class firewall::nas( $ftp = false, $tftp = false, $http = false, $nfsd = false, $rsync = false, $printer = false, $torrent = false, $mpd = false, $samba = false, $dlna = false, $daap = false, $avahi = false ) { if $ftp == true { include shorewall::rules::ftp } if $tftp == true { include shorewall::rules::tftp } if $http == true { include shorewall::rules::http } if $nfsd == true { include shorewall::rules::nfsd # Additional ports needed by NFS # Got using rpcinfo -p and netstat -ap shorewall::rule { 'nfs-1': action => 'ACCEPT', source => 'net', destination => '$FW', proto => 'tcp', destinationport => '35150,43902,46661,46661,46661,50340,54814,57170,58403,59780', ratelimit => '-', order => 100, } shorewall::rule { 'nfs-2': action => 'ACCEPT', source => 'net', destination => '$FW', proto => 'udp', destinationport => '938,38511,43195,53081,53081,53081,38521,45238,52664,52400,60331', ratelimit => '-', order => 100, } } if $rsync == true { include shorewall::rules::rsync } if $printer == true { include firewall::printer } if $torrent == true { include firewall::torrent } if $mpd == true { include firewall::mpd } if $samba == true { # See http://www.shorewall.net/samba.htm shorewall::rule { 'samba': action => 'SMB/ACCEPT', source => 'net', destination => '$FW', proto => '-', destinationport => '-', ratelimit => '-', order => 100, } shorewall::rule { 'netbios-1': action => 'ACCEPT', source => 'net', destination => '$FW', proto => 'tcp', destinationport => '137,138,139', ratelimit => '-', order => 100, } shorewall::rule { 'netbios-2': action => 'ACCEPT', source => 'net', destination => '$FW', proto => 'udp', destinationport => '137,138,139', ratelimit => '-', order => 100, } } if $dlna == true { # DLNA # # https://wiki.archlinux.org/index.php/MiniDLNA # http://netpatia.blogspot.co.uk/2011/03/setup-your-own-dlna-server.html # http://wiki.alpinelinux.org/wiki/IPTV_How_To # http://mediatomb.cc/dokuwiki/faq:faq # http://packages.debian.org/wheezy/djmount # http://packages.debian.org/wheezy/gupnp-tools # # Optional: # # http://www.shorewall.net/UPnP.html # # linux-igd package # /etc/default/linux-igd # /etc/upnpd.conf shorewall::rule { "dlna-1": action => 'ACCEPT', source => 'net', destination => '$FW', proto => 'tcp,udp', destinationport => "1900", ratelimit => '-', order => 102, } shorewall::rule { "dlna-2": action => 'ACCEPT', source => 'net', destination => '$FW', proto => 'tcp,udp', destinationport => "8200", ratelimit => '-', order => 103, } shorewall::rule { "dlna-3": action => 'allowinUPnP', source => 'net', destination => '$FW', order => 104, } shorewall::rule { "dlna-4": action => 'forwardUPnP', source => 'net', destination => '$FW', order => 105, } # Enable multicast augeas { 'enable_multicast': changes => 'set /files/etc/shorewall/shorewall.conf/MULTICAST Yes', lens => 'Shellvars.lns', incl => '/etc/shorewall/shorewall.conf', notify => Service[shorewall]; } } if $daap == true { # DAAP shorewall::rule { 'daap-1': source => 'net', destination => '$FW', proto => 'tcp', destinationport => '3689', order => 300, action => 'ACCEPT'; } shorewall::rule { 'daap-2': source => 'net', destination => '$FW', proto => 'udp', destinationport => '3689', order => 301, action => 'ACCEPT'; } } if $avahi == true { # Avahi/mDNS shorewall::rule { 'mdns': source => 'net', destination => '$FW', proto => 'udp', destinationport => '5353', order => 400, action => 'ACCEPT'; } } }