From 14ced49d32beab8b80c6499b3a02ed1523ab98ae Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Fri, 11 Sep 2015 21:56:50 -0300 Subject: Use firewall::virtual class names --- manifests/virtual/dns.pp | 53 ++++++++++++++++++++++++ manifests/virtual/gitd.pp | 22 ++++++++++ manifests/virtual/gobby.pp | 11 +++++ manifests/virtual/http.pp | 22 ++++++++++ manifests/virtual/https.pp | 22 ++++++++++ manifests/virtual/icecast.pp | 22 ++++++++++ manifests/virtual/jabber.pp | 54 +++++++++++++++++++++++++ manifests/virtual/mail.pp | 64 +++++++++++++++++++++++++++++ manifests/virtual/mdns.pp | 11 +++++ manifests/virtual/mumble.pp | 22 ++++++++++ manifests/virtual/munin.pp | 28 +++++++++++++ manifests/virtual/puppetmaster.pp | 85 +++++++++++++++++++++++++++++++++++++++ manifests/virtual/rsync.pp | 11 +++++ manifests/virtual/ssh.pp | 28 +++++++++++++ manifests/virtual/tor.pp | 43 ++++++++++++++++++++ manifests/virtual/yacy.pp | 11 +++++ manifests/vm/dns.pp | 53 ------------------------ manifests/vm/gitd.pp | 22 ---------- manifests/vm/gobby.pp | 11 ----- manifests/vm/http.pp | 22 ---------- manifests/vm/https.pp | 22 ---------- manifests/vm/icecast.pp | 22 ---------- manifests/vm/jabber.pp | 54 ------------------------- manifests/vm/mail.pp | 64 ----------------------------- manifests/vm/mdns.pp | 11 ----- manifests/vm/mumble.pp | 22 ---------- manifests/vm/munin.pp | 28 ------------- manifests/vm/puppetmaster.pp | 85 --------------------------------------- manifests/vm/rsync.pp | 11 ----- manifests/vm/ssh.pp | 28 ------------- manifests/vm/tor.pp | 43 -------------------- manifests/vm/yacy.pp | 11 ----- 32 files changed, 509 insertions(+), 509 deletions(-) create mode 100644 manifests/virtual/dns.pp create mode 100644 manifests/virtual/gitd.pp create mode 100644 manifests/virtual/gobby.pp create mode 100644 manifests/virtual/http.pp create mode 100644 manifests/virtual/https.pp create mode 100644 manifests/virtual/icecast.pp create mode 100644 manifests/virtual/jabber.pp create mode 100644 manifests/virtual/mail.pp create mode 100644 manifests/virtual/mdns.pp create mode 100644 manifests/virtual/mumble.pp create mode 100644 manifests/virtual/munin.pp create mode 100644 manifests/virtual/puppetmaster.pp create mode 100644 manifests/virtual/rsync.pp create mode 100644 manifests/virtual/ssh.pp create mode 100644 manifests/virtual/tor.pp create mode 100644 manifests/virtual/yacy.pp delete mode 100644 manifests/vm/dns.pp delete mode 100644 manifests/vm/gitd.pp delete mode 100644 manifests/vm/gobby.pp delete mode 100644 manifests/vm/http.pp delete mode 100644 manifests/vm/https.pp delete mode 100644 manifests/vm/icecast.pp delete mode 100644 manifests/vm/jabber.pp delete mode 100644 manifests/vm/mail.pp delete mode 100644 manifests/vm/mdns.pp delete mode 100644 manifests/vm/mumble.pp delete mode 100644 manifests/vm/munin.pp delete mode 100644 manifests/vm/puppetmaster.pp delete mode 100644 manifests/vm/rsync.pp delete mode 100644 manifests/vm/ssh.pp delete mode 100644 manifests/vm/tor.pp delete mode 100644 manifests/vm/yacy.pp diff --git a/manifests/virtual/dns.pp b/manifests/virtual/dns.pp new file mode 100644 index 0000000..f389929 --- /dev/null +++ b/manifests/virtual/dns.pp @@ -0,0 +1,53 @@ +class firewall::virtual::dns($destination, $zone = 'vm') { + shorewall::rule { 'dns-route-0': + action => 'DNS/ACCEPT', + source => 'net', + destination => '$FW', + proto => '-', + destinationport => '-', + ratelimit => '-', + order => 2000, + } + + shorewall::rule { 'dns-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'tcp', + destinationport => '53', + ratelimit => '-', + order => 2001, + } + + shorewall::rule { 'dns-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'tcp', + destinationport => '53', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2002, + } + + shorewall::rule { 'dns-route-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:53", + proto => 'udp', + destinationport => '53', + ratelimit => '-', + order => 2003, + } + + shorewall::rule { 'dns-route-4': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:53", + proto => 'udp', + destinationport => '53', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2004, + } +} diff --git a/manifests/virtual/gitd.pp b/manifests/virtual/gitd.pp new file mode 100644 index 0000000..23095aa --- /dev/null +++ b/manifests/virtual/gitd.pp @@ -0,0 +1,22 @@ +class firewall::virtual::gitd($destination, $zone = 'fw') { + shorewall::rule { 'git-daemon-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9418", + proto => 'tcp', + destinationport => '9418', + ratelimit => '-', + order => 800, + } + + shorewall::rule { 'git-daemon-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9418", + proto => 'tcp', + destinationport => '9418', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 801, + } +} diff --git a/manifests/virtual/gobby.pp b/manifests/virtual/gobby.pp new file mode 100644 index 0000000..5554a11 --- /dev/null +++ b/manifests/virtual/gobby.pp @@ -0,0 +1,11 @@ +class firewall::virtual::gobby($destination, $zone = 'fw') { + shorewall::rule { 'gobby-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:6523", + proto => 'tcp', + destinationport => '6523', + ratelimit => '-', + order => 2400, + } +} diff --git a/manifests/virtual/http.pp b/manifests/virtual/http.pp new file mode 100644 index 0000000..b1e7faa --- /dev/null +++ b/manifests/virtual/http.pp @@ -0,0 +1,22 @@ +class firewall::virtual::http($destination, $zone = 'vm') { + shorewall::rule { 'http-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:80", + proto => 'tcp', + destinationport => '80', + ratelimit => '-', + order => 600, + } + + shorewall::rule { 'http-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:80", + proto => 'tcp', + destinationport => '80', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 601, + } +} diff --git a/manifests/virtual/https.pp b/manifests/virtual/https.pp new file mode 100644 index 0000000..ea900d8 --- /dev/null +++ b/manifests/virtual/https.pp @@ -0,0 +1,22 @@ +class firewall::virtual::https($destination, $zone = 'vm') { + shorewall::rule { 'https-route-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:443", + proto => 'tcp', + destinationport => '443', + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 602, + } + + shorewall::rule { 'https-route-2': + action => 'DNAT', + source => '$FW', + destination => "fw:$destination:443", + proto => 'tcp', + destinationport => '443', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 602, + } +} diff --git a/manifests/virtual/icecast.pp b/manifests/virtual/icecast.pp new file mode 100644 index 0000000..1681f18 --- /dev/null +++ b/manifests/virtual/icecast.pp @@ -0,0 +1,22 @@ +class firewall::virtual::icecast($destination, $zone = 'fw') { + shorewall::rule { 'icecast-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + ratelimit => '-', + order => 900, + } + + shorewall::rule { 'icecast-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:8000", + proto => 'tcp', + destinationport => '8000', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 901, + } +} diff --git a/manifests/virtual/jabber.pp b/manifests/virtual/jabber.pp new file mode 100644 index 0000000..0bba4e9 --- /dev/null +++ b/manifests/virtual/jabber.pp @@ -0,0 +1,54 @@ +class firewall::virtual::jabber($destination, $zone = 'fw') { + shorewall::rule { 'jabber-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5222", + proto => 'tcp', + destinationport => '5222', + ratelimit => '-', + order => 2200, + } + + shorewall::rule { 'jabber-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:5223", + proto => 'tcp', + destinationport => '5223', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2201, + } + + shorewall::rule { 'jabber-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5269", + proto => 'tcp', + destinationport => '5269', + ratelimit => '-', + order => 2202, + } + + shorewall::rule { 'jabber-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4369", + proto => 'tcp', + destinationport => '4369', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2203, + } + + shorewall::rule { 'jabber-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:4370", + proto => 'tcp', + destinationport => '4370:4375', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2204, + } +} diff --git a/manifests/virtual/mail.pp b/manifests/virtual/mail.pp new file mode 100644 index 0000000..83589ce --- /dev/null +++ b/manifests/virtual/mail.pp @@ -0,0 +1,64 @@ +class firewall::virtual::mail($destination, $zone = 'fw') { + shorewall::rule { 'mail-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:25", + proto => 'tcp', + destinationport => '25', + ratelimit => '-', + order => 1000, + } + + shorewall::rule { 'mail-2': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:25", + proto => 'tcp', + destinationport => '25', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 1001, + } + + shorewall::rule { 'mail-3': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:993", + proto => 'tcp', + destinationport => '993', + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1002, + } + + shorewall::rule { 'mail-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:993", + proto => 'tcp', + destinationport => '993', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1003, + } + + shorewall::rule { 'mail-5': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:587", + proto => 'tcp', + destinationport => '587', + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1004, + } + + shorewall::rule { 'mail-6': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:587", + proto => 'tcp', + destinationport => '587', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 1005, + } +} diff --git a/manifests/virtual/mdns.pp b/manifests/virtual/mdns.pp new file mode 100644 index 0000000..db8ec25 --- /dev/null +++ b/manifests/virtual/mdns.pp @@ -0,0 +1,11 @@ +class firewall::virtual::mdns($destination, $zone = 'fw') { + shorewall::rule { 'mdns-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:5353", + proto => 'tcp', + destinationport => '5353', + ratelimit => '-', + order => 2700, + } +} diff --git a/manifests/virtual/mumble.pp b/manifests/virtual/mumble.pp new file mode 100644 index 0000000..45ab393 --- /dev/null +++ b/manifests/virtual/mumble.pp @@ -0,0 +1,22 @@ +class firewall::virtual::mumble($destination, $zone = 'fw') { + shorewall::rule { 'mumble-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:64738", + proto => 'tcp', + destinationport => '64738', + ratelimit => '-', + order => 2300, + } + + shorewall::rule { 'mumble-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:64738", + proto => 'udp', + destinationport => '64738', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2301, + } +} diff --git a/manifests/virtual/munin.pp b/manifests/virtual/munin.pp new file mode 100644 index 0000000..b8bfce1 --- /dev/null +++ b/manifests/virtual/munin.pp @@ -0,0 +1,28 @@ +define firewall::virtual::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') { + shorewall::rule { "munin-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => $order, + } + + shorewall::rule { "munin-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => $order, + } +} diff --git a/manifests/virtual/puppetmaster.pp b/manifests/virtual/puppetmaster.pp new file mode 100644 index 0000000..e54c166 --- /dev/null +++ b/manifests/virtual/puppetmaster.pp @@ -0,0 +1,85 @@ +class firewall::virtual::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'fw') { + shorewall::rule { 'puppetmaster-1': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'tcp', + destinationport => "$puppetmaster_port", + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 700, + } + + shorewall::rule { 'puppetmaster-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'udp', + destinationport => "$puppetmaster_port", + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 701, + } + + shorewall::rule { 'puppetmaster-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'tcp', + destinationport => "$puppetmaster_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 702, + } + + shorewall::rule { 'puppetmaster-4': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_port", + proto => 'udp', + destinationport => "$puppetmaster_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => hiera("firewall::ssl_ratelimit", '-'), + order => 703, + } + + shorewall::rule { 'puppetmaster-5': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'tcp', + destinationport => "$puppetmaster_nonssl_port", + ratelimit => '-', + order => 704, + } + + shorewall::rule { 'puppetmaster-6': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'udp', + destinationport => "$puppetmaster_nonssl_port", + ratelimit => '-', + order => 705, + } + + shorewall::rule { 'puppetmaster-7': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'tcp', + destinationport => "$puppetmaster_nonssl_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 706, + } + + shorewall::rule { 'puppetmaster-8': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:$puppetmaster_nonssl_port", + proto => 'udp', + destinationport => "$puppetmaster_nonssl_port", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 707, + } +} diff --git a/manifests/virtual/rsync.pp b/manifests/virtual/rsync.pp new file mode 100644 index 0000000..50df46c --- /dev/null +++ b/manifests/virtual/rsync.pp @@ -0,0 +1,11 @@ +class firewall::virtual::rsync($destination, $zone = 'fw') { + shorewall::rule { 'rsync-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:873", + proto => 'tcp', + destinationport => '873', + ratelimit => '-', + order => 2600, + } +} diff --git a/manifests/virtual/ssh.pp b/manifests/virtual/ssh.pp new file mode 100644 index 0000000..4832b58 --- /dev/null +++ b/manifests/virtual/ssh.pp @@ -0,0 +1,28 @@ +define firewall::virtual::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') { + shorewall::rule { "ssh-$name-1": + action => 'DNAT', + source => 'net', + destination => $port_dest ? { + '' => "$zone:$destination", + default => "$zone:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + ratelimit => '-', + order => "2$port_orig", + } + + shorewall::rule { "ssh-$name-2": + action => 'DNAT', + source => '$FW', + destination => $port_dest ? { + '' => "fw:$destination", + default => "fw:$destination:$port_dest", + }, + proto => 'tcp', + destinationport => "$port_orig", + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => "2$port_orig", + } +} diff --git a/manifests/virtual/tor.pp b/manifests/virtual/tor.pp new file mode 100644 index 0000000..4d336c6 --- /dev/null +++ b/manifests/virtual/tor.pp @@ -0,0 +1,43 @@ +class firewall::virtual::tor($destination, $zone = 'fw') { + shorewall::rule { 'tor-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => '9001', + ratelimit => '-', + order => 2100, + } + + shorewall::rule { 'tor-1': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9001", + proto => 'tcp', + destinationport => '9001', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2101, + } + + shorewall::rule { 'tor-2': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:9030", + proto => 'tcp', + destinationport => '9030', + ratelimit => '-', + order => 2102, + } + + shorewall::rule { 'tor-3': + action => 'DNAT', + source => '$FW', + destination => "$zone:$destination:9030", + proto => 'tcp', + destinationport => '9030', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2103, + } +} diff --git a/manifests/virtual/yacy.pp b/manifests/virtual/yacy.pp new file mode 100644 index 0000000..173ba13 --- /dev/null +++ b/manifests/virtual/yacy.pp @@ -0,0 +1,11 @@ +class firewall::virtual::yacy($destination, $zone = 'fw') { + shorewall::rule { 'yacy-0': + action => 'DNAT', + source => 'net', + destination => "$zone:$destination:8090", + proto => 'tcp', + destinationport => '8090', + ratelimit => '-', + order => 2500, + } +} diff --git a/manifests/vm/dns.pp b/manifests/vm/dns.pp deleted file mode 100644 index a273bcc..0000000 --- a/manifests/vm/dns.pp +++ /dev/null @@ -1,53 +0,0 @@ -class firewall::vm::dns($destination, $zone = 'vm') { - shorewall::rule { 'dns-route-0': - action => 'DNS/ACCEPT', - source => 'net', - destination => '$FW', - proto => '-', - destinationport => '-', - ratelimit => '-', - order => 2000, - } - - shorewall::rule { 'dns-route-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:53", - proto => 'tcp', - destinationport => '53', - ratelimit => '-', - order => 2001, - } - - shorewall::rule { 'dns-route-2': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:53", - proto => 'tcp', - destinationport => '53', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2002, - } - - shorewall::rule { 'dns-route-3': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:53", - proto => 'udp', - destinationport => '53', - ratelimit => '-', - order => 2003, - } - - shorewall::rule { 'dns-route-4': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:53", - proto => 'udp', - destinationport => '53', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2004, - } -} diff --git a/manifests/vm/gitd.pp b/manifests/vm/gitd.pp deleted file mode 100644 index 8c497db..0000000 --- a/manifests/vm/gitd.pp +++ /dev/null @@ -1,22 +0,0 @@ -class firewall::vm::gitd($destination, $zone = 'fw') { - shorewall::rule { 'git-daemon-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9418", - proto => 'tcp', - destinationport => '9418', - ratelimit => '-', - order => 800, - } - - shorewall::rule { 'git-daemon-2': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9418", - proto => 'tcp', - destinationport => '9418', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 801, - } -} diff --git a/manifests/vm/gobby.pp b/manifests/vm/gobby.pp deleted file mode 100644 index 3b113c5..0000000 --- a/manifests/vm/gobby.pp +++ /dev/null @@ -1,11 +0,0 @@ -class firewall::vm::gobby($destination, $zone = 'fw') { - shorewall::rule { 'gobby-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:6523", - proto => 'tcp', - destinationport => '6523', - ratelimit => '-', - order => 2400, - } -} diff --git a/manifests/vm/http.pp b/manifests/vm/http.pp deleted file mode 100644 index 404d82f..0000000 --- a/manifests/vm/http.pp +++ /dev/null @@ -1,22 +0,0 @@ -class firewall::vm::http($destination, $zone = 'vm') { - shorewall::rule { 'http-route-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:80", - proto => 'tcp', - destinationport => '80', - ratelimit => '-', - order => 600, - } - - shorewall::rule { 'http-route-2': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:80", - proto => 'tcp', - destinationport => '80', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 601, - } -} diff --git a/manifests/vm/https.pp b/manifests/vm/https.pp deleted file mode 100644 index 047ff66..0000000 --- a/manifests/vm/https.pp +++ /dev/null @@ -1,22 +0,0 @@ -class firewall::vm::https($destination, $zone = 'vm') { - shorewall::rule { 'https-route-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:443", - proto => 'tcp', - destinationport => '443', - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 602, - } - - shorewall::rule { 'https-route-2': - action => 'DNAT', - source => '$FW', - destination => "fw:$destination:443", - proto => 'tcp', - destinationport => '443', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 602, - } -} diff --git a/manifests/vm/icecast.pp b/manifests/vm/icecast.pp deleted file mode 100644 index b7bc2fe..0000000 --- a/manifests/vm/icecast.pp +++ /dev/null @@ -1,22 +0,0 @@ -class firewall::vm::icecast($destination, $zone = 'fw') { - shorewall::rule { 'icecast-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:8000", - proto => 'tcp', - destinationport => '8000', - ratelimit => '-', - order => 900, - } - - shorewall::rule { 'icecast-2': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:8000", - proto => 'tcp', - destinationport => '8000', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 901, - } -} diff --git a/manifests/vm/jabber.pp b/manifests/vm/jabber.pp deleted file mode 100644 index db26d6b..0000000 --- a/manifests/vm/jabber.pp +++ /dev/null @@ -1,54 +0,0 @@ -class firewall::vm::jabber($destination, $zone = 'fw') { - shorewall::rule { 'jabber-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:5222", - proto => 'tcp', - destinationport => '5222', - ratelimit => '-', - order => 2200, - } - - shorewall::rule { 'jabber-1': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:5223", - proto => 'tcp', - destinationport => '5223', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2201, - } - - shorewall::rule { 'jabber-2': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:5269", - proto => 'tcp', - destinationport => '5269', - ratelimit => '-', - order => 2202, - } - - shorewall::rule { 