aboutsummaryrefslogtreecommitdiff
path: root/manifests/rules
diff options
context:
space:
mode:
authorMicah Anderson <micah@riseup.net>2013-06-14 13:27:03 -0400
committerMicah Anderson <micah@riseup.net>2013-06-14 13:27:03 -0400
commit06c5058752f7c1856380766784f48e077c3194ed (patch)
tree280b09cbadeb2fe2de163112bc2f64d1fce651d0 /manifests/rules
parent25cea9a44ab5e949e1fe0a470bb8d7c4c7bfd014 (diff)
parentddb4e09e4c6124b321c7b8abb50f45efa062b22c (diff)
downloadpuppet-shorewall-06c5058752f7c1856380766784f48e077c3194ed.tar.gz
puppet-shorewall-06c5058752f7c1856380766784f48e077c3194ed.tar.bz2
Merge remote-tracking branch 'intrigeri/feature/libvirt-host'
Diffstat (limited to 'manifests/rules')
-rw-r--r--manifests/rules/libvirt/host.pp50
1 files changed, 36 insertions, 14 deletions
diff --git a/manifests/rules/libvirt/host.pp b/manifests/rules/libvirt/host.pp
index aaecd9d..dfb753c 100644
--- a/manifests/rules/libvirt/host.pp
+++ b/manifests/rules/libvirt/host.pp
@@ -1,13 +1,21 @@
class shorewall::rules::libvirt::host (
- $vmz = 'vmz',
- $masq_iface = 'eth0',
+ $vmz = 'vmz',
+ $masq_iface = 'eth0',
+ $debproxy_port = 8000,
) {
define shorewall::rule::accept::from_vmz (
- $proto = '-', $destinationport = '-', $action = 'ACCEPT' ) {
- shorewall::rule { "$name":
- source => $vmz, destination => '$FW', order => 300,
- proto => $proto, destinationport => $destinationport, action => $action;
+ $proto = '-',
+ $destinationport = '-',
+ $action = 'ACCEPT'
+ ) {
+ shorewall::rule { $name:
+ source => $shorewall::rules::libvirt::host::vmz,
+ destination => '$FW',
+ order => 300,
+ proto => $proto,
+ destinationport => $destinationport,
+ action => $action;
}
}
@@ -31,16 +39,30 @@ class shorewall::rules::libvirt::host (
}
shorewall::rule::accept::from_vmz {
- 'accept_dns_from_vmz': action => 'DNS(ACCEPT)';
- 'accept_tftp_from_vmz': action => 'TFTP(ACCEPT)';
- 'accept_debproxy_from_vmz': proto => 'tcp', destinationport => '8000', action => 'ACCEPT';
- 'accept_puppet_from_vmz': proto => 'tcp', destinationport => '8140', action => 'ACCEPT';
+ 'accept_dns_from_vmz':
+ action => 'DNS(ACCEPT)';
+ 'accept_tftp_from_vmz':
+ action => 'TFTP(ACCEPT)';
+ 'accept_puppet_from_vmz':
+ proto => 'tcp',
+ destinationport => '8140',
+ action => 'ACCEPT';
}
- shorewall::masq {
- "masq-${masq_iface}":
- interface => "$masq_iface",
- source => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+ if $debproxy_port {
+ shorewall::rule::accept::from_vmz { 'accept_debproxy_from_vmz':
+ proto => 'tcp',
+ destinationport => $debproxy_port,
+ action => 'ACCEPT';
+ }
+ }
+
+ if $masq_iface {
+ shorewall::masq {
+ "masq-${masq_iface}":
+ interface => $masq_iface,
+ source => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+ }
}
}