summaryrefslogtreecommitdiff
path: root/puppet/modules/site_shorewall
AgeCommit message (Collapse)Author
2016-08-08Stricter VPN egress firewall (#8289)Micah
Change-Id: Ie09a6a34dfa8fe3d72568d2de0b208e7d947412f
2016-08-08Disallow intra-client connectivity (#8272).Micah
If you connect to the VPN with a client, you can make direct network connections to the other connected clients. This allows communication to the eip gateways, but disallows any other connections. Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93
2016-08-05Disallow intra-client connectivity (#8272).Micah
If you connect to the VPN with a client, you can make direct network connections to the other connected clients. This allows communication to the eip gateways, but disallows any other connections. Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93
2016-07-13Notify Exec[shorewall_check] not Service[shorew..]varac
Latest shorewall module does `shorewall check` (executed by `Exec[shorewall_check]`) so every related resource change must notify this Exec instead of `Service[shorewall]` as before.
2016-04-27Fix shorewall not starting with systemd (#8044)Micah
Shorewall in jessie doesn't come with a proper unit file, and as a result, it doesn't properly start with systemd. To solve this, we provide the systemd unit file that comes with stretch, add a systemd submodule that provides the exec resources needed for when systemd units or configuration files are changed Change-Id: I861fa951835928b4741abfbf969adcee4b8f147b
2016-04-18[style] more manual linting for custom manifestsvarac
2016-04-18[style] lint some custom manifestsvarac
I used `puppet-lint -f FILE` to fix most issues, while finishing with manual intervention.
2014-11-20specify the destination IP for DNAT rules for gateway addresses on port 443 ↵Micah Anderson
(#6388) Previously the DNAT rule would redirect the incoming port 443 requests to openvpn, which was the wrong thing to do on the primary IP (but the right thing to do on the openvpn gateway IPs). This manifested in the webapp not being available when it was also configured as a service on the node. Change-Id: Ic8c6b6c0389859fab168a7df687351e11263277a
2014-11-20minor lintingMicah Anderson
Change-Id: I6d04cc7e028e86ee0012d96d7ef075fdd7ecef19
2014-07-01Make shorewall accept incoming traffic for obfsproxy serverirregulator
2014-06-25stunnel: make site_mx and site_webapp use new site_stunnelelijah
2014-06-25new generic system for stunnel: just `include site_stunnel` and stunnel + ↵elijah
needed shorewall will be automatically set up. requires new leap_cli
2014-05-02fix incorrect shorewall parameter name 'protocol', should be 'proto'Micah Anderson
Change-Id: I9c6c798b174228d44d01b55f2a4aa19458e2da8d
2014-04-29block DNS traffic at the OpenVPN gateway (#4164)Micah Anderson
There are many different edge cases where mac and windows clients (and maybe android too) will revert to using a different DNS server than the one specified by openvpn. This is bad news for security reasons. The client is being designed so it doesn't leak DNS, however we don't want to put all of our eggs in one basket, so this will block outgoing port 53 (udp and tcp) on the gateway's firewall from any of the EIP interfaces (thus not blocking DNS access on the gateway itself). Change-Id: I84dcfec7fb591cf7e6b356b66b9721feda188177
2013-10-16vagrant: support other providers besides virtualbox (Bug #4158), Part 2varac
took out the last remaining virtualbox references
2013-09-04make sure that the shorewall package is installed before trying to change ↵Micah Anderson
its configuration file (#3701) Change-Id: Ib2dad30d53e5bf7539762eb3683430b10eb875ed
2013-08-31postfix enable submission port using starttls, so the client can transition ↵Micah Anderson
to the more restrictive TLS wrapper mode Change-Id: I2a1728788378d9a1b79155ddb9bb4b0464b16baa
2013-08-29Make TLS-required smtps (465) be port for sending SMTP. This is preferred ↵Micah Anderson
over 25 because that is typically blocked, and we cannot force TLS on that port due to other MTAs not being configured for this century. We don't use submission (568) because that uses STARTTLS, and the STARTTLS banner can easily be stripped by an adversary. (#3604) . enable smtps (port 465) for client submission over TLS, and require that TLS is enabled . add 465 to the allowed open ports in the firewall . change the smtp-service.json to use 465 instead of 25 note: I did not use the 'use_smtps' parameter that is available in the postfix class because it added some options that we do not want/need. Change-Id: I0040eb2dff6008a1c830d59df9963eb83dc9ea02
