From c1c21b8114b0a7895716a99ccade13b338fb3c56 Mon Sep 17 00:00:00 2001
From: Matthias Imsand <imsand@puzzle.ch>
Date: Tue, 23 Nov 2010 18:32:45 +0100
Subject: add management for providers

---
 files/boilerplate/providers.footer | 1 +
 files/boilerplate/providers.header | 9 +++++++++
 2 files changed, 10 insertions(+)
 create mode 100644 files/boilerplate/providers.footer
 create mode 100644 files/boilerplate/providers.header

(limited to 'files')

diff --git a/files/boilerplate/providers.footer b/files/boilerplate/providers.footer
new file mode 100644
index 0000000..6bebc05
--- /dev/null
+++ b/files/boilerplate/providers.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
diff --git a/files/boilerplate/providers.header b/files/boilerplate/providers.header
new file mode 100644
index 0000000..c5fb1c5
--- /dev/null
+++ b/files/boilerplate/providers.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version 4 - Providers File
+#
+# For information about entries in this file, type "man shorewall-providers"
+#
+# For additional information, see http://shorewall.net/MultiISP.html
+#
+############################################################################################
+#NAME   NUMBER  MARK    DUPLICATE       INTERFACE       GATEWAY         OPTIONS         COPY
-- 
cgit v1.2.3


From 8dde08a3acbf2815e0cacdc4121f4f8fa2f6c0e5 Mon Sep 17 00:00:00 2001
From: Marcel Haerry <haerry@puzzle.ch>
Date: Thu, 4 Aug 2011 13:39:27 +0200
Subject: refactor things to use the concat module

---
 files/shorewall.conf               |  2 +-
 files/shorewall.conf.Debian        |  2 +-
 files/shorewall.conf.Debian.etch   |  2 +-
 files/shorewall.conf.Gentoo        |  2 +-
 files/shorewall.conf.Ubuntu.karmic |  2 +-
 manifests/base.pp                  | 26 ++++++++------------------
 manifests/blacklist.pp             |  2 +-
 manifests/entry.pp                 | 15 +++++++--------
 manifests/host.pp                  |  2 +-
 manifests/init.pp                  |  9 ---------
 manifests/interface.pp             |  2 +-
 manifests/managed_file.pp          | 28 +++++++++++++---------------
 manifests/masq.pp                  |  2 +-
 manifests/nat.pp                   |  2 +-
 manifests/params.pp                |  2 +-
 manifests/policy.pp                |  2 +-
 manifests/providers.pp             |  2 +-
 manifests/proxyarp.pp              |  2 +-
 manifests/rfc1918.pp               |  2 +-
 manifests/routestopped.pp          |  2 +-
 manifests/rule.pp                  |  8 ++++----
 manifests/rule_section.pp          |  2 +-
 manifests/zone.pp                  |  2 +-
 23 files changed, 50 insertions(+), 72 deletions(-)

(limited to 'files')

diff --git a/files/shorewall.conf b/files/shorewall.conf
index 979e4ff..614e062 100644
--- a/files/shorewall.conf
+++ b/files/shorewall.conf
@@ -78,7 +78,7 @@ SUBSYSLOCK=/var/lock/subsys/shorewall
 
 MODULESDIR=
 
-CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall
+CONFIG_PATH=/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall
 
 RESTOREFILE=
 
diff --git a/files/shorewall.conf.Debian b/files/shorewall.conf.Debian
index c348017..4d9b255 100644
--- a/files/shorewall.conf.Debian
+++ b/files/shorewall.conf.Debian
@@ -79,7 +79,7 @@ SUBSYSLOCK=""
 MODULESDIR=
 
 # add puppet delivered files in front
-CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall
+CONFIG_PATH=/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall
 
 RESTOREFILE=
 
diff --git a/files/shorewall.conf.Debian.etch b/files/shorewall.conf.Debian.etch
index e5c722d..5907945 100644
--- a/files/shorewall.conf.Debian.etch
+++ b/files/shorewall.conf.Debian.etch
@@ -77,7 +77,7 @@ SUBSYSLOCK=""
 MODULESDIR=
 
 # add puppet delivered files in front
-CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall
+CONFIG_PATH=/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall
 
 RESTOREFILE=
 
diff --git a/files/shorewall.conf.Gentoo b/files/shorewall.conf.Gentoo
index 7d8049d..b99f50c 100644
--- a/files/shorewall.conf.Gentoo
+++ b/files/shorewall.conf.Gentoo
@@ -77,7 +77,7 @@ SUBSYSLOCK="/var/lock/subsys/shorewall"
 MODULESDIR=
 
 # add puppet delivered files in front
-CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall
+CONFIG_PATH=/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall
 
 RESTOREFILE=
 
diff --git a/files/shorewall.conf.Ubuntu.karmic b/files/shorewall.conf.Ubuntu.karmic
index c348017..4d9b255 100644
--- a/files/shorewall.conf.Ubuntu.karmic
+++ b/files/shorewall.conf.Ubuntu.karmic
@@ -79,7 +79,7 @@ SUBSYSLOCK=""
 MODULESDIR=
 
 # add puppet delivered files in front
-CONFIG_PATH=/var/lib/puppet/modules/shorewall:/etc/shorewall:/usr/share/shorewall
+CONFIG_PATH=/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall
 
 RESTOREFILE=
 
diff --git a/manifests/base.pp b/manifests/base.pp
index c5ad790..c9fa660 100644
--- a/manifests/base.pp
+++ b/manifests/base.pp
@@ -4,9 +4,10 @@ class shorewall::base {
     }
 
