leap_platform.git/puppet/modules/site_shorewall, branch master

Stricter VPN egress firewall (#8289)

2016-08-08T15:09:14+00:00

Change-Id: Ie09a6a34dfa8fe3d72568d2de0b208e7d947412f

Disallow intra-client connectivity (#8272).

2016-08-08T15:08:46+00:00

If you connect to the VPN with a client, you can make direct network
connections to the other connected clients.

This allows communication to the eip gateways, but disallows any other
connections.

Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93

Disallow intra-client connectivity (#8272).

2016-08-05T15:51:35+00:00

If you connect to the VPN with a client, you can make direct network
connections to the other connected clients.

This allows communication to the eip gateways, but disallows any other
connections.

Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93

Notify Exec[shorewall_check] not Service[shorew..]

2016-07-13T08:46:05+00:00

Latest shorewall module does `shorewall check` (executed
by `Exec[shorewall_check]`) so every related resource change
must notify this Exec instead of `Service[shorewall]` as before.

Fix shorewall not starting with systemd (#8044)

2016-04-27T12:48:16+00:00

Shorewall in jessie doesn't come with a proper unit file, and
as a result, it doesn't properly start with systemd.

To solve this, we provide the systemd unit file that comes with stretch,
add a systemd submodule that provides the exec resources needed for when
systemd units or configuration files are changed

Change-Id: I861fa951835928b4741abfbf969adcee4b8f147b

[style] more manual linting for custom manifests

2016-04-18T16:28:29+00:00

[style] lint some custom manifests

2016-04-18T16:19:44+00:00

I used `puppet-lint -f FILE` to fix most issues, while
finishing with manual intervention.

specify the destination IP for DNAT rules for gateway addresses on port 443 (#6388)

2014-11-20T18:13:55+00:00

Previously the DNAT rule would redirect the incoming port 443 requests
to openvpn, which was the wrong thing to do on the primary IP (but the
right thing to do on the openvpn gateway IPs). This manifested in the
webapp not being available when it was also configured as a service on
the node.

Change-Id: Ic8c6b6c0389859fab168a7df687351e11263277a

minor linting

2014-11-20T18:13:33+00:00

Change-Id: I6d04cc7e028e86ee0012d96d7ef075fdd7ecef19

Make shorewall accept incoming traffic for obfsproxy server

2014-07-01T23:05:40+00:00