diff options
Diffstat (limited to 'manifests/vm/dns.pp')
-rw-r--r-- | manifests/vm/dns.pp | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/manifests/vm/dns.pp b/manifests/vm/dns.pp new file mode 100644 index 0000000..a273bcc --- /dev/null +++ b/manifests/vm/dns.pp @@ -0,0 +1,53 @@ +class firewall::vm::dns($destination, $zone = 'vm') { + shorewall::rule { 'dns-route-0': + action => 'DNS/ACCEPT', + source => 'net', + destination => '$FW', + proto => '-', + destinationport => '-', + ratelimit => '-', + order => 2000, + } + + shorewall::rule { 'dns-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'tcp', + destinationport => '53', + ratelimit => '-', + order => 2001, + } + + shorewall::rule { 'dns-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'tcp', + destinationport => '53', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2002, + } + + shorewall::rule { 'dns-route-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'udp', + destinationport => '53', + ratelimit => '-', + order => 2003, + } + + shorewall::rule { 'dns-route-4': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'udp', + destinationport => '53', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2004, + } +} |