From 40a9f5b6d556615ad95085b51ec56585dfbe248d Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Thu, 9 Jun 2016 17:52:57 -0300 Subject: Updates some firewall::virtual rules to new kvm scheme --- manifests/virtual/gitd.pp | 9 +++++---- manifests/virtual/gobby.pp | 16 ++++++++++++++-- manifests/virtual/http.pp | 11 ++++++----- manifests/virtual/https.pp | 11 ++++++----- manifests/virtual/mail.pp | 29 ++++++++++++++++------------- 5 files changed, 47 insertions(+), 29 deletions(-) diff --git a/manifests/virtual/gitd.pp b/manifests/virtual/gitd.pp index 23095aa..02c4fb9 100644 --- a/manifests/virtual/gitd.pp +++ b/manifests/virtual/gitd.pp @@ -1,18 +1,19 @@ -class firewall::virtual::gitd($destination, $zone = 'fw') { +class firewall::virtual::gitd($destination) { shorewall::rule { 'git-daemon-1': action => 'DNAT', source => 'net', - destination => "$zone:$destination:9418", + destination => "vm:$destination:9418", proto => 'tcp', destinationport => '9418', + originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => '-', order => 800, } shorewall::rule { 'git-daemon-2': action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:9418", + source => 'vm', + destination => "fw:$destination:9418", proto => 'tcp', destinationport => '9418', originaldest => hiera('firewall::external_ip', $::ipaddress), diff --git a/manifests/virtual/gobby.pp b/manifests/virtual/gobby.pp index 5554a11..162fe1d 100644 --- a/manifests/virtual/gobby.pp +++ b/manifests/virtual/gobby.pp @@ -1,10 +1,22 @@ -class firewall::virtual::gobby($destination, $zone = 'fw') { +class firewall::virtual::gobby($destination) { shorewall::rule { 'gobby-0': + action => 'DNAT', + source => 'vm', + destination => "fw:$destination:6523", + proto => 'tcp', + destinationport => '6523', + originaldest => hiera('firewall::external_ip', $::ipaddress), + ratelimit => '-', + order => 2400, + } + + shorewall::rule { 'gobby-1': action => 'DNAT', source => 'net', - destination => "$zone:$destination:6523", + destination => "vm:$destination:6523", proto => 'tcp', destinationport => '6523', + originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => '-', order => 2400, } diff --git a/manifests/virtual/http.pp b/manifests/virtual/http.pp index b1e7faa..efd3dca 100644 --- a/manifests/virtual/http.pp +++ b/manifests/virtual/http.pp @@ -1,18 +1,19 @@ -class firewall::virtual::http($destination, $zone = 'vm') { +class firewall::virtual::http($destination) { shorewall::rule { 'http-route-1': action => 'DNAT', - source => 'net', - destination => "$zone:$destination:80", + source => 'vm', + destination => "fw:$destination:80", proto => 'tcp', destinationport => '80', + originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => '-', order => 600, } shorewall::rule { 'http-route-2': action => 'DNAT', - source => '$FW', - destination => "fw:$destination:80", + source => 'net', + destination => "vm:$destination:80", proto => 'tcp', destinationport => '80', originaldest => hiera('firewall::external_ip', $::ipaddress), diff --git a/manifests/virtual/https.pp b/manifests/virtual/https.pp index ea900d8..36e0c9f 100644 --- a/manifests/virtual/https.pp +++ b/manifests/virtual/https.pp @@ -1,18 +1,19 @@ -class firewall::virtual::https($destination, $zone = 'vm') { +class firewall::virtual::https($destination) { shorewall::rule { 'https-route-1': action => 'DNAT', - source => 'net', - destination => "$zone:$destination:443", + source => 'vm', + destination => "fw:$destination:443", proto => 'tcp', destinationport => '443', + originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => hiera("firewall::ssl_ratelimit", '-'), order => 602, } shorewall::rule { 'https-route-2': action => 'DNAT', - source => '$FW', - destination => "fw:$destination:443", + source => 'net', + destination => "vm:$destination:443", proto => 'tcp', destinationport => '443', originaldest => hiera('firewall::external_ip', $::ipaddress), diff --git a/manifests/virtual/mail.pp b/manifests/virtual/mail.pp index 83589ce..75eec5f 100644 --- a/manifests/virtual/mail.pp +++ b/manifests/virtual/mail.pp @@ -1,18 +1,19 @@ -class firewall::virtual::mail($destination, $zone = 'fw') { +class firewall::virtual::mail($destination) { shorewall::rule { 'mail-1': action => 'DNAT', - source => 'net', - destination => "$zone:$destination:25", + source => 'vm', + destination => "fw:$destination:25", proto => 'tcp', destinationport => '25', + originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => '-', order => 1000, } shorewall::rule { 'mail-2': action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:25", + source => 'net', + destination => "vm:$destination:25", proto => 'tcp', destinationport => '25', originaldest => hiera('firewall::external_ip', $::ipaddress), @@ -22,18 +23,19 @@ class firewall::virtual::mail($destination, $zone = 'fw') { shorewall::rule { 'mail-3': action => 'DNAT', - source => 'net', - destination => "$zone:$destination:993", + source => 'vm', + destination => "fw:$destination:993", proto => 'tcp', destinationport => '993', + originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => hiera("firewall::ssl_ratelimit", '-'), order => 1002, } shorewall::rule { 'mail-4': action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:993", + source => 'net', + destination => "vm:$destination:993", proto => 'tcp', destinationport => '993', originaldest => hiera('firewall::external_ip', $::ipaddress), @@ -43,18 +45,19 @@ class firewall::virtual::mail($destination, $zone = 'fw') { shorewall::rule { 'mail-5': action => 'DNAT', - source => 'net', - destination => "$zone:$destination:587", + source => 'vm', + destination => "fw:$destination:587", proto => 'tcp', destinationport => '587', + originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => hiera("firewall::ssl_ratelimit", '-'), order => 1004, } shorewall::rule { 'mail-6': action => 'DNAT', - source => '$FW', - destination => "$zone:$destination:587", + source => 'net', + destination => "vm:$destination:587", proto => 'tcp', destinationport => '587', originaldest => hiera('firewall::external_ip', $::ipaddress), -- cgit v1.2.3