aboutsummaryrefslogtreecommitdiff
path: root/manifests/rules
diff options
context:
space:
mode:
Diffstat (limited to 'manifests/rules')
-rw-r--r--manifests/rules/dns/disable.pp5
-rw-r--r--manifests/rules/ipsec.pp12
-rw-r--r--manifests/rules/ipsec_nat.pp18
-rw-r--r--manifests/rules/jetty/http.pp2
-rw-r--r--manifests/rules/libvirt/host.pp46
-rw-r--r--manifests/rules/munin.pp12
-rw-r--r--manifests/rules/openfire.pp12
-rw-r--r--manifests/rules/out/ekeyd.pp4
-rw-r--r--manifests/rules/out/ibackup.pp23
-rw-r--r--manifests/rules/out/irc.pp10
-rw-r--r--manifests/rules/out/ircs.pp10
-rw-r--r--manifests/rules/out/munin.pp16
-rw-r--r--manifests/rules/out/puppet.pp30
-rw-r--r--manifests/rules/out/xmpp.pp10
-rw-r--r--manifests/rules/puppet.pp21
-rw-r--r--manifests/rules/puppet/master.pp17
-rw-r--r--manifests/rules/ssh.pp10
-rw-r--r--manifests/rules/tomcat.pp12
18 files changed, 201 insertions, 69 deletions
diff --git a/manifests/rules/dns/disable.pp b/manifests/rules/dns/disable.pp
new file mode 100644
index 0000000..36541da
--- /dev/null
+++ b/manifests/rules/dns/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::dns::disable inherits shorewall::rules::dns {
+ Shorewall::Rule['net-me-tcp_dns', 'net-me-udp_dns']{
+ action => 'DROP',
+ }
+}
diff --git a/manifests/rules/ipsec.pp b/manifests/rules/ipsec.pp
index 3e9db55..82adff0 100644
--- a/manifests/rules/ipsec.pp
+++ b/manifests/rules/ipsec.pp
@@ -1,7 +1,9 @@
-class shorewall::rules::ipsec {
+class shorewall::rules::ipsec(
+ $source = 'net'
+) {
shorewall::rule {
'net-me-ipsec-udp':
- source => 'net',
+ source => $shorewall::rules::ipsec::source,
destination => '$FW',
proto => 'udp',
destinationport => '500',
@@ -9,20 +11,20 @@ class shorewall::rules::ipsec {
action => 'ACCEPT';
'me-net-ipsec-udp':
source => '$FW',
- destination => 'net',
+ destination => $shorewall::rules::ipsec::source,
proto => 'udp',
destinationport => '500',
order => 240,
action => 'ACCEPT';
'net-me-ipsec':
- source => 'net',
+ source => $shorewall::rules::ipsec::source,
destination => '$FW',
proto => 'esp',
order => 240,
action => 'ACCEPT';
'me-net-ipsec':
source => '$FW',
- destination => 'net',
+ destination => $shorewall::rules::ipsec::source,
proto => 'esp',
order => 240,
action => 'ACCEPT';
diff --git a/manifests/rules/ipsec_nat.pp b/manifests/rules/ipsec_nat.pp
new file mode 100644
index 0000000..6c0d507
--- /dev/null
+++ b/manifests/rules/ipsec_nat.pp
@@ -0,0 +1,18 @@
+class shorewall::rules::ipsec_nat {
+ shorewall::rule {
+ 'net-me-ipsec-nat-udp':
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '4500',
+ order => 240,
+ action => 'ACCEPT';
+ 'me-net-ipsec-nat-udp':
+ source => '$FW',
+ destination => 'net',
+ proto => 'udp',
+ destinationport => '4500',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/jetty/http.pp b/manifests/rules/jetty/http.pp
index be19622..4c0652b 100644
--- a/manifests/rules/jetty/http.pp
+++ b/manifests/rules/jetty/http.pp
@@ -2,7 +2,7 @@ class shorewall::rules::jetty::http {
# dnat
shorewall::rule {
'dnat-http-to-jetty':
- destination => "net:${ipaddress}:8080",
+ destination => "net:${::ipaddress}:8080",
destinationport => '80',
source => 'net', proto => 'tcp', order => 140, action => 'DNAT';
}
diff --git a/manifests/rules/libvirt/host.pp b/manifests/rules/libvirt/host.pp
new file mode 100644
index 0000000..aaecd9d
--- /dev/null
+++ b/manifests/rules/libvirt/host.pp
@@ -0,0 +1,46 @@
+class shorewall::rules::libvirt::host (
+ $vmz = 'vmz',
+ $masq_iface = 'eth0',
+ ) {
+
+ define shorewall::rule::accept::from_vmz (
+ $proto = '-', $destinationport = '-', $action = 'ACCEPT' ) {
+ shorewall::rule { "$name":
+ source => $vmz, destination => '$FW', order => 300,
+ proto => $proto, destinationport => $destinationport, action => $action;
+ }
+ }
+
+ shorewall::policy {
+ 'fw-to-vmz':
+ sourcezone => '$FW',
+ destinationzone => $vmz,
+ policy => 'ACCEPT',
+ order => 110;
+ 'vmz-to-net':
+ sourcezone => $vmz,
+ destinationzone => 'net',
+ policy => 'ACCEPT',
+ order => 200;
+ 'vmz-to-all':
+ sourcezone => $vmz,
+ destinationzone => 'all',
+ policy => 'DROP',
+ shloglevel => 'info',
+ order => 800;
+ }
+
+ shorewall::rule::accept::from_vmz {