'jabber-3': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:4369", - proto => 'tcp', - destinationport => '4369', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2203, - } - - shorewall::rule { 'jabber-4': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:4370", - proto => 'tcp', - destinationport => '4370:4375', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2204, - } -} diff --git a/manifests/vm/mail.pp b/manifests/vm/mail.pp deleted file mode 100644 index f629865..0000000 --- a/manifests/vm/mail.pp +++ /dev/null @@ -1,64 +0,0 @@ -class firewall::vm::mail($destination, $zone = 'fw') { - shorewall::rule { 'mail-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:25", - proto => 'tcp', - destinationport => '25', - ratelimit => '-', - order => 1000, - } - - shorewall::rule { 'mail-2': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:25", - proto => 'tcp', - destinationport => '25', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 1001, - } - - shorewall::rule { 'mail-3': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:993", - proto => 'tcp', - destinationport => '993', - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 1002, - } - - shorewall::rule { 'mail-4': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:993", - proto => 'tcp', - destinationport => '993', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 1003, - } - - shorewall::rule { 'mail-5': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:587", - proto => 'tcp', - destinationport => '587', - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 1004, - } - - shorewall::rule { 'mail-6': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:587", - proto => 'tcp', - destinationport => '587', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 1005, - } -} diff --git a/manifests/vm/mdns.pp b/manifests/vm/mdns.pp deleted file mode 100644 index 644c889..0000000 --- a/manifests/vm/mdns.pp +++ /dev/null @@ -1,11 +0,0 @@ -class firewall::vm::mdns($destination, $zone = 'fw') { - shorewall::rule { 'mdns-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:5353", - proto => 'tcp', - destinationport => '5353', - ratelimit => '-', - order => 2700, - } -} diff --git a/manifests/vm/mumble.pp b/manifests/vm/mumble.pp deleted file mode 100644 index 321ab07..0000000 --- a/manifests/vm/mumble.pp +++ /dev/null @@ -1,22 +0,0 @@ -class firewall::vm::mumble($destination, $zone = 'fw') { - shorewall::rule { 'mumble-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:64738", - proto => 'tcp', - destinationport => '64738', - ratelimit => '-', - order => 2300, - } - - shorewall::rule { 'mumble-1': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:64738", - proto => 'udp', - destinationport => '64738', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2301, - } -} diff --git a/manifests/vm/munin.pp b/manifests/vm/munin.pp deleted file mode 100644 index e92e216..0000000 --- a/manifests/vm/munin.pp +++ /dev/null @@ -1,28 +0,0 @@ -define firewall::vm::munin($destination, $port_orig, $port_dest = '', $order = '400', $zone = 'fw') { - shorewall::rule { "munin-$name-1": - action => 'DNAT', - source => 'net', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - ratelimit => '-', - order => $order, - } - - shorewall::rule { "munin-$name-2": - action => 'DNAT', - source => '$FW', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => $order, - } -} diff --git a/manifests/vm/puppetmaster.pp b/manifests/vm/puppetmaster.pp deleted file mode 100644 index a097d77..0000000 --- a/manifests/vm/puppetmaster.pp +++ /dev/null @@ -1,85 +0,0 @@ -class firewall::vm::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'fw') { - shorewall::rule { 'puppetmaster-1': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:$puppetmaster_port", - proto => 'tcp', - destinationport => "$puppetmaster_port", - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 700, - } - - shorewall::rule { 'puppetmaster-2': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:$puppetmaster_port", - proto => 'udp', - destinationport => "$puppetmaster_port", - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 701, - } - - shorewall::rule { 