     # This file has to be managed in place, so shorewall can find it
-    file { "/etc/shorewall/shorewall.conf":
-      # use OS specific defaults, but use Default if no other is found
-      source => [
+    file {
+      '/etc/shorewall/shorewall.conf':
+        # use OS specific defaults, but use Default if no other is found
+        source => [
             "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf.$operatingsystem",
             "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf",
             "puppet:///modules/site-shorewall/shorewall.conf.$operatingsystem.$lsbdistcodename",
@@ -19,6 +20,10 @@ class shorewall::base {
         require => Package[shorewall],
         notify => Service[shorewall],
         owner => root, group => 0, mode => 0644;
+      '/etc/shorewall/puppet':
+        ensure => directory,
+        require => Package[shorewall],
+        owner => root, group => 0, mode => 0644;
     }
 
     service{shorewall:
@@ -26,21 +31,6 @@ class shorewall::base {
         enable  => true,
         hasstatus => true,
         hasrestart => true,
-        subscribe => [
-            File["/var/lib/puppet/modules/shorewall/zones"],
-            File["/var/lib/puppet/modules/shorewall/interfaces"],
-            File["/var/lib/puppet/modules/shorewall/hosts"],
-            File["/var/lib/puppet/modules/shorewall/policy"],
-            File["/var/lib/puppet/modules/shorewall/rules"],
-            File["/var/lib/puppet/modules/shorewall/masq"],
-            File["/var/lib/puppet/modules/shorewall/proxyarp"],
-            File["/var/lib/puppet/modules/shorewall/nat"],
-            File["/var/lib/puppet/modules/shorewall/blacklist"],
-            File["/var/lib/puppet/modules/shorewall/rfc1918"],
-            File["/var/lib/puppet/modules/shorewall/routestopped"],
-            File["/var/lib/puppet/modules/shorewall/params"],
-            File["/var/lib/puppet/modules/shorewall/providers"],
-        ],
         require => Package[shorewall],
     }
 }
diff --git a/manifests/blacklist.pp b/manifests/blacklist.pp
index 3700ace..afbe216 100644
--- a/manifests/blacklist.pp
+++ b/manifests/blacklist.pp
@@ -3,7 +3,7 @@ define shorewall::blacklist(
     $port = '-',
     $order='100'
 ){
-    shorewall::entry{"blacklist.d/${order}-${name}":
+    shorewall::entry{"blacklist-${order}-${name}":
         line => "${name} ${proto} ${port}",
     }           
 }
diff --git a/manifests/entry.pp b/manifests/entry.pp
index 4e639bc..c8fffc7 100644
--- a/manifests/entry.pp
+++ b/manifests/entry.pp
@@ -2,12 +2,11 @@ define shorewall::entry(
     $ensure = present,
     $line
 ){
-   $target = "/var/lib/puppet/modules/shorewall/${name}"
-   $dir = dirname($target)
-   file { $target:
-        ensure => $ensure,
-        content => "${line}\n",
-        mode => 0600, owner => root, group => 0,
-        notify => Exec["concat_${dir}"],
-    }
+  $parts = split($name,'-')
+  concat::fragment{$name:
+    ensure => $ensure,
+    content => "${line}\n",
+    order => $parts[1],
+    target => "/etc/shorewall/puppet/${parts[0]}",
+  }
 }
diff --git a/manifests/host.pp b/manifests/host.pp
index b431efe..f400223 100644
--- a/manifests/host.pp
+++ b/manifests/host.pp
@@ -3,7 +3,7 @@ define shorewall::host(
     $options = 'tcpflags,blacklist,norfc1918',
     $order='100'
 ){
-    shorewall::entry{"hosts.d/${order}-${name}":
+    shorewall::entry{"hosts-${order}-${name}":
         line => "${zone} ${name} ${options}"
     }
 }
diff --git a/manifests/init.pp b/manifests/init.pp
index a5ed0af..2e68089 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,8 +1,5 @@
 class shorewall { 
 
-  include common::moduledir
-  module_dir { "shorewall": }
-
   case $operatingsystem {
     gentoo: { include shorewall::gentoo }
     debian: { include shorewall::debian }
@@ -19,12 +16,6 @@ class shorewall {
     }
   }
 
-  file {"/var/lib/puppet/modules/shorewall":
-    ensure => directory,
-    force => true,
-    owner => root, group => 0, mode => 0755; 
-  }
-
   # See http://www.shorewall.net/3.0/Documentation.htm#Zones
   shorewall::managed_file{ zones: }
   # See http://www.shorewall.net/3.0/Documentation.htm#Interfaces
diff --git a/manifests/interface.pp b/manifests/interface.pp
index 1cb5042..1716a7e 100644
--- a/manifests/interface.pp
+++ b/manifests/interface.pp
@@ -20,7 +20,7 @@ define shorewall::interface(
         }
     }
 