+ 'accept_dns_from_vmz': action => 'DNS(ACCEPT)';
+ 'accept_tftp_from_vmz': action => 'TFTP(ACCEPT)';
+ 'accept_debproxy_from_vmz': proto => 'tcp', destinationport => '8000', action => 'ACCEPT';
+ 'accept_puppet_from_vmz': proto => 'tcp', destinationport => '8140', action => 'ACCEPT';
+ }
+
+ shorewall::masq {
+ "masq-${masq_iface}":
+ interface => "$masq_iface",
+ source => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+ }
+
+}
diff --git a/manifests/rules/munin.pp b/manifests/rules/munin.pp
index 0a026b0..0c86abe 100644
--- a/manifests/rules/munin.pp
+++ b/manifests/rules/munin.pp
@@ -1,8 +1,12 @@
-class shorewall::rules::munin {
- shorewall::params { 'MUNINPORT': value => $munin_port ? { '' => 4949, default => $munin_port } }
- shorewall::params { 'MUNINCOLLECTOR': value => $munin_collector ? { '' => '127.0.0.1', default => $munin_collector } }
+class shorewall::rules::munin(
+ $munin_port = '4949',
+ $munin_collector = '127.0.0.1',
+ $collector_source = 'net'
+){
+ shorewall::params { 'MUNINPORT': value => $munin_port }
+ shorewall::params { 'MUNINCOLLECTOR': value => join($munin_collector,',') }
shorewall::rule{'net-me-munin-tcp':
- source => 'net:$MUNINCOLLECTOR',
+ source => "${collector_source}:\$MUNINCOLLECTOR",
destination => '$FW',
proto => 'tcp',
destinationport => '$MUNINPORT',
diff --git a/manifests/rules/openfire.pp b/manifests/rules/openfire.pp
new file mode 100644
index 0000000..0e6d1d8
--- /dev/null
+++ b/manifests/rules/openfire.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::openfire {
+ include shorewall::rules::jaberserver
+
+ shorewall::rule { 'me-all-openfire-tcp':
+ source => '$FW',
+ destination => 'all',
+ proto => 'tcp',
+ destinationport => '7070,7443,7777',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/out/ekeyd.pp b/manifests/rules/out/ekeyd.pp
index 858dca4..8acdaad 100644
--- a/manifests/rules/out/ekeyd.pp
+++ b/manifests/rules/out/ekeyd.pp
@@ -1,7 +1,7 @@
-define shorewall::rules::out::ekeyd($ekeyd_host) {
+define shorewall::rules::out::ekeyd($host) {
shorewall::rule { "me-${name}-tcp_ekeyd":
source => '$FW',
- destination => "${name}:${ekeyd_host}",
+ destination => "${name}:${host}",
proto => 'tcp',
destinationport => '8888',
order => 240,
diff --git a/manifests/rules/out/ibackup.pp b/manifests/rules/out/ibackup.pp
index ec12c8b..856bcdb 100644
--- a/manifests/rules/out/ibackup.pp
+++ b/manifests/rules/out/ibackup.pp
@@ -1,13 +1,12 @@
-class shorewall::rules::out::ibackup {
- case $shorewall_ibackup_host {
- '': { fail("You need to define \$shorewall_ibackup_host for ${fqdn}") }
- }
- shorewall::rule { 'me-net-tcp_backupssh':
- source => '$FW',
- destination => "net:${shorewall_ibackup_host}",
- proto => 'tcp',
- destinationport => 'ssh',
- order => 240,
- action => 'ACCEPT';
- }
+class shorewall::rules::out::ibackup(
+ $backup_host
+){
+ shorewall::rule { 'me-net-tcp_backupssh':
+ source => '$FW',
+ destination => "net:${backup_host}",
+ proto => 'tcp',
+ destinationport => 'ssh',
+ order => 240,
+ action => 'ACCEPT';
+ }
}
diff --git a/manifests/rules/out/irc.pp b/manifests/rules/out/irc.pp
new file mode 100644
index 0000000..9c8590a
--- /dev/null
+++ b/manifests/rules/out/irc.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::irc {
+ shorewall::rule{'me-net-irc-tcp':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '6667',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/out/ircs.pp b/manifests/rules/out/ircs.pp
new file mode 100644
index 0000000..a71585d
--- /dev/null
+++ b/manifests/rules/out/ircs.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::ircs {
+ shorewall::rule{'me-net-ircs-tcp':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '6669',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/out/munin.pp b/manifests/rules/out/munin.pp
index 7b0a015..004a3d5 100644
--- a/manifests/rules/out/munin.pp
+++ b/manifests/rules/out/munin.pp
@@ -1,10 +1,10 @@
class shorewall::rules::out::munin {
- shorewall::rule { 'me-net-rcp_muninhost':
- source => '$FW',
- destination => 'net',
- proto => 'tcp',
- destinationport => '4949',
- order => 340,
- action => 'ACCEPT';
- }
+ shorewall::rule { 'me-net-rcp_muninhost':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '4949',
