class firewall::router::http($destination, $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { 'http-route': action => 'DNAT', source => 'all', destination => "$zone:$destination:80", proto => 'tcp', destinationport => '80', ratelimit => '-', order => '600', } if $routeback { firewall::router::hairpinning { 'http-route': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, } } } class firewall::router::https($destination, $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { 'https-route': action => 'DNAT', source => 'all', destination => "$zone:$destination:443", proto => 'tcp', destinationport => '443', ratelimit => '-', order => '602', } if $routeback { firewall::router::hairpinning { 'https-route': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => '443', } } } class firewall::router::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { 'puppetmaster-1': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_port", proto => 'tcp', destinationport => "$puppetmaster_port", ratelimit => '-', order => '700', } shorewall::rule { 'puppetmaster-2': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_port", proto => 'udp', destinationport => "$puppetmaster_port", ratelimit => '-', order => '701', } shorewall::rule { 'puppetmaster-3': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'tcp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => '704', } shorewall::rule { 'puppetmaster-4': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'udp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => '705', } if $routeback { firewall::router::hairpinning { 'puppetmaster-1': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => $puppetmaster_port, } firewall::router::hairpinning { 'puppetmaster-2': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'udp', port => $puppetmaster_port, } firewall::router::hairpinning { 'puppetmaster-3': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => $puppetmaster_nonssl_port, } firewall::router::hairpinning { 'puppetmaster-4': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'udp', port => $puppetmaster_nonssl_port, } } } class firewall::router::gitd($destination, $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { 'git-daemon': action => 'DNAT', source => 'net', destination => "$zone:$destination:9418", proto => 'tcp', destinationport => '9418', ratelimit => '-', order => '800', } if $routeback { firewall::router::hairpinning { 'git-daemon': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => '9418', } } } class firewall::router::icecast($destination, $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { 'icecast': action => 'DNAT', source => 'all', destination => "$zone:$destination:8000", proto => 'tcp', destinationport => '8000', ratelimit => '-', order => '900', } if $routeback { firewall::router::hairpinning { 'icecast': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => '8000', } } } class firewall::router::mail($destination, $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { 'mail-1': action => 'DNAT', source => 'all', destination => "$zone:$destination:25", proto => 'tcp', destinationport => '25', ratelimit => '-', order => '1000', } shorewall::rule { 'mail-2': action => 'DNAT', source => 'all', destination => "$zone:$destination:993", proto => 'tcp', destinationport => '993', ratelimit => '-', order => '1002', } if $routeback { firewall::router::hairpinning { 'mail-1': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => '25', } firewall::router::hairpinning { 'mail-2': interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => '993', } } } define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { "ssh-$name": action => 'DNAT', source => 'all', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", ratelimit => '-', order => "2$port_orig", } if $routeback { firewall::router::hairpinning { "ssh-$name": interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => $port_dest, } } } define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc', $routeback = false, $routeback_dest = '', $routeback_external_ip = '', $routeback_iface = 'eth1') { shorewall::rule { "munin-$name": action => 'DNAT', source => 'all', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", ratelimit => '-', } if $routeback { firewall::router::hairpinning { "munin-$name": interface => $routeback_iface, destination => $routeback_dest, external_ip => $routeback_external_ip, proto => 'tcp', port => $port_dest, } } } class firewall::router::torrent($destination, $zone = 'loc') { shorewall::rule { "torrent-tcp": action => 'DNAT', source => 'all', destination => "$zone:$destination", proto => 'tcp', destinationport => "6881:6999", ratelimit => '-', order => "200", } shorewall::rule { "torrent-udp": action => 'DNAT', source => 'all', destination => "$zone:$destination", proto => 'udp', destinationport => "6881:6999", ratelimit => '-', order => "201", } } # See http://www.shorewall.net/FAQ.htm#faq2 class firewall::router::hairpinning($order = '200', $proto = 'tcp', $port = 'www', $external_ip = '$ETH0_IP', $interface = 'eth1', $destination = '192.168.1.100') { shorewall::masq { "routeback-$name": interface => '$interface:$destination', source => '$interface', address => $external_ip', proto => $proto, port => $port, order => $order, } shorewall::rule { "routeback-$name": action => 'DNAT', source => 'loc', destination => "loc:$destination", proto => $proto, destinationport => $port, ratelimit => '-', order => $order, originaldest => $external_ip, } }