diff options
| -rw-r--r-- | files/shorewall.conf.Ubuntu.karmic | 193 | ||||
| -rw-r--r-- | manifests/base.pp | 6 | ||||
| -rw-r--r-- | manifests/debian.pp | 2 | ||||
| -rw-r--r-- | manifests/init.pp | 4 |
4 files changed, 200 insertions, 5 deletions
diff --git a/files/shorewall.conf.Ubuntu.karmic b/files/shorewall.conf.Ubuntu.karmic new file mode 100644 index 0000000..c348017 --- /dev/null +++ b/files/shorewall.conf.Ubuntu.karmic @@ -0,0 +1,193 @@ +#### +#### Managed by puppet, modify only on the puppetmaster +#### +############################################################################### +# /etc/shorewall/shorewall.conf V4.0 - Change the following variables to +# match your setup +# +# This program is under GPL +# +# This file should be placed in /etc/shorewall +# +# (c) 1999,2000,2001,2002,2003,2004,2005, +# 2006,2007 - Tom Eastep (teastep@shorewall.net) +# +# +# For information about the settings in this file, type "man shorewall.conf" +# +# Additional information is available at +# http://www.shorewall.net/Documentation.htm#Conf +############################################################################### +# S T A R T U P E N A B L E D +############################################################################### + +STARTUP_ENABLED=Yes + +############################################################################### +# V E R B O S I T Y +############################################################################### + +VERBOSITY=1 + +############################################################################### +# C O M P I L E R +# (setting this to 'perl' requires installation of Shorewall-perl) +############################################################################### + +SHOREWALL_COMPILER=shell + +############################################################################### +# L O G G I N G +############################################################################### + +LOGFILE=/var/log/messages + +LOGFORMAT="Shorewall:%s:%s:" + +LOGTAGONLY=No + +LOGRATE= + +LOGBURST= + +LOGALLNEW= + +BLACKLIST_LOGLEVEL= + +MACLIST_LOG_LEVEL=info + +TCP_FLAGS_LOG_LEVEL=info + +RFC1918_LOG_LEVEL=info + +SMURF_LOG_LEVEL=info + +LOG_MARTIANS=No + +############################################################################### +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +############################################################################### + +IPTABLES= + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin + +SHOREWALL_SHELL=/bin/sh + +SUBSYSLOCK="" + +MODULESDIR= + +# add puppet delivered files in front +CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall + +RESTOREFILE= + +IPSECFILE=zones + +LOCKFILE= + +############################################################################### +# D E F A U L T A C T I O N S / M A C R O S +############################################################################### + +DROP_DEFAULT="Drop" +REJECT_DEFAULT="Reject" +ACCEPT_DEFAULT="none" +QUEUE_DEFAULT="none" +NFQUEUE_DEFAULT="none" + +############################################################################### +# R S H / R C P C O M M A N D S +############################################################################### + +RSH_COMMAND='ssh ${root}@${system} ${command}' +RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' + +############################################################################### +# F I R E W A L L O P T I O N S +############################################################################### + +IP_FORWARDING=Keep + +ADD_IP_ALIASES=Yes + +ADD_SNAT_ALIASES=No + +RETAIN_ALIASES=No + +TC_ENABLED=Internal + +TC_EXPERT=No + +CLEAR_TC=Yes + +MARK_IN_FORWARD_CHAIN=No + +CLAMPMSS=No + +ROUTE_FILTER=Yes + +DETECT_DNAT_IPADDRS=No + +MUTEX_TIMEOUT=60 + +ADMINISABSENTMINDED=Yes + +BLACKLISTNEWONLY=Yes + +DELAYBLACKLISTLOAD=No + +MODULE_SUFFIX= + +DISABLE_IPV6=Yes + +BRIDGING=No + +DYNAMIC_ZONES=No + +PKTTYPE=Yes + +RFC1918_STRICT=No + +MACLIST_TABLE=filter + +MACLIST_TTL= + +SAVE_IPSETS=No + +MAPOLDACTIONS=No + +FASTACCEPT=No + +IMPLICIT_CONTINUE=Yes + +HIGH_ROUTE_MARKS=No + +USE_ACTIONS=Yes + +OPTIMIZE=0 + +EXPORTPARAMS=Yes + +EXPAND_POLICIES=Yes + +KEEP_RT_TABLES=No + +DELETE_THEN_ADD=Yes + +MULTICAST=No + +DONT_LOAD= + +############################################################################### +# P A C K E T D I S P O S I T I O N +############################################################################### + +BLACKLIST_DISPOSITION=DROP + +MACLIST_DISPOSITION=REJECT + +TCP_FLAGS_DISPOSITION=DROP + +#LAST LINE -- DO NOT REMOVE diff --git a/manifests/base.pp b/manifests/base.pp index c814795..8a3d5c3 100644 --- a/manifests/base.pp +++ b/manifests/base.pp @@ -1,5 +1,5 @@ class shorewall::base { - package { 'shorewall': + package { 'shorewall-shell': ensure => present, } @@ -16,7 +16,7 @@ class shorewall::base { "puppet://$server/modules/shorewall/shorewall.conf.$operatingsystem", "puppet://$server/modules/shorewall/shorewall.conf" ], - require => Package[shorewall], + require => Package[shorewall-shell], notify => Service[shorewall], owner => root, group => 0, mode => 0644; } @@ -40,6 +40,6 @@ class shorewall::base { Exec["concat_/var/lib/puppet/modules/shorewall/routestopped"], Exec["concat_/var/lib/puppet/modules/shorewall/params"] ], - require => Package[shorewall], + require => Package[shorewall-shell], } } diff --git a/manifests/debian.pp b/manifests/debian.pp index 2583d85..a658cdc 100644 --- a/manifests/debian.pp +++ b/manifests/debian.pp @@ -1,7 +1,7 @@ class shorewall::debian inherits shorewall::base { file{'/etc/default/shorewall': source => "puppet://$server/modules/shorewall/debian/default", - require => Package['shorewall'], + require => Package['shorewall-shell'], notify => Service['shorewall'], owner => root, group => 0, mode => 0644; } diff --git a/manifests/init.pp b/manifests/init.pp index d05504e..1daf403 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -5,7 +5,9 @@ class shorewall { case $operatingsystem { gentoo: { include shorewall::gentoo } debian: { include shorewall::debian } - default: { include shorewall::base } + ubuntu: { include shorewall::debian } + default: { notice "unknown operatingsystem: $operatingsystem" + include shorewall::base } } file {"/var/lib/puppet/modules/shorewall": |