+ order => 340,
+ action => 'ACCEPT';
+ }
}
diff --git a/manifests/rules/out/puppet.pp b/manifests/rules/out/puppet.pp
index 5cd4643..cbe8cce 100644
--- a/manifests/rules/out/puppet.pp
+++ b/manifests/rules/out/puppet.pp
@@ -1,12 +1,20 @@
-class shorewall::rules::out::puppet {
- include ::shorewall::rules::puppet
- # we want to connect to the puppet server
- shorewall::rule { 'me-net-puppet_tcp':
- source => '$FW',
- destination => 'net:$PUPPETSERVER',
- proto => 'tcp',
- destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
- order => 340,
- action => 'ACCEPT';
- }
+class shorewall::rules::out::puppet(
+ $puppetserver = "puppet.${::domain}",
+ $puppetserver_port = 8140,
+ $puppetserver_signport = 8141
+) {
+ class{'shorewall::rules::puppet':
+ puppetserver => $puppetserver,
+ puppetserver_port => $puppetserver_port,
+ puppetserver_signport => $puppetserver_signport,
+ }
+ # we want to connect to the puppet server
+ shorewall::rule { 'me-net-puppet_tcp':
+ source => '$FW',
+ destination => 'net:$PUPPETSERVER',
+ proto => 'tcp',
+ destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
+ order => 340,
+ action => 'ACCEPT';
+ }
}
diff --git a/manifests/rules/out/xmpp.pp b/manifests/rules/out/xmpp.pp
new file mode 100644
index 0000000..a1b4577
--- /dev/null
+++ b/manifests/rules/out/xmpp.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::xmpp {
+ shorewall::rule{'me-net-xmpp-tcp':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '5222',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/puppet.pp b/manifests/rules/puppet.pp
index b53c726..84e7d81 100644
--- a/manifests/rules/puppet.pp
+++ b/manifests/rules/puppet.pp
@@ -1,16 +1,11 @@
-class shorewall::rules::puppet {
- case $shorewall_puppetserver {
- '': { $shorewall_puppetserver = "puppet.${domain}" }
- }
- case $shorewall_puppetserver_port {
- '': { $shorewall_puppetserver_port = '8140' }
- }
- case $shorewall_puppetserver_signport {
- '': { $shorewall_puppetserver_signport = '8141' }
- }
+class shorewall::rules::puppet(
+ $puppetserver = "puppet.${::domain}",
+ $puppetserver_port = 8140,
+ $puppetserver_signport = 8141
+){
shorewall::params{
- 'PUPPETSERVER': value => $shorewall_puppetserver;
- 'PUPPETSERVER_PORT': value => $shorewall_puppetserver_port;
- 'PUPPETSERVER_SIGN_PORT': value => $shorewall_puppetserver_signport;
+ 'PUPPETSERVER': value => $puppetserver;
+ 'PUPPETSERVER_PORT': value => $puppetserver_port;
+ 'PUPPETSERVER_SIGN_PORT': value => $puppetserver_signport;
}
}
diff --git a/manifests/rules/puppet/master.pp b/manifests/rules/puppet/master.pp
index 8ef609f..925979c 100644
--- a/manifests/rules/puppet/master.pp
+++ b/manifests/rules/puppet/master.pp
@@ -1,11 +1,10 @@
class shorewall::rules::puppet::master {
- include ::shorewall::rules::puppet
- shorewall::rule { 'net-me-tcp_puppet-main':
- source => 'net',
- destination => '$FW',
- proto => 'tcp',
- destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
- order => 240,
- action => 'ACCEPT';
- }
+ shorewall::rule { 'net-me-tcp_puppet-main':
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
+ order => 240,
+ action => 'ACCEPT';
+ }
}
diff --git a/manifests/rules/ssh.pp b/manifests/rules/ssh.pp
index 0eebcb4..3a1b530 100644
--- a/manifests/rules/ssh.pp
+++ b/manifests/rules/ssh.pp
@@ -1,10 +1,12 @@
-class shorewall::rules::ssh($ports) {
- $flatted_ports = join($ports,',')
+class shorewall::rules::ssh(
+ $ports,
+ $source = 'net'
+) {
shorewall::rule { 'net-me-tcp_ssh':
- source => 'net',
+ source => $shorewall::rules::ssh::source,
destination => '$FW',
proto => 'tcp',
- destinationport => $flatted_ports,
+ destinationport => join($shorewall::rules::ssh::ports,','),
order => 240,
action => 'ACCEPT';
}
diff --git a/manifests/rules/tomcat.pp b/manifests/rules/tomcat.pp
new file mode 100644
index 0000000..3c6f9df
--- /dev/null
+++ b/manifests/rules/tomcat.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::tomcat {
+ # open tomcat port
+ shorewall::rule {
+ 'net-me-tomcat-tcp':
+ source => 'net',
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '8080',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-14 03:11:15 +0000