diff options
| -rw-r--r-- | files/boilerplate/params.footer | 1 | ||||
| -rw-r--r-- | files/boilerplate/params.header | 26 | ||||
| -rw-r--r-- | files/shorewall.conf.CentOS | 192 | ||||
| l---------[-rw-r--r--] | files/shorewall.conf.Default | 181 | ||||
| -rw-r--r-- | files/shorewall.conf.Gentoo | 180 | ||||
| -rw-r--r-- | manifests/init.pp | 152 |
6 files changed, 500 insertions, 232 deletions
diff --git a/files/boilerplate/params.footer b/files/boilerplate/params.footer new file mode 100644 index 0000000..662ac1c --- /dev/null +++ b/files/boilerplate/params.footer @@ -0,0 +1 @@ +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/params.header b/files/boilerplate/params.header new file mode 100644 index 0000000..b258b0d --- /dev/null +++ b/files/boilerplate/params.header @@ -0,0 +1,26 @@ +# +# Shorewall version 3.4 - Params File +# +# /etc/shorewall/params +# +# Assign any variables that you need here. +# +# It is suggested that variable names begin with an upper case letter +# to distinguish them from variables used internally within the +# Shorewall programs +# +# Example: +# +# NET_IF=eth0 +# NET_BCAST=130.252.100.255 +# NET_OPTIONS=routefilter,norfc1918 +# +# Example (/etc/shorewall/interfaces record): +# +# net $NET_IF $NET_BCAST $NET_OPTIONS +# +# The result will be the same as if the record had been written +# +# net eth0 130.252.100.255 routefilter,norfc1918 +# +############################################################################### diff --git a/files/shorewall.conf.CentOS b/files/shorewall.conf.CentOS new file mode 100644 index 0000000..979e4ff --- /dev/null +++ b/files/shorewall.conf.CentOS @@ -0,0 +1,192 @@ +#### +#### Managed by puppet, modify only on the puppetmaster +#### +###################O############################################################ +# /etc/shorewall/shorewall.conf V4.0 - Change the following variables to +# match your setup +# +# This program is under GPL +# [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] +# +# This file should be placed in /etc/shorewall +# +# (c) 1999,2000,2001,2002,2003,2004,2005, +# 2006,2007 - Tom Eastep (teastep@shorewall.net) +# +# For information about the settings in this file, type "man shorewall.conf" +# +# Additional information is available at +# http://www.shorewall.net/Documentation.htm#Conf +############################################################################### +# S T A R T U P E N A B L E D +############################################################################### + +STARTUP_ENABLED=Yes + +############################################################################### +# V E R B O S I T Y +############################################################################### + +VERBOSITY=1 + +############################################################################### +# C O M P I L E R +# (setting this to 'perl' requires installation of Shorewall-perl) +############################################################################### + +SHOREWALL_COMPILER= + +############################################################################### +# L O G G I N G +############################################################################### + +LOGFILE=/var/log/messages + +LOGFORMAT="Shorewall:%s:%s:" + +LOGTAGONLY=No + +LOGRATE= + +LOGBURST= + +LOGALLNEW= + +BLACKLIST_LOGLEVEL= + +MACLIST_LOG_LEVEL=info + +TCP_FLAGS_LOG_LEVEL=info + +RFC1918_LOG_LEVEL=info + +SMURF_LOG_LEVEL=info + +LOG_MARTIANS=No + +############################################################################### +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +############################################################################### + +IPTABLES= + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin + +SHOREWALL_SHELL=/bin/sh + +SUBSYSLOCK=/var/lock/subsys/shorewall + +MODULESDIR= + +CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall + +RESTOREFILE= + +IPSECFILE=zones + +LOCKFILE= + +############################################################################### +# D E F A U L T A C T I O N S / M A C R O S +############################################################################### + +DROP_DEFAULT="Drop" +REJECT_DEFAULT="Reject" +ACCEPT_DEFAULT="none" +QUEUE_DEFAULT="none" +NFQUEUE_DEFAULT="none" + +############################################################################### +# R S H / R C P C O M M A N D S +############################################################################### + +RSH_COMMAND='ssh ${root}@${system} ${command}' +RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' + +############################################################################### +# F I R E W A L L O P T I O N S +############################################################################### + +IP_FORWARDING=On + +ADD_IP_ALIASES=No + +ADD_SNAT_ALIASES=No + +RETAIN_ALIASES=No + +TC_ENABLED=Internal + +TC_EXPERT=No + +CLEAR_TC=Yes + +MARK_IN_FORWARD_CHAIN=Yes + +CLAMPMSS=No + +ROUTE_FILTER=No + +DETECT_DNAT_IPADDRS=Yes + +MUTEX_TIMEOUT=60 + +ADMINISABSENTMINDED=Yes + +BLACKLISTNEWONLY=Yes + +DELAYBLACKLISTLOAD=No + +MODULE_SUFFIX= + +DISABLE_IPV6=Yes + +BRIDGING=No + +DYNAMIC_ZONES=No + +PKTTYPE=No + +RFC1918_STRICT=No + +MACLIST_TABLE=mangle + +MACLIST_TTL= + +SAVE_IPSETS=No + +MAPOLDACTIONS=No + +FASTACCEPT=No + +IMPLICIT_CONTINUE=Yes + +HIGH_ROUTE_MARKS=No + +USE_ACTIONS=Yes + +OPTIMIZE=0 + +EXPORTPARAMS=Yes + +EXPAND_POLICIES=Yes + +KEEP_RT_TABLES=No + +DELETE_THEN_ADD=Yes + +MULTICAST=No + +DONT_LOAD= + +############################################################################### +# P A C K E T D I S P O S I T I O N +############################################################################### + +BLACKLIST_DISPOSITION=DROP + +MACLIST_DISPOSITION=DROP + +TCP_FLAGS_DISPOSITION=DROP + +#LAST LINE -- DO NOT REMOVE diff --git a/files/shorewall.conf.Default b/files/shorewall.conf.Default index 0097726..9b62b61 100644..120000 --- a/files/shorewall.conf.Default +++ b/files/shorewall.conf.Default @@ -1,180 +1 @@ -#### -#### Managed by puppet, modify only on the puppetmaster -#### -############################################################################### -# /etc/shorewall/shorewall.conf V3.4 - Change the following variables to -# match your setup -# -# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] -# -# This file should be placed in /etc/shorewall -# -# (c) 1999,2000,2001,2002,2003,2004,2005 - Tom Eastep (teastep@shorewall.net) -# -# For information about the settings in this file, type "man shorewall.conf" -# -# Additional information is available at -# http://www.shorewall.net/3.0/Documentation.htm#Conf -############################################################################### -# S T A R T U P E N A B L E D -############################################################################### - -STARTUP_ENABLED=Yes - -############################################################################### -# V E R B O S I T Y -############################################################################### - -VERBOSITY=1 - -############################################################################### -# C O M P I L E R -# (setting this to 'perl' requires installation of Shorewall-perl) -############################################################################### - -SHOREWALL_COMPILER=shell - -############################################################################### -# L O G G I N G -############################################################################### - -LOGFILE=/var/log/messages - -LOGFORMAT="Shorewall:%s:%s:" - -LOGTAGONLY=No - -LOGRATE= - -LOGBURST= - -LOGALLNEW= - -BLACKLIST_LOGLEVEL= - -MACLIST_LOG_LEVEL=info - -TCP_FLAGS_LOG_LEVEL=info - -RFC1918_LOG_LEVEL=info - -SMURF_LOG_LEVEL=info - -LOG_MARTIANS=No - -############################################################################### -# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S -############################################################################### - -IPTABLES= - -PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin - -SHOREWALL_SHELL=/bin/sh - -SUBSYSLOCK="/var/lock/subsys/shorewall" - -MODULESDIR= - -# add puppet delivered files in front -CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall - -RESTOREFILE= - -IPSECFILE=zones - -LOCKFILE= - -############################################################################### -# D E F A U L T A C T I O N S / M A C R O S -############################################################################### - -DROP_DEFAULT="Drop" -REJECT_DEFAULT="Reject" -ACCEPT_DEFAULT="none" -QUEUE_DEFAULT="none" - -############################################################################### -# R S H / R C P C O M M A N D S -############################################################################### - -RSH_COMMAND='ssh ${root}@${system} ${command}' -RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' - -############################################################################### -# F I R E W A L L O P T I O N S -############################################################################### - -IP_FORWARDING=On - -ADD_IP_ALIASES=No - -ADD_SNAT_ALIASES=No - -RETAIN_ALIASES=No - -TC_ENABLED=Internal - -TC_EXPERT=No - -CLEAR_TC=Yes - -MARK_IN_FORWARD_CHAIN=Yes - -CLAMPMSS=Yes - -ROUTE_FILTER=No - -DETECT_DNAT_IPADDRS=Yes - -MUTEX_TIMEOUT=60 - -ADMINISABSENTMINDED=Yes - -BLACKLISTNEWONLY=Yes - -DELAYBLACKLISTLOAD=No - -MODULE_SUFFIX= - -DISABLE_IPV6=Yes - -BRIDGING=No - -DYNAMIC_ZONES=No - -PKTTYPE=No - -RFC1918_STRICT=No - -MACLIST_TABLE=mangle - -MACLIST_TTL= - -SAVE_IPSETS=No - -MAPOLDACTIONS=No - -FASTACCEPT=Yes - -IMPLICIT_CONTINUE=Yes - -HIGH_ROUTE_MARKS=No - -USE_ACTIONS=Yes - -OPTIMIZE=0 - -EXPORTPARAMS=Yes - -############################################################################### -# P A C K E T D I S P O S I T I O N -############################################################################### - -BLACKLIST_DISPOSITION=DROP - -MACLIST_DISPOSITION=DROP - -TCP_FLAGS_DISPOSITION=DROP - -#LAST LINE -- DO NOT REMOVE +shorewall.conf.CentOS
\ No newline at end of file diff --git a/files/shorewall.conf.Gentoo b/files/shorewall.conf.Gentoo new file mode 100644 index 0000000..7d8049d --- /dev/null +++ b/files/shorewall.conf.Gentoo @@ -0,0 +1,180 @@ +#### +#### Managed by puppet, modify only on the puppetmaster +#### +############################################################################### +# /etc/shorewall/shorewall.conf V3.4 - Change the following variables to +# match your setup +# +# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] +# +# This file should be placed in /etc/shorewall +# +# (c) 1999,2000,2001,2002,2003,2004,2005 - Tom Eastep (teastep@shorewall.net) +# +# For information about the settings in this file, type "man shorewall.conf" +# +# Additional information is available at +# http://www.shorewall.net/3.0/Documentation.htm#Conf +############################################################################### +# S T A R T U P E N A B L E D +############################################################################### + +STARTUP_ENABLED=Yes + +############################################################################### +# V E R B O S I T Y +############################################################################### + +VERBOSITY=1 + +############################################################################### +# C O M P I L E R +# (setting this to 'perl' requires installation of Shorewall-perl) +############################################################################### + +SHOREWALL_COMPILER=shell + +############################################################################### +# L O G G I N G +############################################################################### + +LOGFILE=/var/log/messages + +LOGFORMAT="Shorewall:%s:%s:" + +LOGTAGONLY=No + +LOGRATE= + +LOGBURST= + +LOGALLNEW= + +BLACKLIST_LOGLEVEL= + +MACLIST_LOG_LEVEL=info + +TCP_FLAGS_LOG_LEVEL=info + +RFC1918_LOG_LEVEL=info + +SMURF_LOG_LEVEL=info + +LOG_MARTIANS=No + +############################################################################### +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +############################################################################### + +IPTABLES= + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin + +SHOREWALL_SHELL=/bin/sh + +SUBSYSLOCK="/var/lock/subsys/shorewall" + +MODULESDIR= + +# add puppet delivered files in front +CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall + +RESTOREFILE= + +IPSECFILE=zones + +LOCKFILE= + +############################################################################### +# D E F A U L T A C T I O N S / M A C R O S +############################################################################### + +DROP_DEFAULT="Drop" +REJECT_DEFAULT="Reject" +ACCEPT_DEFAULT="none" +QUEUE_DEFAULT="none" + +############################################################################### +# R S H / R C P C O M M A N D S +############################################################################### + +RSH_COMMAND='ssh ${root}@${system} ${command}' +RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' + +############################################################################### +# F I R E W A L L O P T I O N S +############################################################################### + +IP_FORWARDING=On + +ADD_IP_ALIASES=No + +ADD_SNAT_ALIASES=No + +RETAIN_ALIASES=No + +TC_ENABLED=Internal + +TC_EXPERT=No + +CLEAR_TC=Yes + +MARK_IN_FORWARD_CHAIN=Yes + +CLAMPMSS=No + +ROUTE_FILTER=No + +DETECT_DNAT_IPADDRS=Yes + +MUTEX_TIMEOUT=60 + +ADMINISABSENTMINDED=Yes + +BLACKLISTNEWONLY=Yes + +DELAYBLACKLISTLOAD=No + +MODULE_SUFFIX= + +DISABLE_IPV6=Yes + +BRIDGING=No + +DYNAMIC_ZONES=No + +PKTTYPE=No + +RFC1918_STRICT=No + +MACLIST_TABLE=mangle + +MACLIST_TTL= + +SAVE_IPSETS=No + +MAPOLDACTIONS=No + +FASTACCEPT=Yes + +IMPLICIT_CONTINUE=Yes + +HIGH_ROUTE_MARKS=No + +USE_ACTIONS=Yes + +OPTIMIZE=0 + +EXPORTPARAMS=Yes + +############################################################################### +# P A C K E T D I S P O S I T I O N +############################################################################### + +BLACKLIST_DISPOSITION=DROP + +MACLIST_DISPOSITION=DROP + +TCP_FLAGS_DISPOSITION=DROP + +#LAST LINE -- DO NOT REMOVE diff --git a/manifests/init.pp b/manifests/init.pp index 19c9145..33d9729 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,8 +1,7 @@ +# # modules/shorewall/manifests/init.pp - manage firewalling with shorewall 3.x # Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at> # See LICENSE for the full license granted to you. -# adapted by immerda project group -# admin+puppet(at)immerda.ch # # Based on the work of ADNET Ghislain <gadnet@aqueos.com> from AQUEOS # at https://reductivelabs.com/trac/puppet/wiki/AqueosShorewall @@ -16,53 +15,32 @@ # * add 000-header and 999-footer files for all managed_files # * added rule_section define and a few more parameters for rules # * add managing for masq, proxyarp, blacklist, nat, rfc1918 - +# +# adapted by immerda project group - admin+puppet(at)immerda.ch +# adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch +# modules_dir { "shorewall": } -class shorewall { +class shorewall { - package { 'shorewall': - ensure => present, - category => $operatingsystem ? { - gentoo => 'net-firewall', - default => '', - }, - } - - - service{shorewall: - ensure => running, - enable => true, - hasstatus => true, - hasrestart => true, - subscribe => [ - Exec["concat_/var/lib/puppet/modules/shorewall/zones"], - Exec["concat_/var/lib/puppet/modules/shorewall/interfaces"], - Exec["concat_/var/lib/puppet/modules/shorewall/hosts"], - Exec["concat_/var/lib/puppet/modules/shorewall/policy"], - Exec["concat_/var/lib/puppet/modules/shorewall/rules"], - Exec["concat_/var/lib/puppet/modules/shorewall/masq"], - Exec["concat_/var/lib/puppet/modules/shorewall/proxyarp"], - Exec["concat_/var/lib/puppet/modules/shorewall/nat"], - Exec["concat_/var/lib/puppet/modules/shorewall/blacklist"], - Exec["concat_/var/lib/puppet/modules/shorewall/rfc1918"], - Exec["concat_/var/lib/puppet/modules/shorewall/routestopped"] - ], + case $operatingsystem { + gentoo: { include shorewall::gentoo } + default: { include shorewall::base } } - file { + file { "/var/lib/puppet/modules/shorewall": ensure => directory, force => true, mode => 0755, owner => root, group => 0; - } - - # private + } + + # private define managed_file () { $dir = "/var/lib/puppet/modules/shorewall/${name}.d" concatenated_file { "/var/lib/puppet/modules/shorewall/$name": - dir => $dir, + dir => $dir, mode => 0600, } file { @@ -88,18 +66,6 @@ class shorewall { } } - # This file has to be managed in place, so shorewall can find it - file { "/etc/shorewall/shorewall.conf": - # use OS specific defaults, but use Default if no other is found - source => [ - "puppet://$server/shorewall/shorewall.conf.