::icecast": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/mail.pp b/manifests/router/mail.pp index 403579d..5efde58 100644 --- a/manifests/router/mail.pp +++ b/manifests/router/mail.pp @@ -1,64 +1,10 @@ -class firewall::router::mail($destination, $zone = 'loc', $originaldest = $ipaddress) { - shorewall::rule { 'mail-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:25", - proto => 'tcp', - destinationport => '25', - ratelimit => '-', - order => 1000, - } - - shorewall::rule { 'mail-2': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:25", - proto => 'tcp', - destinationport => '25', - originaldest => "$originaldest", - ratelimit => '-', - order => 1001, - } - - shorewall::rule { 'mail-3': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:993", - proto => 'tcp', - destinationport => '993', - ratelimit => '-', - order => 1002, - } - - shorewall::rule { 'mail-4': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:993", - proto => 'tcp', - destinationport => '993', - originaldest => "$originaldest", - ratelimit => '-', - order => 1003, - } - - shorewall::rule { 'mail-5': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:587", - proto => 'tcp', - destinationport => '587', - ratelimit => '-', - order => 1004, - } - - shorewall::rule { 'mail-6': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:587", - proto => 'tcp', - destinationport => '587', - originaldest => "$originaldest", - ratelimit => '-', - order => 1005, +class firewall::router::mail(i + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $ipaddress +) { + class { "firewall::implementations::${implementation}::router::mail": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/mumble.pp b/manifests/router/mumble.pp index 6c96976..1f1a85c 100644 --- a/manifests/router/mumble.pp +++ b/manifests/router/mumble.pp @@ -1,22 +1,10 @@ -class firewall::router::mumble($destination, $zone = 'loc', $originaldest = $::ipaddress) { - shorewall::rule { 'mumble-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:64738", - proto => 'tcp', - destinationport => '64738', - ratelimit => '-', - order => 2300, - } - - shorewall::rule { 'mumble-1': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:64738", - proto => 'udp', - destinationport => '64738', - originaldest => "$originaldest", - ratelimit => '-', - order => 2301, +class firewall::router::mumble( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $::ipaddress +) { + class { "firewall::implementations::${implementation}::router::mumble": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/munin.pp b/manifests/router/munin.pp index 7ca136d..4fd33fd 100644 --- a/manifests/router/munin.pp +++ b/manifests/router/munin.pp @@ -1,29 +1,18 @@ -define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc', - $order = '400', $originaldest = $ipaddress) { - shorewall::rule { "munin-$name-1": - action => 'DNAT', - source => 'net', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - ratelimit => '-', - order => $order, - } - - shorewall::rule { "munin-$name-2": - action => 'DNAT', - source => '$FW', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - originaldest => "$originaldest", - ratelimit => '-', - order => $order, +define firewall::router::munin( + $destination, + $port_orig, + $port_dest = '', + $zone = 'loc', + $order = '400', + $originaldest = $ipaddress + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::router::munin": + destination => $destination, + port_orig => $port_orig, + port_dest => $port_dest, + zone => $zone, + order => $order, + originaldest => $originaldest, } } diff --git a/manifests/router/rsync.pp b/manifests/router/rsync.pp index 71faf86..9e36f85 100644 --- a/manifests/router/rsync.pp +++ b/manifests/router/rsync.pp @@ -1,29 +1,17 @@ -class firewall::router::rsync($destination, $port_orig = '873', $port_dest = '', $zone = 'loc', - $originaldest = $ipaddress) { - shorewall::rule { "rsync-$name-1": - action => 'DNAT', - source => 'net', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - ratelimit => '-', - order => "26$port_orig", - } - - shorewall::rule { "rsync-$name-2": - action => 'DNAT', - source => '$FW', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - originaldest => "$originaldest", - ratelimit => '-', - order => "26$port_orig", +class firewall::router::rsync( + $destination, + $port_orig = '873', + $port_dest = '', + $zone = 'loc', + $originaldest = $ipaddress + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::router::rsync": + destination => $destination, + port_orig => $port_orig, + port_dest => $port_dest, + zone => $zone, + order => $order, + originaldest => $originaldest, } } diff --git a/manifests/router/ssh.pp b/manifests/router/ssh.pp index a37b61f..6f1a640 100644 --- a/manifests/router/ssh.pp +++ b/manifests/router/ssh.pp @@ -1,29 +1,17 @@ -define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc', - $originaldest = $ipaddress) { - shorewall::rule { "ssh-$name-1": - action => 'DNAT', - source => 'net', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - ratelimit => '-', - order => "2$port_orig", - } - - shorewall::rule { "ssh-$name-2": - action => 'DNAT', - source => '$FW', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - originaldest => "$originaldest", - ratelimit => '-', - order => "2$port_orig", +define firewall::router::ssh( + $destination, + $port_orig = '22', + $port_dest = '', + $zone = 'loc', + $originaldest = $ipaddress, + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::router::ssh": + destination => $destination, + port_orig => $port_orig, + port_dest => $port_dest, + zone => $zone, + order => $order, + originaldest => $originaldest, } } diff --git a/manifests/router/tor.pp b/manifests/router/tor.pp index cf5cc58..b93ea05 100644 --- a/manifests/router/tor.pp +++ b/manifests/router/tor.pp @@ -1,85 +1,10 @@ -define firewall::router::tor($destination, $zone = 'loc', $originaldest = $ipaddress) { - shorewall::rule { "tor-$name-1": - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9000", - proto => 'tcp', - destinationport => "9000", - ratelimit => '-', - order => "29000", - } - - shorewall::rule { "tor-$name-2": - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9000", - proto => 'tcp', - destinationport => "9000", - originaldest => "$originaldest", - ratelimit => '-', - order => "29000", - } - - shorewall::rule { "tor-$name-3": - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9001", - proto => 'tcp', - destinationport => "9001", - ratelimit => '-', - order => "29001", - } - - shorewall::rule { "tor-$name-4": - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9001", - proto => 'tcp', - destinationport => "9001", - originaldest => "$originaldest", - ratelimit => '-', - order => "29001", - } - - shorewall::rule { "tor-$name-5": - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9100", - proto => 'tcp', - destinationport => "9100", - ratelimit => '-', - order => "29100", - } - - shorewall::rule { "tor-$name-6": - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9100", - proto => 'tcp', - destinationport => "9100", - originaldest => "$originaldest", - ratelimit => '-', - order => "29100", - } - - shorewall::rule { "tor-$name-7": - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9101", - proto => 'tcp', - destinationport => "9101", - ratelimit => '-', - order => "29101", - } - - shorewall::rule { "tor-$name-8": - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9101", - proto => 'tcp', - destinationport => "9101", - originaldest => "$originaldest", - ratelimit => '-', - order => "29101", +define firewall::router::tor( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'loc', $originaldest = $ipaddress +) { + class { "firewall::implementations::${implementation}::router::tor": + destination => $destination, + zone => $zone, + originaldest => $originaldest, } } diff --git a/manifests/router/torrent.pp b/manifests/router/torrent.pp index 08f4c7e..b5ac97d 100644 --- a/manifests/router/torrent.pp +++ b/manifests/router/torrent.pp @@ -1,48 +1,14 @@ class firewall::router::torrent( $destination, - $zone = 'loc', - $originaldest = $ipaddress, - $range = lookup('firewall::torrent::range', undef, undef, '6881:6999') + $zone = 'loc', + $originaldest = $ipaddress, + $range = lookup('firewall::torrent::range', undef, undef, '6881:6999') + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), ) { - shorewall::rule { "torrent-tcp-1": - action => 'DNAT', - source => 'net', - destination => "$zone:$destination", - proto => 'tcp', - destinationport => "$range", - ratelimit => '-', - order => 200, - } - - shorewall::rule { "torrent-tcp-2": - action => 'DNAT', - source => 'all', - destination => "$zone:$destination", - proto => 'tcp', - destinationport => "$range", - originaldest => "$originaldest", - ratelimit => '-', - order => 200, - } - - shorewall::rule { "torrent-udp-1": - action => 'DNAT', - source => 'net', - destination => "$zone:$destination", - proto => 'udp', - destinationport => "$range", - ratelimit => '-', - order => 201, - } - - shorewall::rule { "torrent-udp-2": - action => 'DNAT', - source => 'all', - destination => "$zone:$destination", - proto => 'udp', - destinationport => "6881:6999", - originaldest => "$originaldest", - ratelimit => '-', - order => 201, + class { "firewall::implementations::${implementation}::router::torrent": + destination => $destination, + zone => $zone, + originaldest => $originaldest, + range => $range, } } diff --git a/manifests/shaping.pp b/manifests/shaping.pp index 277f82c..83558e9 100644 --- a/manifests/shaping.pp +++ b/manifests/shaping.pp @@ -1,46 +1,12 @@ class firewall::shaping( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), $device = lookup('firewall::device', undef, undef, 'eth0'), $in_bandwidth = lookup('firewall::in_bandwidth', undef, undef, '1000mbps'), $out_bandwidth = lookup('firewall::out_bandwidth', undef, undef, '1000mbps') ) { - # - # Traffic shaping - # - shorewall::tcdevices { "${device}": - in_bandwidth => "$in_bandwidth", - out_bandwidth => "$out_bandwidth", - } - - shorewall::tcrules { "ssh-tcp": - order => "1", - source => "0.0.0.0/0", - destination => "0.0.0.0/0", - protocol => "tcp", - ports => "22", - } - - shorewall::tcrules { "ssh-udp": - order => "1", - source => "0.0.0.0/0", - destination => "0.0.0.0/0", - protocol => "udp", - ports => "22", - } - - shorewall::tcclasses { "ssh": - order => "1", - interface => "${device}", - rate => "4*full/100", - ceil => "full", - priority => "1", - } - - shorewall::tcclasses { "default": - order => "2", - interface => "${device}", - rate => "6*full/100", - ceil => "full", - priority => "2", - options => "default", + class { "firewall::implementations::${implementation}::shaping": + device => $device, + in_bandwidth => $in_bandwidth, + out_bandwidth => $out_bandwidth, } } diff --git a/manifests/torrent.pp b/manifests/torrent.pp index bc3a914..bee024b 100644 --- a/manifests/torrent.pp +++ b/manifests/torrent.pp @@ -1,23 +1,8 @@ class firewall::torrent( - $range = lookup('firewall::torrent::range', undef, undef, '6881:6999') + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $range = lookup('firewall::torrent::range', undef, undef, '6881:6999') ) { - shorewall::rule { "torrent-tcp": - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => "$range", - ratelimit => '-', - order => 200, - } - - shorewall::rule { "torrent-udp": - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => "$range", - ratelimit => '-', - order => 201, + class { "firewall::implementations::${implementation}::torrent": + range => $range, } } diff --git a/manifests/tpc.pp b/manifests/tpc.pp new file mode 100644 index 0000000..f648de4 --- /dev/null +++ b/manifests/tpc.pp @@ -0,0 +1,5 @@ +class firewall::tpc( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::tpc": } +} diff --git a/manifests/ups.pp b/manifests/ups.pp index 042fcdc..8822cd4 100644 --- a/manifests/ups.pp +++ b/manifests/ups.pp @@ -1,11 +1,5 @@ -class firewall::ups { - shorewall::rule { "ups": - action => 'ACCEPT', - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => "3551", - ratelimit => '-', - order => 200, - } +class firewall::ups( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::ups": } } diff --git a/manifests/virtual/dns.pp b/manifests/virtual/dns.pp index 1bf3872..8ae02ae 100644 --- a/manifests/virtual/dns.pp +++ b/manifests/virtual/dns.pp @@ -1,53 +1,9 @@ -class firewall::virtual::dns($destination, $zone = 'vm') { - shorewall::rule { 'dns-route-0': - action => 'DNS/ACCEPT', - source => 'net', - destination => '$FW', - proto => '-', - destinationport => '-', - ratelimit => '-', - order => 2000, - } - - shorewall::rule { 'dns-route-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:53", - proto => 'tcp', - destinationport => '53', - ratelimit => '-', - order => 2001, - } - - shorewall::rule { 'dns-route-2': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:53", - proto => 'tcp', - destinationport => '53', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2002, - } - - shorewall::rule { 'dns-route-3': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:53", - proto => 'udp', - destinationport => '53', - ratelimit => '-', - order => 2003, - } - - shorewall::rule { 'dns-route-4': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:53", - proto => 'udp', - destinationport => '53', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2004, +class firewall::virtual::dns( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'vm' +) { + class { "firewall::implementations::${implementation}::virtual::dns": + destination => $destination, + zone => $zone, } } diff --git a/manifests/virtual/gitd.pp b/manifests/virtual/gitd.pp index b760f03..aedca34 100644 --- a/manifests/virtual/gitd.pp +++ b/manifests/virtual/gitd.pp @@ -1,23 +1,8 @@ -class firewall::virtual::gitd($destination) { - shorewall::rule { 'git-daemon-1': - action => 'DNAT', - source => 'net', - destination => "vm:$destination:9418", - proto => 'tcp', - destinationport => '9418', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 800, - } - - shorewall::rule { 'git-daemon-2': - action => 'DNAT', - source => 'vm', - destination => "fw:$destination:9418", - proto => 'tcp', - destinationport => '9418', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 801, +class firewall::virtual::gitd( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination +) { + class { "firewall::implementations::${implementation}::virtual::gitd": + destination => $destination, } } diff --git a/manifests/virtual/gobby.pp b/manifests/virtual/gobby.pp index cc2c9fe..a05f154 100644 --- a/manifests/virtual/gobby.pp +++ b/manifests/virtual/gobby.pp @@ -1,23 +1,8 @@ -class firewall::virtual::gobby($destination) { - shorewall::rule { 'gobby-0': - action => 'DNAT', - source => 'vm', - destination => "fw:$destination:6523", - proto => 'tcp', - destinationport => '6523', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2400, - } - - shorewall::rule { 'gobby-1': - action => 'DNAT', - source => 'net', - destination => "vm:$destination:6523", - proto => 'tcp', - destinationport => '6523', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2400, +class firewall::virtual::gobby( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination +) { + class { "firewall::implementations::${implementation}::virtual::gobby": + destination => $destination, } } diff --git a/manifests/virtual/http.pp b/manifests/virtual/http.pp index bb8e232..3050eb3 100644 --- a/manifests/virtual/http.pp +++ b/manifests/virtual/http.pp @@ -1,23 +1,8 @@ -class firewall::virtual::http($destination) { - shorewall::rule { 'http-route-1': - action => 'DNAT', - source => 'vm', - destination => "fw:$destination:80", - proto => 'tcp', - destinationport => '80', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 600, - } - - shorewall::rule { 'http-route-2': - action => 'DNAT', - source => 'net', - destination => "vm:$destination:80", - proto => 'tcp', - destinationport => '80', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 601, +class firewall::virtual::http( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination +) { + class { "firewall::implementations::${implementation}::virtual::http": + destination => $destination, } } diff --git a/manifests/virtual/https.pp b/manifests/virtual/https.pp index 70a10a4..c93dc01 100644 --- a/manifests/virtual/https.pp +++ b/manifests/virtual/https.pp @@ -1,23 +1,8 @@ -class firewall::virtual::https($destination) { - shorewall::rule { 'https-route-1': - action => 'DNAT', - source => 'vm', - destination => "fw:$destination:443", - proto => 'tcp', - destinationport => '443', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), - order => 602, - } - - shorewall::rule { 'https-route-2': - action => 'DNAT', - source => 'net', - destination => "vm:$destination:443", - proto => 'tcp', - destinationport => '443', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), - order => 602, +class firewall::virtual::https( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination +) { + class { "firewall::implementations::${implementation}::virtual::https": + destination => $destination, } } diff --git a/manifests/virtual/icecast.pp b/manifests/virtual/icecast.pp index 3c392b6..684ce42 100644 --- a/manifests/virtual/icecast.pp +++ b/manifests/virtual/icecast.pp @@ -1,22 +1,9 @@ -class firewall::virtual::icecast($destination, $zone = 'fw') { - shorewall::rule { 'icecast-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:8000", - proto => 'tcp', - destinationport => '8000', - ratelimit => '-', - order => 900, - } - - shorewall::rule { 'icecast-2': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:8000", - proto => 'tcp', - destinationport => '8000', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 901, +class firewall::virtual::icecast( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'fw' +) { + class { "firewall::implementations::${implementation}::virtual::icecast": + destination => $destination, + zone => $zone, } } diff --git a/manifests/virtual/jabber.pp b/manifests/virtual/jabber.pp index 703b9a9..7666f22 100644 --- a/manifests/virtual/jabber.pp +++ b/manifests/virtual/jabber.pp @@ -1,54 +1,9 @@ -class firewall::virtual::jabber($destination, $zone = 'fw') { - shorewall::rule { 'jabber-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:5222", - proto => 'tcp', - destinationport => '5222', - ratelimit => '-', - order => 2200, - } - - shorewall::rule { 'jabber-1': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:5223", - proto => 'tcp', - destinationport => '5223', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2201, - } - - shorewall::rule { 'jabber-2': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:5269", - proto => 'tcp', - destinationport => '5269', - ratelimit => '-', - order => 2202, - } - - shorewall::rule { 'jabber-3': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:4369", - proto => 'tcp', - destinationport => '4369', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2203, - } - - shorewall::rule { 'jabber-4': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:4370", - proto => 'tcp', - destinationport => '4370:4375', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2204, +class firewall::virtual::jabber( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'fw' +) { + class { "firewall::implementations::${implementation}::virtual::jabber": + destination => $destination, + zone => $zone, } } diff --git a/manifests/virtual/mail.pp b/manifests/virtual/mail.pp index c16f898..2bf9635 100644 --- a/manifests/virtual/mail.pp +++ b/manifests/virtual/mail.pp @@ -1,67 +1,8 @@ -class firewall::virtual::mail($destination) { - shorewall::rule { 'mail-1': - action => 'DNAT', - source => 'vm', - destination => "fw:$destination:25", - proto => 'tcp', - destinationport => '25', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 1000, - } - - shorewall::rule { 'mail-2': - action => 'DNAT', - source => 'net', - destination => "vm:$destination:25", - proto => 'tcp', - destinationport => '25', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 1001, - } - - shorewall::rule { 'mail-3': - action => 'DNAT', - source => 'vm', - destination => "fw:$destination:993", - proto => 'tcp', - destinationport => '993', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), - order => 1002, - } - - shorewall::rule { 'mail-4': - action => 'DNAT', - source => 'net', - destination => "vm:$destination:993", - proto => 'tcp', - destinationport => '993', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), - order => 1003, - } - - shorewall::rule { 'mail-5': - action => 'DNAT', - source => 'vm', - destination => "fw:$destination:587", - proto => 'tcp', - destinationport => '587', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), - order => 1004, - } - - shorewall::rule { 'mail-6': - action => 'DNAT', - source => 'net', - destination => "vm:$destination:587", - proto => 'tcp', - destinationport => '587', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), - order => 1005, +class firewall::virtual::mail( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination +) { + class { "firewall::implementations::${implementation}::virtual::mail": + destination => $destination, } } diff --git a/manifests/virtual/mdns.pp b/manifests/virtual/mdns.pp