-    shorewall::entry { "interfaces.d/${order}-${name}":
+    shorewall::entry { "interfaces-${order}-${name}":
         line => "${zone} ${name} ${broadcast} ${options_real}",
     }
 }
diff --git a/manifests/managed_file.pp b/manifests/managed_file.pp
index 548d6f6..2f02c51 100644
--- a/manifests/managed_file.pp
+++ b/manifests/managed_file.pp
@@ -1,17 +1,15 @@
 define shorewall::managed_file () {
-    $dir = "/var/lib/puppet/modules/shorewall/${name}.d"
-    concatenated_file { "/var/lib/puppet/modules/shorewall/$name":
-        dir => $dir,
-        mode => 0600,
-    }       
-    file {
-        "${dir}/000-header":
-            source => "puppet:///modules/shorewall/boilerplate/${name}.header",
-            mode => 0600, owner => root, group => 0,
-            notify => Exec["concat_${dir}"];
-        "${dir}/999-footer":
-            source => "puppet:///modules/shorewall/boilerplate/${name}.footer",
-            mode => 0600, owner => root, group => 0,
-            notify => Exec["concat_${dir}"];
-    }       
+  concat{ "/etc/shorewall/puppet/$name":
+    notify => Service['shorewall'],
+    require => File['/etc/shorewall/puppet'],
+    owner => root, group => 0, mode => 0600;
+  }       
+  concat::fragment {
+    "${name}-header":
+      source => "puppet:///modules/shorewall/boilerplate/${name}.header",
+      order => '000';
+    "${name}-footer":
+      source => "puppet:///modules/shorewall/boilerplate/${name}.footer",
+      order => '999';
+  }       
 } 
diff --git a/manifests/masq.pp b/manifests/masq.pp
index a9c9840..fb097e5 100644
--- a/manifests/masq.pp
+++ b/manifests/masq.pp
@@ -10,7 +10,7 @@ define shorewall::masq(
     $mark = '',
     $order='100'
 ){
-    shorewall::entry{"masq.d/${order}-${name}":
+    shorewall::entry{"masq-${order}-${name}":
         line => "# ${name}\n${interface} ${source} ${address} ${proto} ${port} ${ipsec} ${mark}"
     }
 }
diff --git a/manifests/nat.pp b/manifests/nat.pp
index e69c1c0..e29b784 100644
--- a/manifests/nat.pp
+++ b/manifests/nat.pp
@@ -5,7 +5,7 @@ define shorewall::nat(
     $local = 'yes',
     $order='100'
 ){
-    shorewall::entry{"nat.d/${order}-${name}":
+    shorewall::entry{"nat-${order}-${name}":
         line => "${name} ${interface} ${internal} ${all} ${local}"
     }           
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index 0a1ae11..3bc5663 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -1,5 +1,5 @@
 define shorewall::params($value, $order='100'){
-    shorewall::entry{"params.d/${order}-${name}":
+    shorewall::entry{"params-${order}-${name}":
         line => "${name}=${value}",
     }
 }
diff --git a/manifests/policy.pp b/manifests/policy.pp
index cdaab71..efee05b 100644
--- a/manifests/policy.pp
+++ b/manifests/policy.pp
@@ -5,7 +5,7 @@ define shorewall::policy(
     $limitburst = '-',
     $order
 ){
-    shorewall::entry{"policy.d/${order}-${name}":
+    shorewall::entry{"policy-${order}-${name}":
         line => "# ${name}\n${sourcezone} ${destinationzone} ${policy} ${shloglevel} ${limitburst}",
     }
 }
diff --git a/manifests/providers.pp b/manifests/providers.pp
index 860363e..a02a494 100644
--- a/manifests/providers.pp
+++ b/manifests/providers.pp
@@ -9,7 +9,7 @@ define shorewall::providers(
     $copy = '',
     $order='100'
 ){
-    shorewall::entry{"providers.d/${order}-${name}":
+    shorewall::entry{"providers-${order}-${name}":
         line => "# ${name}\n${provider} ${number} ${mark} ${duplicate} ${interface} ${gateway} ${options} ${copy}"
     }
 }
diff --git a/manifests/proxyarp.pp b/manifests/proxyarp.pp
index 75c853b..1af554f 100644
--- a/manifests/proxyarp.pp
+++ b/manifests/proxyarp.pp
@@ -5,7 +5,7 @@ define shorewall::proxyarp(
     $persistent = no,
     $order='100'
     ){
-    shorewall::entry{"proxyarp.d/${order}-${name}":
+    shorewall::entry{"proxyarp-${order}-${name}":
         line => "# ${name}\n${name} ${interface} ${external} ${haveroute} ${persistent}"
     }
 }
diff --git a/manifests/rfc1918.pp b/manifests/rfc1918.pp
index 6c2719c..31dce5d 100644
--- a/manifests/rfc1918.pp
+++ b/manifests/rfc1918.pp
@@ -2,7 +2,7 @@ define shorewall::rfc1918(
     $action = 'logdrop',
     $order='100'
 ){
-    shorewall::entry{"rfc1918.d/${order}-${name}":
+    shorewall::entry{"rfc1918-${order}-${name}":
         line => "${name} ${action}"
     }   
 }
diff --git a/manifests/routestopped.pp b/manifests/routestopped.pp
index dab539c..0b53a1b 100644
--- a/manifests/routestopped.pp
+++ b/manifests/routestopped.pp
@@ -8,7 +8,7 @@ define shorewall::routestopped(
         '' => $name,
         default => $interface,
     }   
-    shorewall::entry{"routestopped.d/${order}-${name}":
+    shorewall::entry{"routestopped-${order}-${name}":
         line => "${real_interface} ${host} ${options}",
     }           
 }
diff --git a/manifests/rule.pp b/manifests/rule.pp
index 8394970..2fe91e2 100644
--- a/manifests/rule.pp
+++ b/manifests/rule.pp
@@ -13,8 +13,8 @@ define shorewall::rule(
     $mark = '',
     $order
 ){
-    shorewall::entry{"rules.d/${order}-${name}":
-        ensure => $ensure,
-        line => "# ${name}\n${action} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${originaldest} ${ratelimit} ${user} ${mark}",
-    }
+  shorewall::entry{"rules-${order}-${name}":
+    ensure => $ensure,
+    line => "# ${name}\n${action} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${originaldest} ${ratelimit} ${user} ${mark}",
+  }
 }
diff --git a/manifests/rule_section.pp b/manifests/rule_section.pp
index a885eae..82984ca 100644
--- a/manifests/rule_section.pp
+++ b/manifests/rule_section.pp
@@ -1,7 +1,7 @@
 define shorewall::rule_section(
     $order
 ){
-    shorewall::entry{"rules.d/${order}-${name}":
+    shorewall::entry{"rules-${order}-${name}":
         line => "SECTION ${name}",
     }       
 }
diff --git a/manifests/zone.pp b/manifests/zone.pp
index fa83b0b..81e5771 100644
--- a/manifests/zone.pp
+++ b/manifests/zone.pp
@@ -7,7 +7,7 @@ define shorewall::zone(
     $order = 100
 ){
     $real_name = $parent ? { '-' => $name, default => "${name}:${parent}" }
-    shorewall::entry { "zones.d/${order}-${name}":
+    shorewall::entry { "zones-${order}-${name}":
         line => "${real_name} ${type} ${options} ${in} ${out}"
     }
 }
-- 
cgit v1.2.3


