diff options
Diffstat (limited to 'manifests/implementations/shorewall/virtual')
16 files changed, 498 insertions, 0 deletions
diff --git a/manifests/implementations/shorewall/virtual/dns.pp b/manifests/implementations/shorewall/virtual/dns.pp new file mode 100644 index 0000000..51f9f3f --- /dev/null +++ b/manifests/implementations/shorewall/virtual/dns.pp @@ -0,0 +1,53 @@ +class firewall::implementations::shorewall::virtual::dns($destination, $zone = 'vm') { + shorewall::rule { 'dns-route-0': + action => 'DNS/ACCEPT', + source => 'net', + destination => '$FW', + proto => '-', + destinationport => '-', + ratelimit => '-', + order => 2000, + } + + shorewall::rule { 'dns-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'tcp', + destinationport => '53', + ratelimit => '-', + order => 2001, + } + + shorewall::rule { 'dns-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'tcp', + destinationport => '53', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2002, + } + + shorewall::rule { 'dns-route-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'udp', + destinationport => '53', + ratelimit => '-', + order => 2003, + } + + shorewall::rule { 'dns-route-4': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'udp', + destinationport => '53', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2004, + } +} diff --git a/manifests/implementations/shorewall/virtual/gitd.pp b/manifests/implementations/shorewall/virtual/gitd.pp new file mode 100644 index 0000000..2464fee --- /dev/null +++ b/manifests/implementations/shorewall/virtual/gitd.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::gitd($destination) { + shorewall::rule { 'git-daemon-1': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:9418", + proto => 'tcp', + destinationport => '9418', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 800, + } + + shorewall::rule { 'git-daemon-2': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:9418", + proto => 'tcp', + destinationport => '9418', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 801, + } +} diff --git a/manifests/implementations/shorewall/virtual/gobby.pp b/manifests/implementations/shorewall/virtual/gobby.pp new file mode 100644 index 0000000..671d5e5 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/gobby.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::gobby($destination) { + shorewall::rule { 'gobby-0': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:6523", + proto => 'tcp', + destinationport => '6523', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2400, + } + + shorewall::rule { 'gobby-1': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:6523", + proto => 'tcp', + destinationport => '6523', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2400, + } +} diff --git a/manifests/implementations/shorewall/virtual/http.pp b/manifests/implementations/shorewall/virtual/http.pp new file mode 100644 index 0000000..0095a3e --- /dev/null +++ b/manifests/implementations/shorewall/virtual/http.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::http($destination) { + shorewall::rule { 'http-route-1': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:80", + proto => 'tcp', + destinationport => '80', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 600, + } + + shorewall::rule { 'http-route-2': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:80", + proto => 'tcp', + destinationport => '80', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 601, + } +} diff --git a/manifests/implementations/shorewall/virtual/https.pp b/manifests/implementations/shorewall/virtual/https.pp new file mode 100644 index 0000000..f278e90 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/https.pp @@ -0,0 +1,23 @@ +class firewall::implementations::shorewall::virtual::https($destination) { + shorewall::rule { 'https-route-1': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:443", + proto => 'tcp', + destinationport => '443', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 602, + } + + shorewall::rule { 'https-route-2': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:443", + proto => 'tcp', + destinationport => '443', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 602, + } +} diff --git a/manifests/implementations/shorewall/virtual/icecast.pp b/manifests/implementations/shorewall/virtual/icecast.pp new file mode 100644 index 0000000..c7bb0cc --- /dev/null +++ b/manifests/implementations/shorewall/virtual/icecast.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::virtual::icecast($destination, $zone = 'fw') { + shorewall::rule { 'icecast-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + ratelimit => '-', + order => 900, + } + + shorewall::rule { 'icecast-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 901, + } +} diff --git a/manifests/implementations/shorewall/virtual/jabber.pp b/manifests/implementations/shorewall/virtual/jabber.pp new file mode 100644 index 0000000..14a111e --- /dev/null +++ b/manifests/implementations/shorewall/virtual/jabber.pp @@ -0,0 +1,54 @@ +class firewall::implementations::shorewall::virtual::jabber($destination, $zone = 'fw') { + shorewall::rule { 'jabber-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5222", + proto => 'tcp', + destinationport => '5222', + ratelimit => '-', + order => 2200, + } + + shorewall::rule { 'jabber-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:5223", + proto => 'tcp', + destinationport => '5223', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2201, + } + + shorewall::rule { 'jabber-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5269", + proto => 'tcp', + destinationport => '5269', + ratelimit => '-', + order => 2202, + } + + shorewall::rule { 'jabber-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4369", + proto => 'tcp', + destinationport => '4369', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2203, + } + + shorewall::rule { 'jabber-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4370", + proto => 'tcp', + destinationport => '4370:4375', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2204, + } +} diff --git a/manifests/implementations/shorewall/virtual/mail.pp b/manifests/implementations/shorewall/virtual/mail.pp new file mode 100644 index 0000000..4eaa07a --- /dev/null +++ b/manifests/implementations/shorewall/virtual/mail.pp @@ -0,0 +1,67 @@ +class firewall::implementations::shorewall::virtual::mail($destination) { + shorewall::rule { 'mail-1': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:25", + proto => 'tcp', + destinationport => '25', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 1000, + } + + shorewall::rule { 'mail-2': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:25", + proto => 'tcp', + destinationport => '25', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 1001, + } + + shorewall::rule { 'mail-3': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:993", + proto => 'tcp', + destinationport => '993', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1002, + } + + shorewall::rule { 'mail-4': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:993", + proto => 'tcp', + destinationport => '993', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1003, + } + + shorewall::rule { 'mail-5': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:587", + proto => 'tcp', + destinationport => '587', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1004, + } + + shorewall::rule { 'mail-6': + action => 'DNAT', + source => 'net', + destination => "vm:$destination:587", + proto => 'tcp', + destinationport => '587', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => lookup("firewall::ssl_ratelimit", undef, undef, '-'), + order => 1005, + } +} diff --git a/manifests/implementations/shorewall/virtual/mdns.pp b/manifests/implementations/shorewall/virtual/mdns.pp new file mode 100644 index 0000000..b41e414 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/mdns.pp @@ -0,0 +1,11 @@ +class firewall::implementations::shorewall::virtual::mdns($destination, $zone = 'fw') { + shorewall::rule { 'mdns-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5353", + proto => 'tcp', + destinationport => '5353', + ratelimit => '-', + order => 2700, + } +} diff --git a/manifests/implementations/shorewall/virtual/mumble.pp b/manifests/implementations/shorewall/virtual/mumble.pp new file mode 100644 index 0000000..d90ec30 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/mumble.pp @@ -0,0 +1,22 @@ +class firewall::implementations::shorewall::virtual::mumble($destination, $zone = 'fw') { + shorewall::rule { 'mumble-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:64738", + proto => 'tcp', + destinationport => '64738', + ratelimit => '-', + order => 2300, + } + + shorewall::rule { 'mumble-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:64738", + proto => 'udp', + destinationport => '64738', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2301, + } +} diff --git a/manifests/implementations/shorewall/virtual/munin.pp b/manifests/implementations/shorewall/virtual/munin.pp new file mode 100644 index 0000000..79514c6 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/munin.pp @@ -0,0 +1,28 @@ +define firewall::virtual::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') { + shorewall::rule { "munin-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => $order, + } + + shorewall::rule { "munin-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => $order, + } +} diff --git a/manifests/implementations/shorewall/virtual/rsync.pp b/manifests/implementations/shorewall/virtual/rsync.pp new file mode 100644 index 0000000..357e937 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/rsync.pp @@ -0,0 +1,11 @@ +class firewall::implementations::shorewall::virtual::rsync($destination, $zone = 'fw') { + shorewall::rule { 'rsync-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:873", + proto => 'tcp', + destinationport => '873', + ratelimit => '-', + order => 2600, + } +} diff --git a/manifests/implementations/shorewall/virtual/ssh.pp b/manifests/implementations/shorewall/virtual/ssh.pp new file mode 100644 index 0000000..7ad93fc --- /dev/null +++ b/manifests/implementations/shorewall/virtual/ssh.pp @@ -0,0 +1,28 @@ +define firewall::virtual::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') { + shorewall::rule { "ssh-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => "2$port_orig", + } + + shorewall::rule { "ssh-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "fw:$destination", + default => "fw:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => "2$port_orig", + } +} diff --git a/manifests/implementations/shorewall/virtual/tor.pp b/manifests/implementations/shorewall/virtual/tor.pp new file mode 100644 index 0000000..2e96cbe --- /dev/null +++ b/manifests/implementations/shorewall/virtual/tor.pp @@ -0,0 +1,85 @@ +class firewall::implementations::shorewall::virtual::tor($destination, $zone = 'vm') { + shorewall::rule { 'tor-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9000", + proto => 'tcp', + destinationport => '9000', + ratelimit => '-', + order => 2100, + } + + shorewall::rule { 'tor-1': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9000", + proto => 'tcp', + destinationport => '9000', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2101, + } + + shorewall::rule { 'tor-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => '9001', + ratelimit => '-', + order => 2102, + } + + shorewall::rule { 'tor-3': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9001", + proto => 'tcp', + destinationport => '9001', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2103, + } + + shorewall::rule { 'tor-4': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9100", + proto => 'tcp', + destinationport => '9100', + ratelimit => '-', + order => 2104, + } + + shorewall::rule { 'tor-5': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9100", + proto => 'tcp', + destinationport => '9100', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2105, + } + + shorewall::rule { 'tor-6': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9101", + proto => 'tcp', + destinationport => '9101', + ratelimit => '-', + order => 2106, + } + + shorewall::rule { 'tor-7': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:9101", + proto => 'tcp', + destinationport => '9101', + originaldest => lookup('firewall::external_ip', undef, undef, $::ipaddress), + ratelimit => '-', + order => 2107, + } +} diff --git a/manifests/implementations/shorewall/virtual/web.pp b/manifests/implementations/shorewall/virtual/web.pp new file mode 100644 index 0000000..06bf993 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/web.pp @@ -0,0 +1,14 @@ +define firewall::virtual::web( + $destination +) { + shorewall::rule { "web-route-${name}-1": + action => 'DNAT', + source => 'vm', + destination => "fw:${destination}:80", + proto => 'tcp', + destinationport => '80', + originaldest => $destination, + ratelimit => '-', + order => 600, + } +} diff --git a/manifests/implementations/shorewall/virtual/yacy.pp b/manifests/implementations/shorewall/virtual/yacy.pp new file mode 100644 index 0000000..0a791f9 --- /dev/null +++ b/manifests/implementations/shorewall/virtual/yacy.pp @@ -0,0 +1,11 @@ +class firewall::implementations::shorewall::virtual::yacy($destination, $zone = 'fw') { + shorewall::rule { 'yacy-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8090", + proto => 'tcp', + destinationport => '8090', + ratelimit => '-', + order => 2500, + } +} |