'puppetmaster-3': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:$puppetmaster_port", - proto => 'tcp', - destinationport => "$puppetmaster_port", - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 702, - } - - shorewall::rule { 'puppetmaster-4': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:$puppetmaster_port", - proto => 'udp', - destinationport => "$puppetmaster_port", - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => hiera("firewall::ssl_ratelimit", '-'), - order => 703, - } - - shorewall::rule { 'puppetmaster-5': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:$puppetmaster_nonssl_port", - proto => 'tcp', - destinationport => "$puppetmaster_nonssl_port", - ratelimit => '-', - order => 704, - } - - shorewall::rule { 'puppetmaster-6': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:$puppetmaster_nonssl_port", - proto => 'udp', - destinationport => "$puppetmaster_nonssl_port", - ratelimit => '-', - order => 705, - } - - shorewall::rule { 'puppetmaster-7': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:$puppetmaster_nonssl_port", - proto => 'tcp', - destinationport => "$puppetmaster_nonssl_port", - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 706, - } - - shorewall::rule { 'puppetmaster-8': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:$puppetmaster_nonssl_port", - proto => 'udp', - destinationport => "$puppetmaster_nonssl_port", - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 707, - } -} diff --git a/manifests/vm/rsync.pp b/manifests/vm/rsync.pp deleted file mode 100644 index 6ee9c98..0000000 --- a/manifests/vm/rsync.pp +++ /dev/null @@ -1,11 +0,0 @@ -class firewall::vm::rsync($destination, $zone = 'fw') { - shorewall::rule { 'rsync-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:873", - proto => 'tcp', - destinationport => '873', - ratelimit => '-', - order => 2600, - } -} diff --git a/manifests/vm/ssh.pp b/manifests/vm/ssh.pp deleted file mode 100644 index f9586da..0000000 --- a/manifests/vm/ssh.pp +++ /dev/null @@ -1,28 +0,0 @@ -define firewall::vm::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'vm') { - shorewall::rule { "ssh-$name-1": - action => 'DNAT', - source => 'net', - destination => $port_dest ? { - '' => "$zone:$destination", - default => "$zone:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - ratelimit => '-', - order => "2$port_orig", - } - - shorewall::rule { "ssh-$name-2": - action => 'DNAT', - source => '$FW', - destination => $port_dest ? { - '' => "fw:$destination", - default => "fw:$destination:$port_dest", - }, - proto => 'tcp', - destinationport => "$port_orig", - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => "2$port_orig", - } -} diff --git a/manifests/vm/tor.pp b/manifests/vm/tor.pp deleted file mode 100644 index cd8820a..0000000 --- a/manifests/vm/tor.pp +++ /dev/null @@ -1,43 +0,0 @@ -class firewall::vm::tor($destination, $zone = 'fw') { - shorewall::rule { 'tor-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9001", - proto => 'tcp', - destinationport => '9001', - ratelimit => '-', - order => 2100, - } - - shorewall::rule { 'tor-1': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9001", - proto => 'tcp', - destinationport => '9001', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2101, - } - - shorewall::rule { 'tor-2': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:9030", - proto => 'tcp', - destinationport => '9030', - ratelimit => '-', - order => 2102, - } - - shorewall::rule { 'tor-3': - action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9030", - proto => 'tcp', - destinationport => '9030', - originaldest => hiera('firewall::external_ip', $::ipaddress), - ratelimit => '-', - order => 2103, - } -} diff --git a/manifests/vm/yacy.pp b/manifests/vm/yacy.pp deleted file mode 100644 index 0ddbf4b..0000000 --- a/manifests/vm/yacy.pp +++ /dev/null @@ -1,11 +0,0 @@ -class firewall::vm::yacy($destination, $zone = 'fw') { - shorewall::rule { 'yacy-0': - action => 'DNAT', - source => 'net', - destination => "$zone:$destination:8090", - proto => 'tcp', - destinationport => '8090', - ratelimit => '-', - order => 2500, - } -} -- cgit v1.2.3