From b74e089b30d075e32a7aec7e530ceafefa9e573f Mon Sep 17 00:00:00 2001
From: mh <mh@immerda.ch>
Date: Thu, 22 Dec 2011 21:13:12 +0100
Subject: add CentOS 6 version

---
 files/shorewall.conf.CentOS.6 | 214 ++++++++++++++++++++++++++++++++++++++++++
 manifests/base.pp             |  11 ++-
 2 files changed, 220 insertions(+), 5 deletions(-)
 create mode 100644 files/shorewall.conf.CentOS.6

(limited to 'files')

diff --git a/files/shorewall.conf.CentOS.6 b/files/shorewall.conf.CentOS.6
new file mode 100644
index 0000000..989af13
--- /dev/null
+++ b/files/shorewall.conf.CentOS.6
@@ -0,0 +1,214 @@
+###############################################################################
+#
+#  Shorewall Version 4 -- /etc/shorewall/shorewall.conf
+#
+#  For information about the settings in this file, type "man shorewall.conf"
+#
+#  Manpage also online at http://www.shorewall.net/manpages/shorewall.conf.html
+###############################################################################
+#		       S T A R T U P   E N A B L E D
+###############################################################################
+
+STARTUP_ENABLED=Yes
+
+###############################################################################
+#		              V E R B O S I T Y
+###############################################################################
+
+VERBOSITY=1
+
+###############################################################################
+#		                L O G G I N G
+###############################################################################
+
+BLACKLIST_LOGLEVEL=
+
+LOG_MARTIANS=No
+
+LOG_VERBOSITY=2
+
+LOGALLNEW=
+
+LOGFILE=/var/log/messages
+
+LOGFORMAT="Shorewall:%s:%s:"
+
+LOGTAGONLY=No
+
+LOGLIMIT=
+
+MACLIST_LOG_LEVEL=info
+
+SFILTER_LOG_LEVEL=info
+
+SMURF_LOG_LEVEL=info
+
+STARTUP_LOG=/var/log/shorewall-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
+###############################################################################
+#	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
+###############################################################################
+
+CONFIG_PATH="/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"
+
+IPTABLES=
+
+IP=
+
+IPSET=
+
+MODULESDIR=
+
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
+
+PERL=/usr/bin/perl
+
+RESTOREFILE=restore
+
+SHOREWALL_SHELL=/bin/sh
+
+SUBSYSLOCK=/var/lock/subsys/shorewall
+
+TC=
+
+###############################################################################
+#		D E F A U L T   A C T I O N S / M A C R O S
+###############################################################################
+
+ACCEPT_DEFAULT=none
+DROP_DEFAULT=Drop
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
+REJECT_DEFAULT=Reject
+
+###############################################################################
+#                        R S H / R C P  C O M M A N D S
+###############################################################################
+
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+
+###############################################################################
+#			F I R E W A L L	  O P T I O N S
+###############################################################################
+
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADD_IP_ALIASES=No
+
+ADD_SNAT_ALIASES=No
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DELETE_THEN_ADD=Yes
+
+DETECT_DNAT_IPADDRS=No
+
+DISABLE_IPV6=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+HIGH_ROUTE_MARKS=No
+
+IP_FORWARDING=On
+
+KEEP_RT_TABLES=No
+
+LEGACY_FASTSTART=Yes
+
+LOAD_HELPERS_ONLY=No
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MAPOLDACTIONS=No
+
+MARK_IN_FORWARD_CHAIN=Yes
+
+MODULE_SUFFIX=ko
+
+MULTICAST=No
+
+MUTEX_TIMEOUT=60
+
+NULL_ROUTE_RFC1918=No
+
+OPTIMIZE=0
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTORE_DEFAULT_ROUTE=Yes
+
+RETAIN_ALIASES=No
+
+ROUTE_FILTER=No
+
+SAVE_IPSETS=No
+
+TC_ENABLED=Internal
+
+TC_EXPERT=No
+
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+
+TRACK_PROVIDERS=No
+
+USE_DEFAULT_RT=No
+
+WIDE_TC_MARKS=No
+
+ZONE2ZONE=2
+
+###############################################################################
+#			P A C K E T   D I S P O S I T I O N
+###############################################################################
+
+BLACKLIST_DISPOSITION=DROP
+
+MACLIST_DISPOSITION=DROP
+
+SMURF_DISPOSITION=DROP
+
+SFILTER_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
+################################################################################
+#                            L E G A C Y  O P T I O N
+#                      D O  N O T  D E L E T E  O R  A L T E R
+################################################################################
+
+IPSECFILE=zones
diff --git a/manifests/base.pp b/manifests/base.pp
index c9fa660..d3fdec7 100644
--- a/manifests/base.pp
+++ b/manifests/base.pp
@@ -8,13 +8,14 @@ class shorewall::base {
       '/etc/shorewall/shorewall.conf':
         # use OS specific defaults, but use Default if no other is found
         source => [
-            "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf.$operatingsystem",
+            "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf.${operatingsystem}",
             "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf",
-            "puppet:///modules/site-shorewall/shorewall.conf.$operatingsystem.$lsbdistcodename",
-            "puppet:///modules/site-shorewall/shorewall.conf.$operatingsystem",
+            "puppet:///modules/site-shorewall/shorewall.conf.${operatingsystem}.${lsbdistcodename}",
+            "puppet:///modules/site-shorewall/shorewall.conf.${operatingsystem}",
             "puppet:///modules/site-shorewall/shorewall.conf",
-            "puppet:///modules/shorewall/shorewall.conf.$operatingsystem.$lsbdistcodename",
-            "puppet:///modules/shorewall/shorewall.conf.$operatingsystem",
+            "puppet:///modules/shorewall/shorewall.conf.${operatingsystem}.${lsbdistcodename}",
+            "puppet:///modules/shorewall/shorewall.conf.${operatingsystem}.${lsbmajdistrelease}",
+            "puppet:///modules/shorewall/shorewall.conf.${operatingsystem}",
             "puppet:///modules/shorewall/shorewall.conf"
         ],
         require => Package[shorewall],
-- 
cgit v1.2.3


