Merge remote-tracking branch 'origin/release/v0.2.0'0.2.0

1 files changed, 54 insertions, 0 deletions

diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp
new file mode 100644
index 00000000..d5639a90
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/defaults.pp
@@ -0,0 +1,54 @@
+class site_shorewall::defaults {
+  include shorewall
+
+  # be safe for development
+  #if ( $::virtual == 'virtualbox') { $shorewall_startup='0' }
+
+  $ip_address     = hiera('ip_address')
+  # a special case for vagrant interfaces
+  $interface      = $::virtual ? {
+    virtualbox => [ 'eth0', 'eth1' ],
+    default    => getvar("interface_${ip_address}")
+  }
+
+
+  # If you want logging:
+  shorewall::params {
+    'LOG': value => 'debug';
+  }
+
+  shorewall::zone {'net': type => 'ipv4'; }
+
+
+  # define interfaces
+  shorewall::interface { $interface:
+    zone      => 'net',
+    options   => 'tcpflags,blacklist,nosmurfs';
+  }
+
+  shorewall::routestopped { $interface: }
+
+  shorewall::policy {
+    'fw-to-all':
+      sourcezone      => 'fw',
+      destinationzone => 'all',
+      policy          => 'ACCEPT',
+      order           => 100;
+    'all-to-all':
+      sourcezone      => 'all',
+      destinationzone => 'all',
+      policy          => 'DROP',
+      order           => 200;
+  }
+
+  shorewall::rule {
+      # ping party
+      'all2all-ping':
+        source      => 'all',
+        destination => 'all',
+        action      => 'Ping(ACCEPT)',
+        order       => 200;
+  }
+
+  include site_shorewall::sshd
+}