From 00503ad90e7650269a6e122d143a29f3110179fe Mon Sep 17 00:00:00 2001 From: am Date: Tue, 6 Nov 2007 11:45:52 +0000 Subject: install default git.black.co.at shorewall module rename class shorewall to shorewall_install git-svn-id: https://svn/ipuppet/trunk/modules/shorewall@40 d66ca3ae-40d7-4aa7-90d4-87d79ca94279 --- files/boilerplate/blacklist.footer | 1 + files/boilerplate/blacklist.header | 10 ++ files/boilerplate/hosts.footer | 1 + files/boilerplate/hosts.header | 8 ++ files/boilerplate/interfaces.footer | 1 + files/boilerplate/interfaces.header | 10 ++ files/boilerplate/masq.footer | 1 + files/boilerplate/masq.header | 9 ++ files/boilerplate/nat.footer | 1 + files/boilerplate/nat.header | 9 ++ files/boilerplate/policy.footer | 1 + files/boilerplate/policy.header | 9 ++ files/boilerplate/proxyarp.footer | 1 + files/boilerplate/proxyarp.header | 9 ++ files/boilerplate/rfc1918.footer | 5 + files/boilerplate/rfc1918.header | 5 + files/boilerplate/routestopped.footer | 1 + files/boilerplate/routestopped.header | 11 +++ files/boilerplate/rules.footer | 1 + files/boilerplate/rules.header | 10 ++ files/boilerplate/zones.footer | 1 + files/boilerplate/zones.header | 11 +++ files/shorewall.conf.Debian.etch | 180 ++++++++++++++++++++++++++++++++++ 23 files changed, 296 insertions(+) create mode 100644 files/boilerplate/blacklist.footer create mode 100644 files/boilerplate/blacklist.header create mode 100644 files/boilerplate/hosts.footer create mode 100644 files/boilerplate/hosts.header create mode 100644 files/boilerplate/interfaces.footer create mode 100644 files/boilerplate/interfaces.header create mode 100644 files/boilerplate/masq.footer create mode 100644 files/boilerplate/masq.header create mode 100644 files/boilerplate/nat.footer create mode 100644 files/boilerplate/nat.header create mode 100644 files/boilerplate/policy.footer create mode 100644 files/boilerplate/policy.header create mode 100644 files/boilerplate/proxyarp.footer create mode 100644 files/boilerplate/proxyarp.header create mode 100644 files/boilerplate/rfc1918.footer create mode 100644 files/boilerplate/rfc1918.header create mode 100644 files/boilerplate/routestopped.footer create mode 100644 files/boilerplate/routestopped.header create mode 100644 files/boilerplate/rules.footer create mode 100644 files/boilerplate/rules.header create mode 100644 files/boilerplate/zones.footer create mode 100644 files/boilerplate/zones.header create mode 100644 files/shorewall.conf.Debian.etch (limited to 'files') diff --git a/files/boilerplate/blacklist.footer b/files/boilerplate/blacklist.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/blacklist.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/blacklist.header b/files/boilerplate/blacklist.header new file mode 100644 index 0000000..2392e17 --- /dev/null +++ b/files/boilerplate/blacklist.header @@ -0,0 +1,10 @@ +# +# Shorewall version 3.4 - Blacklist File +# +# For information about entries in this file, type "man shorewall-blacklist" +# +# Please see http://shorewall.net/blacklisting_support.htm for additional +# information. +# +############################################################################### +#ADDRESS/SUBNET PROTOCOL PORT diff --git a/files/boilerplate/hosts.footer b/files/boilerplate/hosts.footer new file mode 100644 index 0000000..dc2fef5 --- /dev/null +++ b/files/boilerplate/hosts.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE diff --git a/files/boilerplate/hosts.header b/files/boilerplate/hosts.header new file mode 100644 index 0000000..8a81664 --- /dev/null +++ b/files/boilerplate/hosts.header @@ -0,0 +1,8 @@ +horewall version 3.4 - Hosts file +# +# For information about entries in this file, type "man shorewall-hosts" +# +# For additional information, see http://shorewall.net/Documentation.htm#Hosts +# +############################################################################### +#ZONE HOST(S) OPTIONS diff --git a/files/boilerplate/interfaces.footer b/files/boilerplate/interfaces.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/interfaces.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/interfaces.header b/files/boilerplate/interfaces.header new file mode 100644 index 0000000..2027523 --- /dev/null +++ b/files/boilerplate/interfaces.header @@ -0,0 +1,10 @@ +# +# Shorewall version 3.4 - Interfaces File +# +# For information about entries in this file, type "man shorewall-interfaces" +# +# For additional information, see +# http://shorewall.net/Documentation.htm#Interfaces +# +############################################################################### +#ZONE INTERFACE BROADCAST OPTIONS diff --git a/files/boilerplate/masq.footer b/files/boilerplate/masq.footer new file mode 100644 index 0000000..6bebc05 --- /dev/null +++ b/files/boilerplate/masq.