aboutsummaryrefslogtreecommitdiff
path: root/manifests/rules
diff options
context:
space:
mode:
Diffstat (limited to 'manifests/rules')
-rw-r--r--manifests/rules/dns.pp20
-rw-r--r--manifests/rules/dns/disable.pp7
-rw-r--r--manifests/rules/dns_rules.pp22
-rw-r--r--manifests/rules/ipsec.pp62
-rw-r--r--manifests/rules/jabberserver.pp41
-rw-r--r--manifests/rules/libvirt/host.pp62
-rw-r--r--manifests/rules/managesieve.pp30
-rw-r--r--manifests/rules/munin.pp4
-rw-r--r--manifests/rules/openvpn.pp18
-rw-r--r--manifests/rules/out/managesieve.pp30
-rw-r--r--manifests/rules/out/pyzor.pp12
-rw-r--r--manifests/rules/out/razor.pp12
12 files changed, 225 insertions, 95 deletions
diff --git a/manifests/rules/dns.pp b/manifests/rules/dns.pp
index 99311ca..e775eee 100644
--- a/manifests/rules/dns.pp
+++ b/manifests/rules/dns.pp
@@ -1,18 +1,6 @@
+# open dns port
class shorewall::rules::dns {
- shorewall::rule {
- 'net-me-tcp_dns':
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '53',
- order => 240,
- action => 'ACCEPT';
- 'net-me-udp_dns':
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => '53',
- order => 240,
- action => 'ACCEPT';
- }
+ shorewall::rules::dns_rules{
+ 'net':
+ }
}
diff --git a/manifests/rules/dns/disable.pp b/manifests/rules/dns/disable.pp
index 36541da..7de923b 100644
--- a/manifests/rules/dns/disable.pp
+++ b/manifests/rules/dns/disable.pp
@@ -1,5 +1,6 @@
+# disable dns acccess
class shorewall::rules::dns::disable inherits shorewall::rules::dns {
- Shorewall::Rule['net-me-tcp_dns', 'net-me-udp_dns']{
- action => 'DROP',
- }
+ Shorewall::Rules::Dns_rules['net']{
+ action => 'DROP',
+ }
}
diff --git a/manifests/rules/dns_rules.pp b/manifests/rules/dns_rules.pp
new file mode 100644
index 0000000..abe0eb5
--- /dev/null
+++ b/manifests/rules/dns_rules.pp
@@ -0,0 +1,22 @@
+# open dns port
+define shorewall::rules::dns_rules(
+ $source = $name,
+ $action = 'ACCEPT',
+) {
+ shorewall::rule {
+ "${source}-me-tcp_dns":
+ source => $source,
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '53',
+ order => 240,
+ action => $action;
+ "${source}-me-udp_dns":
+ source => $source,
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '53',
+ order => 240,
+ action => $action;
+ }
+}
diff --git a/manifests/rules/ipsec.pp b/manifests/rules/ipsec.pp
index 82adff0..413406e 100644
--- a/manifests/rules/ipsec.pp
+++ b/manifests/rules/ipsec.pp
@@ -1,32 +1,32 @@
-class shorewall::rules::ipsec(
- $source = 'net'
-) {
- shorewall::rule {
- 'net-me-ipsec-udp':
- source => $shorewall::rules::ipsec::source,
- destination => '$FW',
- proto => 'udp',
- destinationport => '500',
- order => 240,
- action => 'ACCEPT';
- 'me-net-ipsec-udp':
- source => '$FW',
- destination => $shorewall::rules::ipsec::source,
- proto => 'udp',
- destinationport => '500',
- order => 240,
- action => 'ACCEPT';
- 'net-me-ipsec':
- source => $shorewall::rules::ipsec::source,
- destination => '$FW',
- proto => 'esp',
- order => 240,
- action => 'ACCEPT';
- 'me-net-ipsec':
- source => '$FW',
- destination => $shorewall::rules::ipsec::source,
- proto => 'esp',
- order => 240,
- action => 'ACCEPT';
- }
+# manage ipsec rules for zone specified in
+# $name
+define shorewall::rules::ipsec() {
+ shorewall::rule {
+ "${name}-me-ipsec-udp":
+ source => $name,
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '500',
+ order => 240,
+ action => 'ACCEPT';
+ "me-${name}-ipsec-udp":
+ source => '$FW',
+ destination => $name,
+ proto => 'udp',
+ destinationport => '500',
+ order => 240,
+ action => 'ACCEPT';
+ "${name}-me-ipsec":
+ source => $name,
+ destination => '$FW',
+ proto => 'esp',
+ order => 240,
+ action => 'ACCEPT';
+ "me-${name}-ipsec":
+ source => '$FW',
+ destination => $name,
+ proto => 'esp',
+ order => 240,
+ action => 'ACCEPT';
+ }
}
diff --git a/manifests/rules/jabberserver.pp b/manifests/rules/jabberserver.pp
index 3b38b29..226d627 100644
--- a/manifests/rules/jabberserver.pp
+++ b/manifests/rules/jabberserver.pp
@@ -1,19 +1,34 @@
-class shorewall::rules::jabberserver {
+# open ports used by a jabberserver
+# in and outbound.
