From 3bc3cca757448549c4973f499932b48aaea6f218 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Sat, 5 Mar 2016 11:52:31 -0300 Subject: Make traffic shaping optional --- manifests/init.pp | 44 -------------------------------------------- manifests/shaping.pp | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 44 deletions(-) create mode 100644 manifests/shaping.pp diff --git a/manifests/init.pp b/manifests/init.pp index b6a57c2..48c9df3 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -3,8 +3,6 @@ class firewall( $device = hiera('firewall::device', 'eth0'), $zone = hiera('firewall::zone', '-'), $local_net = hiera('firewall::local_net', false), - $in_bandwidth = hiera('firewall::in_bandwidth', '1000mbps'), - $out_bandwidth = hiera('firewall::out_bandwidth', '1000mbps'), $device_options = hiera('firewall::device_options', 'tcpflags,blacklist,routefilter,nosmurfs,logmartians'), $vm_address = hiera('firewall::vm_address', '192.168.0.0/24'), $vm_device = hiera('firewall::vm_device', false) @@ -67,7 +65,6 @@ class firewall( } } - shorewall::policy { 'net-all': sourcezone => 'net', destinationzone => 'all', @@ -195,47 +192,6 @@ class firewall( order => 4, } - # - # Traffic shapping - # - shorewall::tcdevices { "${device}": - in_bandwidth => "$in_bandwidth", - out_bandwidth => "$out_bandwidth", - } - - shorewall::tcrules { "ssh-tcp": - order => "1", - source => "0.0.0.0/0", - destination => "0.0.0.0/0", - protocol => "tcp", - ports => "22", - } - - shorewall::tcrules { "ssh-udp": - order => "1", - source => "0.0.0.0/0", - destination => "0.0.0.0/0", - protocol => "udp", - ports => "22", - } - - shorewall::tcclasses { "ssh": - order => "1", - interface => "${device}", - rate => "4*full/100", - ceil => "full", - priority => "1", - } - - shorewall::tcclasses { "default": - order => "2", - interface => "${device}", - rate => "6*full/100", - ceil => "full", - priority => "2", - options => "default", - } - if $local_net == true { class { "firewall::local": } } diff --git a/manifests/shaping.pp b/manifests/shaping.pp new file mode 100644 index 0000000..63bd464 --- /dev/null +++ b/manifests/shaping.pp @@ -0,0 +1,46 @@ +class firewall::shaping( + $device = hiera('firewall::device', 'eth0'), + $in_bandwidth = hiera('firewall::in_bandwidth', '1000mbps'), + $out_bandwidth = hiera('firewall::out_bandwidth', '1000mbps') +) { + # + # Traffic shaping + # + shorewall::tcdevices { "${device}": + in_bandwidth => "$in_bandwidth", + out_bandwidth => "$out_bandwidth", + } + + shorewall::tcrules { "ssh-tcp": + order => "1", + source => "0.0.0.0/0", + destination => "0.0.0.0/0", + protocol => "tcp", + ports => "22", + } + + shorewall::tcrules { "ssh-udp": + order => "1", + source => "0.0.0.0/0", + destination => "0.0.0.0/0", + protocol => "udp", + ports => "22", + } + + shorewall::tcclasses { "ssh": + order => "1", + interface => "${device}", + rate => "4*full/100", + ceil => "full", + priority => "1", + } + + shorewall::tcclasses { "default": + order => "2", + interface => "${device}", + rate => "6*full/100", + ceil => "full", + priority => "2", + options => "default", + } +} -- cgit v1.2.3