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE diff --git a/files/boilerplate/masq.header b/files/boilerplate/masq.header new file mode 100644 index 0000000..f823321 --- /dev/null +++ b/files/boilerplate/masq.header @@ -0,0 +1,9 @@ +# +# Shorewall version 3.4 - Masq file +# +# For information about entries in this file, type "man shorewall-masq" +# +# For additional information, see http://shorewall.net/Documentation.htm#Masq +# +############################################################################### +#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK diff --git a/files/boilerplate/nat.footer b/files/boilerplate/nat.footer new file mode 100644 index 0000000..6bebc05 --- /dev/null +++ b/files/boilerplate/nat.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE diff --git a/files/boilerplate/nat.header b/files/boilerplate/nat.header new file mode 100644 index 0000000..c2e0d92 --- /dev/null +++ b/files/boilerplate/nat.header @@ -0,0 +1,9 @@ +# +# Shorewall version 3.4 - Nat File +# +# For information about entries in this file, type "man shorewall-nat" +# +# For additional information, see http://shorewall.net/NAT.htm +# +############################################################################### +#EXTERNAL INTERFACE INTERNAL ALL LOCAL diff --git a/files/boilerplate/policy.footer b/files/boilerplate/policy.footer new file mode 100644 index 0000000..16c86d0 --- /dev/null +++ b/files/boilerplate/policy.footer @@ -0,0 +1 @@ +#LAST LINE -- DO NOT REMOVE diff --git a/files/boilerplate/policy.header b/files/boilerplate/policy.header new file mode 100644 index 0000000..a0c5d5d --- /dev/null +++ b/files/boilerplate/policy.header @@ -0,0 +1,9 @@ +# +# Shorewall version 3.4 - Policy File +# +# For information about entries in this file, type "man shorewall-policy" +# +# See http://shorewall.net/Documentation.htm#Policy for additional information. +# +############################################################################### +#SOURCE DEST POLICY LOG LIMIT:BURST diff --git a/files/boilerplate/proxyarp.footer b/files/boilerplate/proxyarp.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/proxyarp.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/proxyarp.header b/files/boilerplate/proxyarp.header new file mode 100644 index 0000000..1e16853 --- /dev/null +++ b/files/boilerplate/proxyarp.header @@ -0,0 +1,9 @@ +# +# Shorewall version 3.4 - Proxyarp File +# +# For information about entries in this file, type "man shorewall-proxyarp" +# +# See http://shorewall.net/ProxyARP.htm for additional information. +# +############################################################################### +#ADDRESS INTERFACE EXTERNAL HAVEROUTE PERSISTENT diff --git a/files/boilerplate/rfc1918.footer b/files/boilerplate/rfc1918.footer new file mode 100644 index 0000000..e07fdb1 --- /dev/null +++ b/files/boilerplate/rfc1918.footer @@ -0,0 +1,5 @@ +# The real subnets from RFC1918 +172.16.0.0/12 logdrop # RFC 1918 +192.168.0.0/16 logdrop # RFC 1918 +10.0.0.0/8 logdrop # RFC 1918 +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/rfc1918.header b/files/boilerplate/rfc1918.header new file mode 100644 index 0000000..8d6a416 --- /dev/null +++ b/files/boilerplate/rfc1918.header @@ -0,0 +1,5 @@ +# +# Shorewall version 3.4 - Rfc1918 File +# +############################################################################### +#SUBNETS TARGET diff --git a/files/boilerplate/routestopped.footer b/files/boilerplate/routestopped.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/routestopped.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/routestopped.header b/files/boilerplate/routestopped.header new file mode 100644 index 0000000..5408aac --- /dev/null +++ b/files/boilerplate/routestopped.header @@ -0,0 +1,11 @@ +# +# Shorewall version 3.4 - Routestopped File +# +# For information about entries in this file, type "man shorewall-routestopped" +# +# See http://shorewall.net/Documentation.htm#Routestopped and +# http://shorewall.net/starting_and_stopping_shorewall.htm for additional +# information. +# +############################################################################### +#INTERFACE HOST(S) OPTIONS diff --git a/files/boilerplate/rules.footer b/files/boilerplate/rules.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/rules.