From b0aaa689982edef19b349bd85350713f8b7108c2 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Mon, 15 Dec 2014 18:00:58 -0200
Subject: Docker and forwarding classes

---
 manifests/docker.pp     | 28 ++++++++++++++++++++++++++++
 manifests/forwarding.pp |  8 ++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 manifests/docker.pp
 create mode 100644 manifests/forwarding.pp

diff --git a/manifests/docker.pp b/manifests/docker.pp
new file mode 100644
index 0000000..7a5fdac
--- /dev/null
+++ b/manifests/docker.pp
@@ -0,0 +1,28 @@
+# See http://serverfault.com/questions/579726/docker-shorewall
+class firewall::docker($device) {
+  class { 'firewall::forwarding': }
+
+  shorewall::masq { "${device}":
+    interface => "${device}",
+    source    => '172.17.0.0/16',
+    order     => '10',
+  }
+
+  shorewall::zone { 'dock':
+    type  => 'ipv4',
+    order => '10',
+  }
+
+  shorewall::policy { 'dock-all':
+    sourcezone      => 'dock',
+    destinationzone => 'all',
+    policy          => 'ACCEPT',
+    order           => 10,
+  }
+
+  shorewall::interface { 'docker0': 
+   zone    => 'dock',
+   rfc1918 => false,
+   options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+  }
+}
diff --git a/manifests/forwarding.pp b/manifests/forwarding.pp
new file mode 100644
index 0000000..603fcc6
--- /dev/null
+++ b/manifests/forwarding.pp
@@ -0,0 +1,8 @@
+class firewall::forwarding {
+  augeas { 'ip_forwarding':
+    changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING On',
+    lens    => 'Shellvars.lns',
+    incl    => '/etc/shorewall/shorewall.conf',
+    notify  => Service[shorewall];
+  }
+}
-- 
cgit v1.2.3