class firewall::vm::icecast($destination, $zone = 'fw') { shorewall::rule { 'icecast-1': action => 'DNAT', source => 'net', destination => "$zone:$destination:8000", proto => 'tcp', destinationport => '8000', ratelimit => '-', order => 900, } shorewall::rule { 'icecast-2': action => 'DNAT', source => '$FW', destination => "$zone:$destination:8000", proto => 'tcp', destinationport => '8000', originaldest => hiera('firewall::external_ip', $::ipaddress), ratelimit => '-', order => 901, } }