From 26f7cfbbaa3cea68a6d668b00d956c605ae7cd84 Mon Sep 17 00:00:00 2001
From: mh <mh@immerda.ch>
Date: Thu, 22 Dec 2011 22:35:45 +0100
Subject: bring a few things in line with the old config file

---
 files/shorewall.conf.CentOS.6 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'files')

diff --git a/files/shorewall.conf.CentOS.6 b/files/shorewall.conf.CentOS.6
index 989af13..8998d81 100644
--- a/files/shorewall.conf.CentOS.6
+++ b/files/shorewall.conf.CentOS.6
@@ -118,7 +118,7 @@ COMPLETE=No
 
 DELETE_THEN_ADD=Yes
 
-DETECT_DNAT_IPADDRS=No
+DETECT_DNAT_IPADDRS=YES
 
 DISABLE_IPV6=Yes
 
@@ -134,7 +134,7 @@ FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
 
-IMPLICIT_CONTINUE=No
+IMPLICIT_CONTINUE=Yes
 
 HIGH_ROUTE_MARKS=No
 
@@ -146,7 +146,7 @@ LEGACY_FASTSTART=Yes
 
 LOAD_HELPERS_ONLY=No
 
-MACLIST_TABLE=filter
+MACLIST_TABLE=mangle
 
 MACLIST_TTL=
 
-- 
cgit v1.2.3


From 33350d4b8799e586fa6567806faac984b69745ba Mon Sep 17 00:00:00 2001
From: mh <mh@immerda.ch>
Date: Fri, 23 Dec 2011 00:16:27 +0100
Subject: add squeeze config file

---
 files/shorewall.conf.CentOS.6       |   3 +
 files/shorewall.conf.Debian.squeeze | 217 ++++++++++++++++++++++++++++++++++++
 2 files changed, 220 insertions(+)
 create mode 100644 files/shorewall.conf.Debian.squeeze

(limited to 'files')

diff --git a/files/shorewall.conf.CentOS.6 b/files/shorewall.conf.CentOS.6
index 8998d81..0d7a9be 100644
--- a/files/shorewall.conf.CentOS.6
+++ b/files/shorewall.conf.CentOS.6
@@ -1,3 +1,6 @@
+####
+#### Managed by puppet, modify only on the puppetmaster
+####
 ###############################################################################
 #
 #  Shorewall Version 4 -- /etc/shorewall/shorewall.conf
diff --git a/files/shorewall.conf.Debian.squeeze b/files/shorewall.conf.Debian.squeeze
new file mode 100644
index 0000000..724287d
--- /dev/null
+++ b/files/shorewall.conf.Debian.squeeze
@@ -0,0 +1,217 @@
+####
+#### Managed by puppet, modify only on the puppetmaster
+###
+###############################################################################
+#
+#  Shorewall Version 4 -- /etc/shorewall/shorewall.conf
+#
+#  For information about the settings in this file, type "man shorewall.conf"
+#
+#  Manpage also online at http://www.shorewall.net/manpages/shorewall.conf.html
+###############################################################################
+#		       S T A R T U P   E N A B L E D
+###############################################################################
+
+STARTUP_ENABLED=Yes
+
+###############################################################################
+#		              V E R B O S I T Y
+###############################################################################
+
+VERBOSITY=1
+
+###############################################################################
+#		                L O G G I N G
+###############################################################################
+
+BLACKLIST_LOGLEVEL=
+
+LOG_MARTIANS=No
+
+LOG_VERBOSITY=2
+
+LOGALLNEW=
+
+LOGFILE=/var/log/messages
+
+LOGFORMAT="Shorewall:%s:%s:"
+
+LOGTAGONLY=No
+
+LOGLIMIT=
+
+MACLIST_LOG_LEVEL=info
+
+SFILTER_LOG_LEVEL=info
+
+SMURF_LOG_LEVEL=info
+
+STARTUP_LOG=/var/log/shorewall-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
+###############################################################################
+#	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
+###############################################################################
+
+CONFIG_PATH="/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"
+
+IPTABLES=
+
+IP=
+
+IPSET=
+
+MODULESDIR=
+
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
+
+PERL=/usr/bin/perl
+
+RESTOREFILE=restore
+
+SHOREWALL_SHELL=/bin/sh
+
+SUBSYSLOCK=/var/lock/subsys/shorewall
+
+TC=
+
+###############################################################################
+#		D E F A U L T   A C T I O N S / M A C R O S
+###############################################################################
+
+ACCEPT_DEFAULT=none
+DROP_DEFAULT=Drop
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
+REJECT_DEFAULT=Reject
+
+###############################################################################
+#                        R S H / R C P  C O M M A N D S
+###############################################################################
+
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+
+###############################################################################
+#			F I R E W A L L	  O P T I O N S
+###############################################################################
+
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADD_IP_ALIASES=No
+
+ADD_SNAT_ALIASES=No
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DELETE_THEN_ADD=Yes
+
+DETECT_DNAT_IPADDRS=YES
+
+DISABLE_IPV6=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=Yes
+
+HIGH_ROUTE_MARKS=No
+
+IP_FORWARDING=On
+
+KEEP_RT_TABLES=No
+
+LEGACY_FASTSTART=Yes
+
+LOAD_HELPERS_ONLY=No
+
+MACLIST_TABLE=mangle
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MAPOLDACTIONS=No
+
+MARK_IN_FORWARD_CHAIN=Yes
+
+MODULE_SUFFIX=ko
+
+MULTICAST=No
+
+MUTEX_TIMEOUT=60
+
+NULL_ROUTE_RFC1918=No
+
+OPTIMIZE=0
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTORE_DEFAULT_ROUTE=Yes
+
+RETAIN_ALIASES=No
+
+ROUTE_FILTER=No
+
+SAVE_IPSETS=No
+
+TC_ENABLED=Internal
+
+TC_EXPERT=No
+
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+
+TRACK_PROVIDERS=No
+
+USE_DEFAULT_RT=No
+
+WIDE_TC_MARKS=No
+
+ZONE2ZONE=2
+
+###############################################################################
+#			P A C K E T   D I S P O S I T I O N
+###############################################################################
+
+BLACKLIST_DISPOSITION=DROP
+
+MACLIST_DISPOSITION=DROP
+
+SMURF_DISPOSITION=DROP
+
+SFILTER_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
+################################################################################
+#                            L E G A C Y  O P T I O N
+#                      D O  N O T  D E L E T E  O R  A L T E R
+################################################################################
+
+IPSECFILE=zones
-- 
cgit v1.2.3


