From 5f478e91625da72d244360ea24d0ad7ad3283a93 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 11 Aug 2011 15:28:56 -0300
Subject: Adding firewall::local

---
 manifests/subsystems/firewall/local.pp | 46 ++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 manifests/subsystems/firewall/local.pp

(limited to 'manifests/subsystems/firewall')

diff --git a/manifests/subsystems/firewall/local.pp b/manifests/subsystems/firewall/local.pp
new file mode 100644
index 0000000..71c21cd
--- /dev/null
+++ b/manifests/subsystems/firewall/local.pp
@@ -0,0 +1,46 @@
+class firewall::local($network = '192.168.1.0/24', $interface = 'eth0', $manage_host = true, $manage_interface = false) {
+
+  if $manage_host {
+    shorewall::host { "$interface-loc":
+      name    =>  "$interface:$network",
+      zone    => 'loc',
+      options => '',
+      order   => '3',
+    }
+  }
+
+  if $manage_interface {
+    shorewall::interface { $interface:
+      zone    => 'loc',
+      rfc1918 => true,
+      dhcp    => true,
+      options => 'routeback',
+    }
+  }
+
+  shorewall::policy { 'loc-all':
+    sourcezone      => 'loc',
+    destinationzone => 'all',
+    policy          => 'ACCEPT',
+    order           => '5',
+  }
+
+  shorewall::policy { 'vm-loc':
+    sourcezone      => 'vm',
+    destinationzone => 'loc',
+    policy          => 'ACCEPT',
+    order           => '6',
+  }
+
+  shorewall::policy { 'fw-loc':
+    sourcezone      => '$FW',
+    destinationzone => 'loc',
+    policy          => 'ACCEPT',
+    order           => '7',
+  }
+
+  shorewall::zone { 'loc':
+    type  => 'ipv4',
+    order => '4',
+  }
+}
-- 
cgit v1.2.3