summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--manifests/docker.pp28
-rw-r--r--manifests/forwarding.pp8
2 files changed, 36 insertions, 0 deletions
diff --git a/manifests/docker.pp b/manifests/docker.pp
new file mode 100644
index 0000000..7a5fdac
--- /dev/null
+++ b/manifests/docker.pp
@@ -0,0 +1,28 @@
+# See http://serverfault.com/questions/579726/docker-shorewall
+class firewall::docker($device) {
+ class { 'firewall::forwarding': }
+
+ shorewall::masq { "${device}":
+ interface => "${device}",
+ source => '172.17.0.0/16',
+ order => '10',
+ }
+
+ shorewall::zone { 'dock':
+ type => 'ipv4',
+ order => '10',
+ }
+
+ shorewall::policy { 'dock-all':
+ sourcezone => 'dock',
+ destinationzone => 'all',
+ policy => 'ACCEPT',
+ order => 10,
+ }
+
+ shorewall::interface { 'docker0':
+ zone => 'dock',
+ rfc1918 => false,
+ options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+ }
+}
diff --git a/manifests/forwarding.pp b/manifests/forwarding.pp
new file mode 100644
index 0000000..603fcc6
--- /dev/null
+++ b/manifests/forwarding.pp
@@ -0,0 +1,8 @@
+class firewall::forwarding {
+ augeas { 'ip_forwarding':
+ changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING On',
+ lens => 'Shellvars.lns',
+ incl => '/etc/shorewall/shorewall.conf',
+ notify => Service[shorewall];
+ }
+}