From b9f1b40cce8d265a799a23f07af3eea701393898 Mon Sep 17 00:00:00 2001
From: mh <mh@immerda.ch>
Date: Fri, 23 Dec 2011 11:05:14 +0100
Subject: remove a couple of not yet supported options

---
 files/shorewall.conf.Debian.squeeze | 16 ----------------
 1 file changed, 16 deletions(-)

(limited to 'files')

diff --git a/files/shorewall.conf.Debian.squeeze b/files/shorewall.conf.Debian.squeeze
index 724287d..f04e947 100644
--- a/files/shorewall.conf.Debian.squeeze
+++ b/files/shorewall.conf.Debian.squeeze
@@ -38,12 +38,8 @@ LOGFORMAT="Shorewall:%s:%s:"
 
 LOGTAGONLY=No
 
-LOGLIMIT=
-
 MACLIST_LOG_LEVEL=info
 
-SFILTER_LOG_LEVEL=info
-
 SMURF_LOG_LEVEL=info
 
 STARTUP_LOG=/var/log/shorewall-init.log
@@ -99,8 +95,6 @@ RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ACCOUNTING=Yes
 
-ACCOUNTING_TABLE=filter
-
 ADD_IP_ALIASES=No
 
 ADD_SNAT_ALIASES=No
@@ -117,8 +111,6 @@ CLAMPMSS=No
 
 CLEAR_TC=Yes
 
-COMPLETE=No
-
 DELETE_THEN_ADD=Yes
 
 DETECT_DNAT_IPADDRS=YES
@@ -131,8 +123,6 @@ DYNAMIC_BLACKLIST=Yes
 
 EXPAND_POLICIES=Yes
 
-EXPORTMODULES=Yes
-
 FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
@@ -145,8 +135,6 @@ IP_FORWARDING=On
 
 KEEP_RT_TABLES=No
 
-LEGACY_FASTSTART=Yes
-
 LOAD_HELPERS_ONLY=No
 
 MACLIST_TABLE=mangle
@@ -203,10 +191,6 @@ BLACKLIST_DISPOSITION=DROP
 
 MACLIST_DISPOSITION=DROP
 
-SMURF_DISPOSITION=DROP
-
-SFILTER_DISPOSITION=DROP
-
 TCP_FLAGS_DISPOSITION=DROP
 
 ################################################################################
-- 
cgit v1.2.3


From c2f5b75eb81faf1a7ee364ce3b6e35de16e59a8e Mon Sep 17 00:00:00 2001
From: mh <mh@immerda.ch>
Date: Fri, 23 Dec 2011 11:59:06 +0100
Subject: correct config file for squeeze

---
 files/shorewall.conf.Debian.squeeze | 150 ++++++++++++++++++++----------------
 1 file changed, 83 insertions(+), 67 deletions(-)

(limited to 'files')

diff --git a/files/shorewall.conf.Debian.squeeze b/files/shorewall.conf.Debian.squeeze
index f04e947..63b7350 100644
--- a/files/shorewall.conf.Debian.squeeze
+++ b/files/shorewall.conf.Debian.squeeze
@@ -24,165 +24,185 @@ VERBOSITY=1
 #		                L O G G I N G
 ###############################################################################
 
-BLACKLIST_LOGLEVEL=
+LOGFILE=/var/log/messages
 
-LOG_MARTIANS=No
+STARTUP_LOG=/var/log/shorewall-init.log
 
 LOG_VERBOSITY=2
 
-LOGALLNEW=
-
-LOGFILE=/var/log/messages
-
 LOGFORMAT="Shorewall:%s:%s:"
 