2013-08-22install a preliminary firewall that blocks everything, except ssh for the ↵Micah Anderson
cases when shorewall doesn't properly come up, ensuring that it fails safe (#3339) Change-Id: Id4f0bf6cf25f420aa2ad67635b37ae95f54e3d38
2013-08-01make site_shorewall::soledad use the hiera value for the soledad portMicah Anderson
Change-Id: I923f15de807f907d6246c3a83df1e59c39d4e920
2013-07-26Merge branch 'feature/soledad' into feature/leap_mxMicah Anderson
2013-07-25initial soledad configurationMicah Anderson
Change-Id: I19e91887c3f8e90764b4baef8c5e29e25658e190
2013-07-25shorewall rules for site_mxvarac
2013-06-12webapp should be available over http so a proper redirect can be done to httpsMicah Anderson
without this rule, one just gets a 'site is unavailable' result Change-Id: I27b80a0044e9fe4e87e607412c8d0a089d4866a6
2013-05-16special casing for pistoncloud/openstack/ec2Micah Anderson
2013-05-02fixed dnat_ruleselijah
2013-04-30minor spacing changesMicah Anderson
2013-04-30setup a site_config::params class that can be used to set some common ↵Micah Anderson
variables that are used in different places to start with we setup the $interface variable, based on logic as defined in #2213 change the various places that were looking up this value to use site_config::params::interface instead
2013-04-04add Erlang Distributed Node Protocol Port json entry under bigcouchMicah Anderson
setup ednp_server and ednp_client stunnels update couchdb puppet submodule to support configurable ednp_port parameter and general module cleanup pass ednp_port to couchdb setup so that it is configured in the vm.args template clarify in comments the difference between the epmd and ednp ports remove hard-coded erlang_vm_port variable and instead setup shorewall to allow for the stunnel connection only setup dnat rules for the ednp client connections
2013-04-04rename bigcouch.port to more accurate bigcouch.epmd_portMicah Anderson
2013-04-02shorewall: re-order dnat rule variables to match configuration file orderMicah Anderson
2013-04-02replace hard-coded port number with hiera determined one, manipulated to ↵Micah Anderson
remove the 'ip:' from the beginning in bigcouch replication client stunnels
2013-04-02firewall: remove no longer needed epmd portMicah Anderson
2013-04-02shorewall:Micah Anderson
create a macro for the bigcouch replication server stunnel to enable these connections pulling bigcouch_replication_clients, bigcouch_replication_server_port from hiera create site_shorewall::couchdb::dnat and create_resources to properly setup DNAT for bigcouch_replication_clients
2013-04-02remove unnecessary class inheritanceMicah Anderson
2013-04-02shorewall: add couch_server stunnel port to macro.leap_couchdb, this is ↵Micah Anderson
necessary for the stunnel to communicate
2013-04-02start erlang vm on dedicated port so firewalling is easiervarac
2013-04-02added site_shorewall::couchdb::bigcouchvarac
bigcouch cluster protocol communicate via the fqdn of the neighbor hosts. So we need to bend all requests to <fqdn>:4369 to localhost:400x (which is the entry of an stunnel connection to the other neighbor)
2013-04-02added site_shorewall::dnat to configure DNAT rulesvarac
2013-04-02shorewall couchdb config: get open ports rightvarac
2013-04-02working on stunnel for bigcouch clusteringvarac
2013-03-17added support for "limited" service levels (although vpn is not yet actually ↵elijah
rate limited).
2013-02-27openvpn -- added support for optional "free" rate-limited service via ↵elijah
special client certificates with the FREE prefix in the common name.
2013-02-26missed another require => Package['shorewall'] on the file resources in ↵Micah Anderson
site_shorewall
2013-02-12missed one require => Package['shorewall'] on of the file resources in ↵Micah Anderson
site_shorewall
2013-02-12file resources that make changes to shorewall need to make sure that ↵Micah Anderson
shorewall is installed first (#1741)
2013-02-12fixed shorewall is blocking api port (Bug #1735)varac
2013-02-11duplicate shortwall service definitions now inclduded from services/*varac
2013-02-09site_shorewall::monitor: allow port 80 + 443varac
2013-02-06allow outgoing traffic moved to site_shorewall::defaultsvarac
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 05:09:22 +0000