diff options
author | intrigeri <intrigeri@boum.org> | 2010-12-17 19:39:44 +0100 |
---|---|---|
committer | intrigeri <intrigeri@boum.org> | 2010-12-17 19:39:44 +0100 |
commit | b39b5c24910f8816c3b9e6d2a0211ad892b36aa6 (patch) | |
tree | e0b7d6044597a4dc4a70c377274bc0075667ea21 /manifests/rules/torify/allow_tor_transparent_proxy.pp | |
parent | 3691f9c09adbb9dbde9bb945b0f4da0e5a525ced (diff) | |
download | puppet-shorewall-b39b5c24910f8816c3b9e6d2a0211ad892b36aa6.tar.gz puppet-shorewall-b39b5c24910f8816c3b9e6d2a0211ad892b36aa6.tar.bz2 |
Add support for Tor-ified traffic.
Diffstat (limited to 'manifests/rules/torify/allow_tor_transparent_proxy.pp')
-rw-r--r-- | manifests/rules/torify/allow_tor_transparent_proxy.pp | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/manifests/rules/torify/allow_tor_transparent_proxy.pp b/manifests/rules/torify/allow_tor_transparent_proxy.pp new file mode 100644 index 0000000..3c18db6 --- /dev/null +++ b/manifests/rules/torify/allow_tor_transparent_proxy.pp @@ -0,0 +1,21 @@ +class shorewall::rules::torify::allow_tor_transparent_proxy { + + $rule = "allow-tor-transparent-proxy" + + if !defined(Shorewall::Rule["$rule"]) { + # A weirdness in shorewall forces us to explicitly allow traffic to + # net:$tor_transparent_proxy_host:$tor_transparent_proxy_port even + # if $FW->$FW traffic is allowed. This anyway avoids us special-casing + # the remote Tor transparent proxy situation. + shorewall::rule { + "$rule": + source => '$FW', + destination => "net:${shorewall::tor_transparent_proxy_host}", + proto => 'tcp', + destinationport => $shorewall::tor_transparent_proxy_port, + order => 100, + action => 'ACCEPT'; + } + } + +} |