index db8ec25..559a00b 100644 --- a/manifests/virtual/mdns.pp +++ b/manifests/virtual/mdns.pp @@ -1,11 +1,9 @@ -class firewall::virtual::mdns($destination, $zone = 'fw') { - shorewall::rule { 'mdns-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:5353", - proto => 'tcp', - destinationport => '5353', - ratelimit => '-', - order => 2700, +class firewall::virtual::mdns( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'fw' +) { + class { "firewall::implementations::${implementation}::virtual::mdns": + destination => $destination, + zone => $zone, } } diff --git a/manifests/virtual/mumble.pp b/manifests/virtual/mumble.pp index b523dca..a091363 100644 --- a/manifests/virtual/mumble.pp +++ b/manifests/virtual/mumble.pp @@ -1,22 +1,9 @@ -class firewall::virtual::mumble($destination, $zone = 'fw') { - shorewall::rule { 'mumble-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:64738", - proto => 'tcp', - destinationport => '64738', - ratelimit => '-', - order => 2300, - } - - shorewall::rule { 'mumble-1': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:64738", - proto => 'udp', - destinationport => '64738', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2301, +class firewall::virtual::mumble( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'fw' +) { + class { "firewall::implementations::${implementation}::virtual::mumble": + destination => $destination, + zone => $zone, } } diff --git a/manifests/virtual/munin.pp b/manifests/virtual/munin.pp index 79514c6..531acd9 100644 --- a/manifests/virtual/munin.pp +++ b/manifests/virtual/munin.pp @@ -1,28 +1,16 @@ -define firewall::virtual::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') { - shorewall::rule { "munin-$name-1": - action => 'DNAT', - source => 'net', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - ratelimit => '-', - order => $order, - } - - shorewall::rule { "munin-$name-2": - action => 'DNAT', - source => '$FW', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => $order, +define firewall::virtual::munin( + $destination, + $port_orig, + $port_dest = '', + $order = '400', + $zone = 'fw' + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::virtual::munin": + destination => $destination, + port_orig => $port_orig, + port_dest => $port_dest, + order => $order, + zone => $zone, } } diff --git a/manifests/virtual/rsync.pp b/manifests/virtual/rsync.pp index 50df46c..79a8d83 100644 --- a/manifests/virtual/rsync.pp +++ b/manifests/virtual/rsync.pp @@ -1,11 +1,9 @@ -class firewall::virtual::rsync($destination, $zone = 'fw') { - shorewall::rule { 'rsync-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:873", - proto => 'tcp', - destinationport => '873', - ratelimit => '-', - order => 2600, +class firewall::virtual::rsync( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'fw' +) { + class { "firewall::implementations::${implementation}::virtual::rsync": + destination => $destination, + zone => $zone, } } diff --git a/manifests/virtual/ssh.pp b/manifests/virtual/ssh.pp index 7ad93fc..0a11fa2 100644 --- a/manifests/virtual/ssh.pp +++ b/manifests/virtual/ssh.pp @@ -1,28 +1,14 @@ -define firewall::virtual::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') { - shorewall::rule { "ssh-$name-1": - action => 'DNAT', - source => 'net', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - ratelimit => '-', - order => "2$port_orig", - } - - shorewall::rule { "ssh-$name-2": - action => 'DNAT', - source => '$FW', - destination => $port_dest ? { - '' => "fw:$destination", - default => "fw:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => "2$port_orig", +define firewall::virtual::ssh( + $destination, + $port_orig = '22', + $port_dest = '', + $zone = 'vm' + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), +) { + class { "firewall::implementations::${implementation}::virtual::ssh": + destination => $destination, + port_orig => $port_orig, + port_dest => $port_dest, + zone => $zone, } } diff --git a/manifests/virtual/tor.pp b/manifests/virtual/tor.pp index 7cca6d6..2b83151 100644 --- a/manifests/virtual/tor.pp +++ b/manifests/virtual/tor.pp @@ -1,85 +1,9 @@ -class firewall::virtual::tor($destination, $zone = 'vm') { - shorewall::rule { 'tor-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9000", - proto => 'tcp', - destinationport => '9000', - ratelimit => '-', - order => 2100, - } - - shorewall::rule { 'tor-1': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:9000", - proto => 'tcp', - destinationport => '9000', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2101, - } - - shorewall::rule { 'tor-2': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9001", - proto => 'tcp', - destinationport => '9001', - ratelimit => '-', - order => 2102, - } - - shorewall::rule { 'tor-3': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:9001", - proto => 'tcp', - destinationport => '9001', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2103, - } - - shorewall::rule { 'tor-4': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9100", - proto => 'tcp', - destinationport => '9100', - ratelimit => '-', - order => 2104, - } - - shorewall::rule { 'tor-5': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:9100", - proto => 'tcp', - destinationport => '9100', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2105, - } - - shorewall::rule { 'tor-6': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9101", - proto => 'tcp', - destinationport => '9101', - ratelimit => '-', - order => 2106, - } - - shorewall::rule { 'tor-7': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:9101", - proto => 'tcp', - destinationport => '9101', - originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), - ratelimit => '-', - order => 2107, +class firewall::virtual::tor( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'vm' +) { + class { "firewall::implementations::${implementation}::virtual::tor": + destination => $destination, + zone => $zone, } } diff --git a/manifests/virtual/web.pp b/manifests/virtual/web.pp index 06bf993..c54a95b 100644 --- a/manifests/virtual/web.pp +++ b/manifests/virtual/web.pp @@ -1,14 +1,8 @@ define firewall::virtual::web( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), $destination ) { - shorewall::rule { "web-route-${name}-1": - action => 'DNAT', - source => 'vm', - destination => "fw:${destination}:80", - proto => 'tcp', - destinationport => '80', - originaldest => $destination, - ratelimit => '-', - order => 600, + class { "firewall::implementations::${implementation}::virtual::web": + destination => $destination, } } diff --git a/manifests/virtual/yacy.pp b/manifests/virtual/yacy.pp index 173ba13..fcc6b1d 100644 --- a/manifests/virtual/yacy.pp +++ b/manifests/virtual/yacy.pp @@ -1,11 +1,9 @@ -class firewall::virtual::yacy($destination, $zone = 'fw') { - shorewall::rule { 'yacy-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:8090", - proto => 'tcp', - destinationport => '8090', - ratelimit => '-', - order => 2500, +class firewall::virtual::yacy( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), + $destination, $zone = 'fw' +) { + class { "firewall::implementations::${implementation}::virtual::yacy": + destination => $destination, + zone => $zone, } } diff --git a/manifests/wifi.pp b/manifests/wifi.pp index a93ca6a..92415ac 100644 --- a/manifests/wifi.pp +++ b/manifests/wifi.pp @@ -1,53 +1,10 @@ class firewall::wifi ( + $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'), $shorewall_local_net = false, $wifi_device = '', ) { - $rfc1918 = $shorewall_local_net ? { - true => true, - false => false, - default => false, - } - - # Default device depends if madwifi or - # built-in kernel driver is being used - $wifi_default_device = $lsbdistcodename ? { - 'lenny' => 'ath0', - default => 'wlan0', - } - - $wifi_dev = $wifi_device ? { - '' => $wifi_default_device, - default => $wifi_device, - } - - # - # Interfaces - # - shorewall::interface { "$wifi_dev": - zone => '-', - rfc1918 => $rfc1918, - } - - # - # Hosts - # - shorewall::host { "$wifi_dev-subnet": - name => "$wifi_dev:192.168.0.0/24", - zone => 'vm', - options => '', - order => 1, - } - - shorewall::host { "$wifi_dev": - name => "$wifi_dev:0.0.0.0/0", - zone => 'net', - options => '', - order => 2, - } - - shorewall::masq { "$wifi_dev": - interface => "$wifi_dev:!192.168.0.0/24", - source => '192.168.0.0/24', - order => 1, + class { "firewall::implementations::${implementation}::wifi": + shorewall_local_net => $shorewall_local_net, + wifi_device => $wifi_device, } } |