diff options
| author | Micah Anderson <micah@leap.se> | 2014-12-23 16:47:35 -0500 |
|---|---|---|
| committer | Micah Anderson <micah@leap.se> | 2014-12-23 16:47:35 -0500 |
| commit | 574a0554a95ba74867ebd0ca4a93195bfa104c14 (patch) | |
| tree | fd07b5b2ec8b32e82aa665dad117ee6e51791884 /puppet/modules/site_shorewall/manifests/stunnel | |
| parent | 126faf8606f4911ccc3c1f55a9e0f381a46d536a (diff) | |
| parent | fc9a8af17d927085486052a53233401c42b0caab (diff) | |
Merge branch 'develop'
Conflicts:
platform.rb
Change-Id: Ic2e08e594d29a585691341c8667ac0b64933a505
Diffstat (limited to 'puppet/modules/site_shorewall/manifests/stunnel')
| -rw-r--r-- | puppet/modules/site_shorewall/manifests/stunnel/client.pp | 40 | ||||
| -rw-r--r-- | puppet/modules/site_shorewall/manifests/stunnel/server.pp | 22 |
2 files changed, 62 insertions, 0 deletions
diff --git a/puppet/modules/site_shorewall/manifests/stunnel/client.pp b/puppet/modules/site_shorewall/manifests/stunnel/client.pp new file mode 100644 index 00000000..9a89a244 --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/stunnel/client.pp @@ -0,0 +1,40 @@ +# +# Adds some firewall magic to the stunnel. +# +# Using DNAT, this firewall rule allow a locally running program +# to try to connect to the normal remote IP and remote port of the +# service on another machine, but have this connection magically +# routed through the locally running stunnel client. +# +# The network looks like this: +# +# From the client's perspective: +# +# |------- stunnel client --------------| |---------- stunnel server -----------------------| +# consumer app -> localhost:accept_port -> connect:connect_port -> localhost:original_port +# +# From the server's perspective: +# +# |------- stunnel client --------------| |---------- stunnel server -----------------------| +# ?? -> *:accept_port -> localhost:connect_port -> service +# + +define site_shorewall::stunnel::client( + $accept_port, + $connect, + $connect_port, + $original_port) { + + include site_shorewall::defaults + + shorewall::rule { + "stunnel_dnat_${name}": + action => 'DNAT', + source => '$FW', + destination => "\$FW:127.0.0.1:${accept_port}", + proto => 'tcp', + destinationport => $original_port, + originaldest => $connect, + order => 200 + } +} diff --git a/puppet/modules/site_shorewall/manifests/stunnel/server.pp b/puppet/modules/site_shorewall/manifests/stunnel/server.pp new file mode 100644 index 00000000..798cd631 --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/stunnel/server.pp @@ -0,0 +1,22 @@ +# +# Allow all incoming connections to stunnel server port +# + +define site_shorewall::stunnel::server($port) { + + include site_shorewall::defaults + + file { "/etc/shorewall/macro.stunnel_server_${name}": + content => "PARAM - - tcp ${port}", + notify => Service['shorewall'], + require => Package['shorewall'] + } + shorewall::rule { + "net2fw-stunnel-server-${name}": + source => 'net', + destination => '$FW', + action => "stunnel_server_${name}(ACCEPT)", + order => 200; + } + +}
\ No newline at end of file |