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/rules.header b/files/boilerplate/rules.header new file mode 100644 index 0000000..764358a --- /dev/null +++ b/files/boilerplate/rules.header @@ -0,0 +1,10 @@ +# +# Shorewall version 3.4 - Rules File +# +# For information on the settings in this file, type "man shorewall-rules" +# +# See http://shorewall.net/Documentation.htm#Rules for additional information. +# +############################################################################################################# +#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK +# PORT PORT(S) DEST LIMIT GROUP diff --git a/files/boilerplate/zones.footer b/files/boilerplate/zones.footer new file mode 100644 index 0000000..662ac1c --- /dev/null +++ b/files/boilerplate/zones.footer @@ -0,0 +1 @@ +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/zones.header b/files/boilerplate/zones.header new file mode 100644 index 0000000..8b82c2e --- /dev/null +++ b/files/boilerplate/zones.header @@ -0,0 +1,11 @@ +# +# Shorewall version 3.4 - Zones File +# +# For information about this file, type "man shorewall-zones" +# +# For more information, see http://www.shorewall.net/Documentation.htm#Zones +# +############################################################################### +#ZONE TYPE OPTIONS IN OUT +# OPTIONS OPTIONS +fw firewall diff --git a/files/shorewall.conf.Debian.etch b/files/shorewall.conf.Debian.etch new file mode 100644 index 0000000..e5c722d --- /dev/null +++ b/files/shorewall.conf.Debian.etch @@ -0,0 +1,180 @@ +#### +#### Managed by puppet, modify only on the puppetmaster +#### +############################################################################### +# /etc/shorewall/shorewall.conf V3.4 - Change the following variables to +# match your setup +# +# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] +# +# This file should be placed in /etc/shorewall +# +# (c) 1999,2000,2001,2002,2003,2004,2005 - Tom Eastep (teastep@shorewall.net) +# +# For information about the settings in this file, type "man shorewall.conf" +# +# Additional information is available at +# http://www.shorewall.net/Documentation.htm#Conf +############################################################################### +# S T A R T U P E N A B L E D +############################################################################### + +STARTUP_ENABLED=Yes + +############################################################################### +# V E R B O S I T Y +############################################################################### + +VERBOSITY=1 + +############################################################################### +# C O M P I L E R +# (setting this to 'perl' requires installation of Shorewall-perl) +############################################################################### + +SHOREWALL_COMPILER=shell + +############################################################################### +# L O G G I N G +############################################################################### + +LOGFILE=/var/log/messages + +LOGFORMAT="Shorewall:%s:%s:" + +LOGTAGONLY=No + +LOGRATE= + +LOGBURST= + +LOGALLNEW= + +BLACKLIST_LOGLEVEL= + +MACLIST_LOG_LEVEL=info + +TCP_FLAGS_LOG_LEVEL=info + +RFC1918_LOG_LEVEL=info + +SMURF_LOG_LEVEL=info + +LOG_MARTIANS=No + +############################################################################### +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +############################################################################### + +IPTABLES= + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin + +SHOREWALL_SHELL=/bin/sh + +SUBSYSLOCK="" + +MODULESDIR= + +# add puppet delivered files in front +CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall + +RESTOREFILE= + +IPSECFILE=zones + +LOCKFILE= + +############################################################################### +# D E F A U L T A C T I O N S / M A C R O S +############################################################################### + +DROP_DEFAULT="Drop" +REJECT_DEFAULT="Reject" +ACCEPT_DEFAULT="none" +QUEUE_DEFAULT="none" + +############################################################################### +# R S H / R C P C O M M A N D S +############################################################################### + +RSH_COMMAND='ssh ${root}@${system} ${command}' +RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' + +############################################################################### +# F I R E W A L L O P T I O N S +############################################################################### + +IP_FORWARDING=Keep + +ADD_IP_ALIASES=Yes + +ADD_SNAT_ALIASES=No + +RETAIN_ALIASES=No + +TC_ENABLED=Internal + +TC_EXPERT=No + +CLEAR_TC=Yes + +MARK_IN_FORWARD_CHAIN=No + +CLAMPMSS=No + +ROUTE_FILTER=Yes + +DETECT_DNAT_IPADDRS=No + +MUTEX_TIMEOUT=60 + +ADMINISABSENTMINDED=Yes + +BLACKLISTNEWONLY=Yes + +DELAYBLACKLISTLOAD=No + +MODULE_SUFFIX= + +DISABLE_IPV6=Yes + +BRIDGING=No + +DYNAMIC_ZONES=No + +PKTTYPE=Yes + +RFC1918_STRICT=No + +MACLIST_TABLE=filter + +MACLIST_TTL= + +SAVE_IPSETS=No + +MAPOLDACTIONS=No + +FASTACCEPT=No + +IMPLICIT_CONTINUE=Yes + +HIGH_ROUTE_MARKS=No + +USE_ACTIONS=Yes + +OPTIMIZE=0 + +EXPORTPARAMS=Yes + +############################################################################### +# P A C K E T D I S P O S I T I O N +############################################################################### + +BLACKLIST_DISPOSITION=DROP + +MACLIST_DISPOSITION=REJECT + +TCP_FLAGS_DISPOSITION=DROP + +#LAST LINE -- DO NOT REMOVE -- cgit v1.2.3