class firewall::redirect::ssh($destinationport) {
  # When the box is in an internal network and we want to provide
  # and external access through a shared real IP, we have to
  # redirect requests coming from another port to port 22.
  $ip = lookup('firewall::external_ip', undef, undef, $::ipaddress)

  shorewall::rule { "ssh-redirect-1":
    action          => 'DNAT',
    source          => 'net',
    destination     => "fw:$ip:22",
    proto           => 'tcp',
    destinationport => $destinationport,
    ratelimit       => '-',
    order           => $destinationport,
  }
}