 LOGTAGONLY=No
 
-MACLIST_LOG_LEVEL=info
+LOGRATE=
 
-SMURF_LOG_LEVEL=info
+LOGBURST=
 
-STARTUP_LOG=/var/log/shorewall-init.log
+LOGALLNEW=
+
+BLACKLIST_LOGLEVEL=
+
+MACLIST_LOG_LEVEL=info
 
 TCP_FLAGS_LOG_LEVEL=info
 
+SMURF_LOG_LEVEL=info
+
+LOG_MARTIANS=No
+
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
-CONFIG_PATH="/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"
-
 IPTABLES=
 
 IP=
 
-IPSET=
-
-MODULESDIR=
+TC=
 
-PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
+IPSET=
 
 PERL=/usr/bin/perl
 
-RESTOREFILE=restore
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
 SHOREWALL_SHELL=/bin/sh
 
-SUBSYSLOCK=/var/lock/subsys/shorewall
+SUBSYSLOCK=""
 
-TC=
+MODULESDIR=
+
+CONFIG_PATH="/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"
+
+RESTOREFILE=
+
+IPSECFILE=zones
+
+LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-DROP_DEFAULT=Drop
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
-REJECT_DEFAULT=Reject
+DROP_DEFAULT="Drop"
+REJECT_DEFAULT="Reject"
+ACCEPT_DEFAULT="none"
+QUEUE_DEFAULT="none"
+NFQUEUE_DEFAULT="none"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
 RSH_COMMAND='ssh ${root}@${system} ${command}'
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
-ACCOUNTING=Yes
+IP_FORWARDING=On
 
 ADD_IP_ALIASES=No
 
 ADD_SNAT_ALIASES=No
 
-ADMINISABSENTMINDED=Yes
-
-AUTO_COMMENT=Yes
+RETAIN_ALIASES=No
 
-AUTOMAKE=No
+TC_ENABLED=Internal
 
-BLACKLISTNEWONLY=Yes
+TC_EXPERT=No
 
-CLAMPMSS=No
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
 CLEAR_TC=Yes
 
-DELETE_THEN_ADD=Yes
+MARK_IN_FORWARD_CHAIN=Yes
 
-DETECT_DNAT_IPADDRS=YES
+CLAMPMSS=No
 
-DISABLE_IPV6=Yes
+ROUTE_FILTER=No
 
-DONT_LOAD=
+DETECT_DNAT_IPADDRS=YES
 
-DYNAMIC_BLACKLIST=Yes
+MUTEX_TIMEOUT=60
 
-EXPAND_POLICIES=Yes
+ADMINISABSENTMINDED=Yes
 
-FASTACCEPT=No
+BLACKLISTNEWONLY=Yes
 
-FORWARD_CLEAR_MARK=
+DELAYBLACKLISTLOAD=No
 
-IMPLICIT_CONTINUE=Yes
+MODULE_SUFFIX=ko
 
-HIGH_ROUTE_MARKS=No
+DISABLE_IPV6=Yes
 
-IP_FORWARDING=On
+BRIDGING=No
 
-KEEP_RT_TABLES=No
+DYNAMIC_ZONES=No
 
-LOAD_HELPERS_ONLY=No
+PKTTYPE=Yes
+
+NULL_ROUTE_RFC1918=No
 
 MACLIST_TABLE=mangle
 
 MACLIST_TTL=
 
-MANGLE_ENABLED=Yes
+SAVE_IPSETS=No
 
 MAPOLDACTIONS=No
 
-MARK_IN_FORWARD_CHAIN=Yes
+FASTACCEPT=No
 
-MODULE_SUFFIX=ko
+IMPLICIT_CONTINUE=Yes
 
-MULTICAST=No
+HIGH_ROUTE_MARKS=No
 
-MUTEX_TIMEOUT=60
-
-NULL_ROUTE_RFC1918=No
+USE_ACTIONS=Yes
 
 OPTIMIZE=0
 
-OPTIMIZE_ACCOUNTING=No
+EXPORTPARAMS=Yes
 
-REQUIRE_INTERFACE=No
+EXPAND_POLICIES=Yes
 
-RESTORE_DEFAULT_ROUTE=Yes
+KEEP_RT_TABLES=No
 
-RETAIN_ALIASES=No
+DELETE_THEN_ADD=Yes
 
-ROUTE_FILTER=No
+MULTICAST=No
 
-SAVE_IPSETS=No
+DONT_LOAD=
 
-TC_ENABLED=Internal
+AUTO_COMMENT=Yes
 
-TC_EXPERT=No
+MANGLE_ENABLED=Yes
 
-TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+USE_DEFAULT_RT=No
 
-TRACK_PROVIDERS=No
+RESTORE_DEFAULT_ROUTE=Yes
 
-USE_DEFAULT_RT=No
+AUTOMAKE=No
 
 WIDE_TC_MARKS=No
 
+TRACK_PROVIDERS=No
+
 ZONE2ZONE=2
 
+ACCOUNTING=Yes
+
+DYNAMIC_BLACKLIST=Yes
+
+OPTIMIZE_ACCOUNTING=No
+
+LOAD_HELPERS_ONLY=No
+
+REQUIRE_INTERFACE=No
+
+FORWARD_CLEAR_MARK=Yes
+
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
@@ -193,9 +213,5 @@ MACLIST_DISPOSITION=DROP
 
 TCP_FLAGS_DISPOSITION=DROP
 
-################################################################################
-#                            L E G A C Y  O P T I O N
-#                      D O  N O T  D E L E T E  O R  A L T E R
-################################################################################
+#LAST LINE -- DO NOT REMOVE
 
-IPSECFILE=zones
-- 
cgit v1.2.3


From 475d93888ff853d48b6f4cdcc894415026553abe Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Wed, 20 Jun 2012 13:39:20 -0400
Subject: fixup some merge gaffs

---
 files/shorewall.conf.Debian.squeeze | 3 +--
 manifests/init.pp                   | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