$operatingsystem.$lsbdistcodename", - "puppet://$server/shorewall/shorewall.conf.$operatingsystem", - "puppet://$server/shorewall/shorewall.conf.Default" - ], - mode => 0644, owner => root, group => 0, - notify => Service[shorewall], - } - # See http://www.shorewall.net/3.0/Documentation.htm#Zones managed_file{ zones: } define zone($type, $options = '-', $in = '-', $out = '-', $parent = '-', $order = 100) { @@ -111,9 +77,31 @@ class shorewall { # See http://www.shorewall.net/3.0/Documentation.htm#Interfaces managed_file{ interfaces: } - define interface($zone, $broadcast = 'detect', $options = 'tcpflags,blacklist,norfc1918,routefilter,nosmurfs,logmartians', $order='100') { + define interface( + $zone, + $broadcast = 'detect', + $options = 'tcpflags,blacklist,routefilter,nosmurfs,logmartians', + $rfc1918 = false, + $dhcp = false, + $order = 100 + ) + { + if $rfc1918 { + if $dhcp { + $options_real = "${options},dhcp" + } else { + $options_real = $options + } + } else { + if $dhcp { + $options_real = "${options},norfc1918,dhcp" + } else { + $options_real = "${options},norfc1918" + } + } + entry { "interfaces.d/${order}-${name}": - line => "${zone} ${name} ${broadcast} ${options}", + line => "${zone} ${name} ${broadcast} ${options_real}", } } @@ -195,11 +183,71 @@ class shorewall { # See http://www.shorewall.net/3.0/Documentation.htm#Routestopped managed_file { routestopped: } - define routestopped($host = '-', $options = '', $order='100') { + define routestopped($interface = '', $host = '-', $options = '', $order='100') { + $real_interface = $interface ? { + '' => $name, + default => $interface, + } entry { "routestopped.d/${order}-${name}": - line => "${name} ${host} ${options}", + line => "${real_interface} ${host} ${options}", } } + # See http://www.shorewall.net/3.0/Documentation.htm#Variables + managed_file { params: } + define params($value, $order='100'){ + entry { "params.d/${order}-${name}": + line => "${name}=${value}", + } + } + +} + +class shorewall::base { + + # service { shorewall: ensure => running, enable => true, } + package { 'shorewall': + ensure => present, + } + + # This file has to be managed in place, so shorewall can find it + file { "/etc/shorewall/shorewall.conf": + # use OS specific defaults, but use Default if no other is found + source => [ + "puppet://$server/shorewall/shorewall.conf.$operatingsystem.$lsbdistcodename", + "puppet://$server/shorewall/shorewall.conf.$operatingsystem", + "puppet://$server/shorewall/shorewall.conf.Default" + ], + mode => 0644, owner => root, group => 0, + require => Package[shorewall], + notify => Service[shorewall], + } + + service{shorewall: + ensure => running, + enable => true, + hasstatus => true, + hasrestart => true, + subscribe => [ + Exec["concat_/var/lib/puppet/modules/shorewall/zones"], + Exec["concat_/var/lib/puppet/modules/shorewall/interfaces"], + Exec["concat_/var/lib/puppet/modules/shorewall/hosts"], + Exec["concat_/var/lib/puppet/modules/shorewall/policy"], + Exec["concat_/var/lib/puppet/modules/shorewall/rules"], + Exec["concat_/var/lib/puppet/modules/shorewall/masq"], + Exec["concat_/var/lib/puppet/modules/shorewall/proxyarp"], + Exec["concat_/var/lib/puppet/modules/shorewall/nat"], + Exec["concat_/var/lib/puppet/modules/shorewall/blacklist"], + Exec["concat_/var/lib/puppet/modules/shorewall/rfc1918"], + Exec["concat_/var/lib/puppet/modules/shorewall/routestopped"], + Exec["concat_/var/lib/puppet/modules/shorewall/params"] + ], + require => Package[shorewall], + } } +class shorewall::gentoo inherits shorewall::base { + Package[shorewall]{ + category => 'net-firewall', + } +} |