+class shorewall::rules::jabberserver(
+ $open_stun = true,
+) {
shorewall::rule {
'net-me-tcp_jabber':
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '5222,5223,5269',
- order => 240,
- action => 'ACCEPT';
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '5222,5223,5269',
+ order => 240,
+ action => 'ACCEPT';
'me-net-tcp_jabber_s2s':
- source => '$FW',
- destination => 'net',
- proto => 'tcp',
- destinationport => '5260,5269,5270,5271,5272',
- order => 240,
- action => 'ACCEPT';
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '5260,5269,5270,5271,5272',
+ order => 240,
+ action => 'ACCEPT';
}
+ if $open_stun {
+ shorewall::rule {
+ 'net-me-udp_jabber_stun_server':
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '3478',
+ order => 240,
+ action => 'ACCEPT';
+ }
+ }
}
diff --git a/manifests/rules/libvirt/host.pp b/manifests/rules/libvirt/host.pp
index aaecd9d..dc3970d 100644
--- a/manifests/rules/libvirt/host.pp
+++ b/manifests/rules/libvirt/host.pp
@@ -1,13 +1,23 @@
class shorewall::rules::libvirt::host (
- $vmz = 'vmz',
- $masq_iface = 'eth0',
+ $vmz = 'vmz',
+ $masq_iface = 'eth0',
+ $debproxy_port = 8000,
+ $accept_dhcp = true,
+ $vmz_iface = 'virbr0',
) {
define shorewall::rule::accept::from_vmz (
- $proto = '-', $destinationport = '-', $action = 'ACCEPT' ) {
- shorewall::rule { "$name":
- source => $vmz, destination => '$FW', order => 300,
- proto => $proto, destinationport => $destinationport, action => $action;
+ $proto = '-',
+ $destinationport = '-',
+ $action = 'ACCEPT'
+ ) {
+ shorewall::rule { $name:
+ source => $shorewall::rules::libvirt::host::vmz,
+ destination => '$FW',
+ order => 300,
+ proto => $proto,
+ destinationport => $destinationport,
+ action => $action;
}
}
@@ -31,16 +41,40 @@ class shorewall::rules::libvirt::host (
}
shorewall::rule::accept::from_vmz {
- 'accept_dns_from_vmz': action => 'DNS(ACCEPT)';
- 'accept_tftp_from_vmz': action => 'TFTP(ACCEPT)';
- 'accept_debproxy_from_vmz': proto => 'tcp', destinationport => '8000', action => 'ACCEPT';
- 'accept_puppet_from_vmz': proto => 'tcp', destinationport => '8140', action => 'ACCEPT';
+ 'accept_dns_from_vmz':
+ action => 'DNS(ACCEPT)';
+ 'accept_tftp_from_vmz':
+ action => 'TFTP(ACCEPT)';
+ 'accept_puppet_from_vmz':
+ proto => 'tcp',
+ destinationport => '8140',
+ action => 'ACCEPT';
}
- shorewall::masq {
- "masq-${masq_iface}":
- interface => "$masq_iface",
- source => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+ if $accept_dhcp {
+ shorewall::mangle { "CHECKSUM:T_${vmz_iface}":
+ action => 'CHECKSUM:T',
+ source => '-',
+ destination => $vmz_iface,
+ proto => 'udp',
+ destinationport => '68';
+ }
+ }
+
+ if $debproxy_port {
+ shorewall::rule::accept::from_vmz { 'accept_debproxy_from_vmz':
+ proto => 'tcp',
+ destinationport => $debproxy_port,
+ action => 'ACCEPT';
+ }
+ }
+
+ if $masq_iface {
+ shorewall::masq {
+ "masq-${masq_iface}":
+ interface => $masq_iface,
+ source => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+ }
}
}
diff --git a/manifests/rules/managesieve.pp b/manifests/rules/managesieve.pp
index 63fafcb..ce1c321 100644
--- a/manifests/rules/managesieve.pp
+++ b/manifests/rules/managesieve.pp
@@ -1,11 +1,25 @@
-class shorewall::rules::managesieve {
+# manage managesieve ports
+class shorewall::rules::managesieve(
+ $legacy_port = false,
+) {
+ shorewall::rule {
