diff options
| -rw-r--r-- | manifests/subsystems/firewall.pp | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/manifests/subsystems/firewall.pp b/manifests/subsystems/firewall.pp index 849d016..feae18d 100644 --- a/manifests/subsystems/firewall.pp +++ b/manifests/subsystems/firewall.pp @@ -356,6 +356,7 @@ class firewall::torrent { } class firewall::router::http($destination, $zone = 'vm') { + # We have two rules because to avoid loops in the internal proxy shorewall::rule { 'http-route-1': action => 'DNAT', source => 'net', @@ -379,6 +380,7 @@ class firewall::router::http($destination, $zone = 'vm') { } class firewall::router::https($destination, $zone = 'vm') { + # We have two rules because to avoid loops in the internal proxy shorewall::rule { 'https-route-1': action => 'DNAT', source => 'net', @@ -401,7 +403,7 @@ class firewall::router::https($destination, $zone = 'vm') { } } -class firewall::router::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'fw') { +class firewall::router::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'vm') { shorewall::rule { 'puppetmaster-1': action => 'DNAT', source => 'all', @@ -443,7 +445,7 @@ class firewall::router::puppetmaster($destination, $puppetmaster_port = '8140', } } -class firewall::router::gitd($destination, $zone = 'fw') { +class firewall::router::gitd($destination, $zone = 'vm') { shorewall::rule { 'git-daemon': action => 'DNAT', source => 'net', @@ -455,7 +457,7 @@ class firewall::router::gitd($destination, $zone = 'fw') { } } -class firewall::router::icecast($destination, $zone = 'fw') { +class firewall::router::icecast($destination, $zone = 'vm') { shorewall::rule { 'icecast-1': action => 'DNAT', source => 'net', @@ -478,7 +480,7 @@ class firewall::router::icecast($destination, $zone = 'fw') { } } -class firewall::router::mail($destination, $zone = 'fw') { +class firewall::router::mail($destination, $zone = 'vm') { shorewall::rule { 'mail-1': action => 'DNAT', source => 'all', @@ -515,7 +517,7 @@ define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $ } } -define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'fw') { +define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'vm') { shorewall::rule { "munin-$name": action => 'DNAT', source => 'all', @@ -530,7 +532,7 @@ define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone } } -class firewall::router::torrent($destination, $zone = 'fw') { +class firewall::router::torrent($destination, $zone = 'vm') { shorewall::rule { "torrent-tcp": action => 'DNAT', source => 'all', @@ -542,7 +544,7 @@ class firewall::router::torrent($destination, $zone = 'fw') { } shorewall::rule { "torrent-udp": - action => 'ACCEPT', + action => 'DNAT', source => 'all', destination => "$zone:$destination", proto => 'udp', |