class firewall::router::http($destination, $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { 'http-route-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:80", proto => 'tcp', destinationport => '80', ratelimit => '-', order => 600, } shorewall::rule { 'http-route-2': action => 'DNAT', source => '$FW', destination => "fw:$destination:80", proto => 'tcp', destinationport => '80', originaldest => "$originaldest", ratelimit => '-', order => 601, } } class firewall::router::https($destination, $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { 'https-route-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:443", proto => 'tcp', destinationport => '443', ratelimit => '-', order => 602, } shorewall::rule { 'https-route-2': action => 'DNAT', source => '$FW', destination => "fw:$destination:443", proto => 'tcp', destinationport => '443', originaldest => "$originaldest", ratelimit => '-', order => 602, } } class firewall::router::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { 'puppetmaster-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:$puppetmaster_port", proto => 'tcp', destinationport => "$puppetmaster_port", ratelimit => '-', order => 700, } shorewall::rule { 'puppetmaster-2': action => 'DNAT', source => 'net', destination => "$zone:$destination:$puppetmaster_port", proto => 'udp', destinationport => "$puppetmaster_port", ratelimit => '-', order => 701, } shorewall::rule { 'puppetmaster-3': action => 'DNAT', source => '$FW', destination => "$zone:$destination:$puppetmaster_port", proto => 'tcp', destinationport => "$puppetmaster_port", originaldest => "$originaldest", ratelimit => '-', order => 702, } shorewall::rule { 'puppetmaster-4': action => 'DNAT', source => '$FW', destination => "$zone:$destination:$puppetmaster_port", proto => 'udp', destinationport => "$puppetmaster_port", originaldest => "$originaldest", ratelimit => '-', order => 703, } shorewall::rule { 'puppetmaster-5': action => 'DNAT', source => 'net', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'tcp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => 704, } shorewall::rule { 'puppetmaster-6': action => 'DNAT', source => 'net', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'udp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => 705, } shorewall::rule { 'puppetmaster-7': action => 'DNAT', source => '$FW', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'tcp', destinationport => "$puppetmaster_nonssl_port", originaldest => "$originaldest", ratelimit => '-', order => 706, } shorewall::rule { 'puppetmaster-8': action => 'DNAT', source => '$FW', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'udp', destinationport => "$puppetmaster_nonssl_port", originaldest => "$originaldest", ratelimit => '-', order => 707, } } class firewall::router::gitd($destination, $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { 'git-daemon-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:9418", proto => 'tcp', destinationport => '9418', ratelimit => '-', order => 800, } shorewall::rule { 'git-daemon-2': action => 'DNAT', source => '$FW', destination => "$zone:$destination:9418", proto => 'tcp', destinationport => '9418', originaldest => "$originaldest", ratelimit => '-', order => 801, } } class firewall::router::icecast($destination, $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { 'icecast-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:8000", proto => 'tcp', destinationport => '8000', ratelimit => '-', order => 900, } shorewall::rule { 'icecast-2': action => 'DNAT', source => '$FW', destination => "$zone:$destination:8000", proto => 'tcp', destinationport => '8000', originaldest => "$originaldest", ratelimit => '-', order => 901, } } class firewall::router::mail($destination, $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { 'mail-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:25", proto => 'tcp', destinationport => '25', ratelimit => '-', order => 1000, } shorewall::rule { 'mail-2': action => 'DNAT', source => '$FW', destination => "$zone:$destination:25", proto => 'tcp', destinationport => '25', originaldest => "$originaldest", ratelimit => '-', order => 1001, } shorewall::rule { 'mail-3': action => 'DNAT', source => 'net', destination => "$zone:$destination:993", proto => 'tcp', destinationport => '993', ratelimit => '-', order => 1002, } shorewall::rule { 'mail-4': action => 'DNAT', source => '$FW', destination => "$zone:$destination:993", proto => 'tcp', destinationport => '993', originaldest => "$originaldest", ratelimit => '-', order => 1003, } shorewall::rule { 'mail-5': action => 'DNAT', source => 'net', destination => "$zone:$destination:587", proto => 'tcp', destinationport => '587', ratelimit => '-', order => 1004, } shorewall::rule { 'mail-6': action => 'DNAT', source => '$FW', destination => "$zone:$destination:587", proto => 'tcp', destinationport => '587', originaldest => "$originaldest", ratelimit => '-', order => 1005, } } define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { "ssh-$name-1": action => 'DNAT', source => 'net', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", ratelimit => '-', order => "2$port_orig", } shorewall::rule { "ssh-$name-2": action => 'DNAT', source => '$FW', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", originaldest => "$originaldest", ratelimit => '-', order => "2$port_orig", } } define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc', $order = '400', $originaldest = $ipaddress) { shorewall::rule { "munin-$name-1": action => 'DNAT', source => 'net', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", ratelimit => '-', order => $order, } shorewall::rule { "munin-$name-2": action => 'DNAT', source => '$FW', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", originaldest => "$originaldest", ratelimit => '-', order => $order, } } class firewall::router::torrent($destination, $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { "torrent-tcp-1": action => 'DNAT', source => 'net', destination => "$zone:$destination", proto => 'tcp', destinationport => "6881:6999", ratelimit => '-', order => 200, } shorewall::rule { "torrent-tcp-2": action => 'DNAT', source => 'all', destination => "$zone:$destination", proto => 'tcp', destinationport => "6881:6999", originaldest => "$originaldest", ratelimit => '-', order => 200, } shorewall::rule { "torrent-udp-1": action => 'DNAT', source => 'net', destination => "$zone:$destination", proto => 'udp', destinationport => "6881:6999", ratelimit => '-', order => 201, } shorewall::rule { "torrent-udp-2": action => 'DNAT', source => 'all', destination => "$zone:$destination", proto => 'udp', destinationport => "6881:6999", originaldest => "$originaldest", ratelimit => '-', order => 201, } } class firewall::router::gobby($destination, $zone = 'loc', $originaldest = $ipaddress) { shorewall::rule { 'gobby-route-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:6523", proto => 'tcp', destinationport => '6523', ratelimit => '-', order => 600, } shorewall::rule { 'gobby-route-2': action => 'DNAT', source => '$FW', destination => "fw:$destination:6523", proto => 'tcp', destinationport => '6523', originaldest => "$originaldest", ratelimit => '-', order => 601, } } # See http://www.shorewall.net/FAQ.htm#faq2 define firewall::router::hairpinning($order = '5000', $proto = 'tcp', $port = 'www', $external_ip = '$ETH0_IP', $interface = 'eth1', $destination = '192.168.1.100', $source = 'eth1', $source_zone = 'loc', $dest_zone = 'loc', $port_dest = '') { shorewall::masq { "routeback-$name": interface => "$interface:$destination", source => $source, address => $external_ip, proto => $proto, port => $port, order => $order, } shorewall::rule { "routeback-$name": action => 'DNAT', source => $source_zone, destination => $port_dest ? { '' => "$dest_zone:$destination", default => "$dest_zone:$destination:$port_dest", }, proto => $proto, destinationport => $port, ratelimit => '-', order => $order, originaldest => $external_ip, } }