+ 'net-me-tcp_managesieve':
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '4190',
+ order => 260,
+ action => 'ACCEPT';
+ }
+ if $legacy_port {
shorewall::rule {
- 'net-me-tcp_managesieve':
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '2000',
- order => 260,
- action => 'ACCEPT';
+ 'net-me-tcp_managesieve_legacy':
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '2000',
+ order => 260,
+ action => 'ACCEPT';
}
+ }
}
diff --git a/manifests/rules/munin.pp b/manifests/rules/munin.pp
index 0c86abe..a20a4e0 100644
--- a/manifests/rules/munin.pp
+++ b/manifests/rules/munin.pp
@@ -1,10 +1,10 @@
class shorewall::rules::munin(
$munin_port = '4949',
- $munin_collector = '127.0.0.1',
+ $munin_collector = ['127.0.0.1'],
$collector_source = 'net'
){
shorewall::params { 'MUNINPORT': value => $munin_port }
- shorewall::params { 'MUNINCOLLECTOR': value => join($munin_collector,',') }
+ shorewall::params { 'MUNINCOLLECTOR': value => join(any2array($munin_collector),',') }
shorewall::rule{'net-me-munin-tcp':
source => "${collector_source}:\$MUNINCOLLECTOR",
destination => '$FW',
diff --git a/manifests/rules/openvpn.pp b/manifests/rules/openvpn.pp
new file mode 100644
index 0000000..55a20d2
--- /dev/null
+++ b/manifests/rules/openvpn.pp
@@ -0,0 +1,18 @@
+class shorewall::rules::openvpn {
+ shorewall::rule { 'net-me-openvpn-udp':
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '1194',
+ order => 240,
+ action => 'ACCEPT';
+ }
+ shorewall::rule { 'me-net-openvpn-udp':
+ source => '$FW',
+ destination => 'net',
+ proto => 'udp',
+ destinationport => '1194',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/out/managesieve.pp b/manifests/rules/out/managesieve.pp
index b0e1c3d..c4147d4 100644
--- a/manifests/rules/out/managesieve.pp
+++ b/manifests/rules/out/managesieve.pp
@@ -1,11 +1,25 @@
-class shorewall::rules::out::managesieve {
+# manage outgoing traffic to managesieve
+class shorewall::rules::out::managesieve(
+ $legacy_port = false
+) {
+ shorewall::rule {
+ 'me-net-tcp_managesieve':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '4190',
+ order => 260,
+ action => 'ACCEPT';
+ }
+ if $legacy_port {
shorewall::rule {
- 'me-net-tcp_managesieve':
- source => '$FW',
- destination => 'net',
- proto => 'tcp',
- destinationport => '2000',
- order => 260,
- action => 'ACCEPT';
+ 'me-net-tcp_managesieve_legacy':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '2000',
+ order => 260,
+ action => 'ACCEPT';
}
+ }
}
diff --git a/manifests/rules/out/pyzor.pp b/manifests/rules/out/pyzor.pp
new file mode 100644
index 0000000..f4f5151
--- /dev/null
+++ b/manifests/rules/out/pyzor.pp
@@ -0,0 +1,12 @@
+# pyzor calls out on 24441
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::pyzor {
+ shorewall::rule { 'me-net-udp_pyzor':
+ source => '$FW',
+ destination => 'net',
+ proto => 'udp',
+ destinationport => '24441',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/out/razor.pp b/manifests/rules/out/razor.pp
new file mode 100644
index 0000000..1f8397c
--- /dev/null
+++ b/manifests/rules/out/razor.pp
@@ -0,0 +1,12 @@
+# razor calls out on 2703
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::razor {
+ shorewall::rule { 'me-net-tcp_razor':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '2703',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-26 18:44:06 +0000