aboutsummaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
authorintrigeri <intrigeri@boum.org>2012-11-11 23:12:14 +0100
committerintrigeri <intrigeri@boum.org>2012-11-11 23:12:14 +0100
commit6c29c55b9cc35a3ba06704e34dd3483a33c85898 (patch)
tree5e7afe57f5911bdf6df30628ce98dc77415ba47c /manifests
parent8080f1a892a69dc171187c8165d7e81f5b5b512d (diff)
parent8a98c5b47995f54a2619f5fe2964edd792bb051f (diff)
downloadpuppet-shorewall-6c29c55b9cc35a3ba06704e34dd3483a33c85898.tar.gz
puppet-shorewall-6c29c55b9cc35a3ba06704e34dd3483a33c85898.tar.bz2
Merge branch 'feature/libvirt-host' into old-master
Diffstat (limited to 'manifests')
-rw-r--r--manifests/rules/libvirt/host.pp47
1 files changed, 47 insertions, 0 deletions
diff --git a/manifests/rules/libvirt/host.pp b/manifests/rules/libvirt/host.pp
new file mode 100644
index 0000000..ac60b98
--- /dev/null
+++ b/manifests/rules/libvirt/host.pp
@@ -0,0 +1,47 @@
+class shorewall::rules::libvirt::host (
+ $vmz = 'vmz',
+ $masq_iface = 'eth0',
+ ) {
+
+ define shorewall::rule::accept::from_vmz (
+ $proto = '-', $destinationport = '-', $action = 'ACCEPT' ) {
+ shorewall::rule { "$name":
+ source => $vmz, destination => '$FW', order => 300,
+ proto => $proto, destinationport => $destinationport, action => $action;
+ }
+ }
+
+ shorewall::policy {
+ 'fw-to-vmz':
+ sourcezone => '$FW',
+ destinationzone => $vmz,
+ policy => 'ACCEPT',
+ order => 110;
+ 'vmz-to-net':
+ sourcezone => $vmz,
+ destinationzone => 'net',
+ policy => 'ACCEPT',
+ order => 200;
+ 'vmz-to-all':
+ sourcezone => $vmz,
+ destinationzone => 'all',
+ policy => 'DROP',
+ shloglevel => 'info',
+ order => 800;
+ }
+
+ shorewall::rule::accept::from_vmz {
+ 'accept_ftp_from_vmz': action => 'FTP(ACCEPT)';
+ 'accept_dns_from_vmz': action => 'DNS(ACCEPT)';
+ 'accept_tftp_from_vmz': action => 'TFTP(ACCEPT)';
+ 'accept_debproxy_from_vmz': proto => 'tcp', destinationport => '8000', action => 'ACCEPT';
+ 'accept_puppet_from_vmz': proto => 'tcp', destinationport => '8140', action => 'ACCEPT';
+ }
+
+ shorewall::masq {
+ "masq-${masq_iface}":
+ interface => "$masq_iface",
+ source => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+ }
+
+}