(limited to 'files')

diff --git a/files/shorewall.conf.Debian.squeeze b/files/shorewall.conf.Debian.squeeze
index 5c57b04..a3b1577 100644
--- a/files/shorewall.conf.Debian.squeeze
+++ b/files/shorewall.conf.Debian.squeeze
@@ -121,7 +121,7 @@ CLAMPMSS=No
 ROUTE_FILTER=Yes
 
 DETECT_DNAT_IPADDRS=No
-=======
+
 MARK_IN_FORWARD_CHAIN=Yes
 
 CLAMPMSS=No
@@ -129,7 +129,6 @@ CLAMPMSS=No
 ROUTE_FILTER=No
 
 DETECT_DNAT_IPADDRS=YES
->>>>>>> immerda/master
 
 MUTEX_TIMEOUT=60
 
diff --git a/manifests/init.pp b/manifests/init.pp
index 574ac85..656f5a1 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -16,7 +16,7 @@ class shorewall(
       }
     }
     default: {
-      notice "unknown operatingsystem: $operatingsystem" 
+      notice "unknown operatingsystem: ${::operatingsystem}" 
       include shorewall::base
     }
   }
-- 
cgit v1.2.3


From 4bb5d70f506fc336a1b03ea74f60506a8af3ccc2 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Wed, 20 Jun 2012 16:00:46 -0400
Subject: fix config path, I think I merged that wrong

---
 files/shorewall.conf.Debian.squeeze | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

(limited to 'files')

diff --git a/files/shorewall.conf.Debian.squeeze b/files/shorewall.conf.Debian.squeeze
index a3b1577..da8e29e 100644
--- a/files/shorewall.conf.Debian.squeeze
+++ b/files/shorewall.conf.Debian.squeeze
@@ -1,3 +1,7 @@
+####
+#### Managed by puppet, modify only on the puppetmaster
+####
+
 ###############################################################################
 #
 #  Shorewall Version 4 -- /etc/shorewall/shorewall.conf
@@ -18,7 +22,7 @@ STARTUP_ENABLED=Yes
 VERBOSITY=1
 
 ###############################################################################
-#		                L O G G I N G
+#			       L O G G I N G
 ###############################################################################
 
 LOGFILE=/var/log/messages
@@ -122,14 +126,6 @@ ROUTE_FILTER=Yes
 
 DETECT_DNAT_IPADDRS=No
 
-MARK_IN_FORWARD_CHAIN=Yes
-
-CLAMPMSS=No
-
-ROUTE_FILTER=No
-
-DETECT_DNAT_IPADDRS=YES
-
 MUTEX_TIMEOUT=60
 
 ADMINISABSENTMINDED=Yes
-- 
cgit v1.2.3


From 5052233d92e97263eab292408ed2602db0836d98 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Wed, 20 Jun 2012 16:17:37 -0400
Subject: put config file back to immerda version

---
 files/shorewall.conf.Debian.squeeze | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

(limited to 'files')

diff --git a/files/shorewall.conf.Debian.squeeze b/files/shorewall.conf.Debian.squeeze
index da8e29e..63b7350 100644
--- a/files/shorewall.conf.Debian.squeeze
+++ b/files/shorewall.conf.Debian.squeeze
@@ -1,7 +1,6 @@
 ####
 #### Managed by puppet, modify only on the puppetmaster
-####
-
+###
 ###############################################################################
 #
 #  Shorewall Version 4 -- /etc/shorewall/shorewall.conf
@@ -22,7 +21,7 @@ STARTUP_ENABLED=Yes
 VERBOSITY=1
 
 ###############################################################################
-#			       L O G G I N G
+#		                L O G G I N G
 ###############################################################################
 
 LOGFILE=/var/log/messages
@@ -49,7 +48,7 @@ TCP_FLAGS_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
-LOG_MARTIANS=Yes
+LOG_MARTIANS=No
 
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
@@ -102,7 +101,7 @@ RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
-IP_FORWARDING=Keep
+IP_FORWARDING=On
 
 ADD_IP_ALIASES=No
 
@@ -118,13 +117,13 @@ TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
 CLEAR_TC=Yes
 
-MARK_IN_FORWARD_CHAIN=No
+MARK_IN_FORWARD_CHAIN=Yes
 
 CLAMPMSS=No
 
-ROUTE_FILTER=Yes
+ROUTE_FILTER=No
 
-DETECT_DNAT_IPADDRS=No
+DETECT_DNAT_IPADDRS=YES
 
 MUTEX_TIMEOUT=60
 
@@ -136,7 +135,7 @@ DELAYBLACKLISTLOAD=No
 
 MODULE_SUFFIX=ko
 
-DISABLE_IPV6=No
+DISABLE_IPV6=Yes
 
 BRIDGING=No
 
@@ -146,7 +145,7 @@ PKTTYPE=Yes
 
 NULL_ROUTE_RFC1918=No
 
-MACLIST_TABLE=filter
+MACLIST_TABLE=mangle
 
 MACLIST_TTL=
 
@@ -156,7 +155,7 @@ MAPOLDACTIONS=No
 
 FASTACCEPT=No
 
-IMPLICIT_CONTINUE=No
+IMPLICIT_CONTINUE=Yes
 
 HIGH_ROUTE_MARKS=No
 
@@ -210,8 +209,9 @@ FORWARD_CLEAR_MARK=Yes
 
 BLACKLIST_DISPOSITION=DROP
 
-MACLIST_DISPOSITION=REJECT
+MACLIST_DISPOSITION=DROP
 
 TCP_FLAGS_DISPOSITION=DROP
 
 #LAST LINE -- DO NOT REMOVE
+
-- 
cgit v1.2.3