class firewall::router::http($destination, $zone = 'loc') { shorewall::rule { 'http-route': action => 'DNAT', source => 'all', destination => "$zone:$destination:80", proto => 'tcp', destinationport => '80', ratelimit => '-', order => '600', } } class firewall::router::https($destination, $zone = 'loc') { shorewall::rule { 'https-route': action => 'DNAT', source => 'all', destination => "$zone:$destination:443", proto => 'tcp', destinationport => '443', ratelimit => '-', order => '602', } } class firewall::router::puppetmaster($destination, $puppetmaster_port = '8140', $puppetmaster_nonssl_port = '8141', $zone = 'loc') { shorewall::rule { 'puppetmaster-1': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_port", proto => 'tcp', destinationport => "$puppetmaster_port", ratelimit => '-', order => '700', } shorewall::rule { 'puppetmaster-2': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_port", proto => 'udp', destinationport => "$puppetmaster_port", ratelimit => '-', order => '701', } shorewall::rule { 'puppetmaster-3': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'tcp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => '704', } shorewall::rule { 'puppetmaster-4': action => 'DNAT', source => 'all', destination => "$zone:$destination:$puppetmaster_nonssl_port", proto => 'udp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => '705', } } class firewall::router::gitd($destination, $zone = 'loc') { shorewall::rule { 'git-daemon': action => 'DNAT', source => 'net', destination => "$zone:$destination:9418", proto => 'tcp', destinationport => '9418', ratelimit => '-', order => '800', } } class firewall::router::icecast($destination, $zone = 'loc') { shorewall::rule { 'icecast': action => 'DNAT', source => 'all', destination => "$zone:$destination:8000", proto => 'tcp', destinationport => '8000', ratelimit => '-', order => '900', } } class firewall::router::mail($destination, $zone = 'loc') { shorewall::rule { 'mail-1': action => 'DNAT', source => 'all', destination => "$zone:$destination:25", proto => 'tcp', destinationport => '25', ratelimit => '-', order => '1000', } shorewall::rule { 'mail-2': action => 'DNAT', source => 'all', destination => "$zone:$destination:993", proto => 'tcp', destinationport => '993', ratelimit => '-', order => '1002', } } define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc') { shorewall::rule { "ssh-$name": action => 'DNAT', source => 'all', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", ratelimit => '-', order => "2$port_orig", } } define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc', $order = '400') { shorewall::rule { "munin-$name": action => 'DNAT', source => 'all', destination => $port_dest ? { '' => "$zone:$destination", default => "$zone:$destination:$port_dest", }, proto => 'tcp', destinationport => "$port_orig", ratelimit => '-', order => $order, } } class firewall::router::torrent($destination, $zone = 'loc') { shorewall::rule { "torrent-tcp": action => 'DNAT', source => 'all', destination => "$zone:$destination", proto => 'tcp', destinationport => "6881:6999", ratelimit => '-', order => "200", } shorewall::rule { "torrent-udp": action => 'DNAT', source => 'all', destination => "$zone:$destination", proto => 'udp', destinationport => "6881:6999", ratelimit => '-', order => "201", } } # See http://www.shorewall.net/FAQ.htm#faq2 class firewall::router::hairpinning($order = '200', $proto = 'tcp', $port = 'www', $external_ip = '$ETH0_IP', $interface = 'eth1', $destination = '192.168.1.100') { shorewall::masq { "routeback-$name": interface => "$interface:$destination", source => $interface, address => $external_ip, proto => $proto, port => $port, order => $order, } shorewall::rule { "routeback-$name": action => 'DNAT', source => 'loc', destination => "loc:$destination", proto => $proto, destinationport => $port, ratelimit => '-', order => $order, originaldest => $external_ip, } }