From 6209061fd112fed1715676abb7b6ae4697f21d83 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:51 -0400
Subject: git subrepo clone https://leap.se/git/puppet_shorewall
 puppet/modules/shorewall

subrepo:
  subdir:   "puppet/modules/shorewall"
  merged:   "06e89ed"
upstream:
  origin:   "https://leap.se/git/puppet_shorewall"
  branch:   "master"
  commit:   "06e89ed"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ief531c1b951e9a1573d31bd9718cc5df11706af5
---
 .../modules/shorewall/manifests/rules/out/ekeyd.pp | 10 +++++++++
 .../modules/shorewall/manifests/rules/out/git.pp   | 10 +++++++++
 .../shorewall/manifests/rules/out/ibackup.pp       | 12 +++++++++++
 .../modules/shorewall/manifests/rules/out/imap.pp  | 11 ++++++++++
 .../modules/shorewall/manifests/rules/out/irc.pp   | 10 +++++++++
 .../modules/shorewall/manifests/rules/out/ircs.pp  | 10 +++++++++
 .../shorewall/manifests/rules/out/keyserver.pp     | 11 ++++++++++
 .../shorewall/manifests/rules/out/managesieve.pp   | 25 ++++++++++++++++++++++
 .../modules/shorewall/manifests/rules/out/munin.pp | 10 +++++++++
 .../modules/shorewall/manifests/rules/out/mysql.pp | 11 ++++++++++
 .../modules/shorewall/manifests/rules/out/pop3.pp  | 11 ++++++++++
 .../shorewall/manifests/rules/out/postgres.pp      | 11 ++++++++++
 .../shorewall/manifests/rules/out/puppet.pp        | 20 +++++++++++++++++
 .../modules/shorewall/manifests/rules/out/pyzor.pp | 12 +++++++++++
 .../modules/shorewall/manifests/rules/out/razor.pp | 12 +++++++++++
 .../modules/shorewall/manifests/rules/out/silc.pp  | 19 ++++++++++++++++
 .../modules/shorewall/manifests/rules/out/smtp.pp  | 11 ++++++++++
 .../modules/shorewall/manifests/rules/out/ssh.pp   | 10 +++++++++
 .../shorewall/manifests/rules/out/ssh/disable.pp   |  5 +++++
 .../shorewall/manifests/rules/out/ssh/remove.pp    |  5 +++++
 .../modules/shorewall/manifests/rules/out/whois.pp | 11 ++++++++++
 .../modules/shorewall/manifests/rules/out/xmpp.pp  | 10 +++++++++
 22 files changed, 257 insertions(+)
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ekeyd.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/git.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ibackup.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/imap.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/irc.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ircs.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/keyserver.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/managesieve.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/munin.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/mysql.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/pop3.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/postgres.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/puppet.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/pyzor.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/razor.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/silc.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/smtp.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ssh.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/whois.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/xmpp.pp

(limited to 'puppet/modules/shorewall/manifests/rules/out')

diff --git a/puppet/modules/shorewall/manifests/rules/out/ekeyd.pp b/puppet/modules/shorewall/manifests/rules/out/ekeyd.pp
new file mode 100644
index 00000000..8acdaad5
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ekeyd.pp
@@ -0,0 +1,10 @@
+define shorewall::rules::out::ekeyd($host) {
+  shorewall::rule { "me-${name}-tcp_ekeyd":
+    source          => '$FW',
+    destination     => "${name}:${host}",
+    proto           => 'tcp',
+    destinationport => '8888',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/git.pp b/puppet/modules/shorewall/manifests/rules/out/git.pp
new file mode 100644
index 00000000..cb88da85
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/git.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::git {
+    shorewall::rule{'me-net-git-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '9418',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ibackup.pp b/puppet/modules/shorewall/manifests/rules/out/ibackup.pp
new file mode 100644
index 00000000..856bcdb9
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ibackup.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::out::ibackup(
+  $backup_host
+){
+  shorewall::rule { 'me-net-tcp_backupssh':
+    source          => '$FW',
+    destination     => "net:${backup_host}",
+    proto           => 'tcp',
+    destinationport => 'ssh',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/imap.pp b/puppet/modules/shorewall/manifests/rules/out/imap.pp
new file mode 100644
index 00000000..f1313d2c
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/imap.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::imap {
+    shorewall::rule {
+        'me-net-tcp_imap_s':
+            source          =>      '$FW',
+            destination     =>      'net',
+            proto           =>      'tcp',
+            destinationport =>      '143,993',
+            order           =>      260,
+            action          =>      'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/irc.pp b/puppet/modules/shorewall/manifests/rules/out/irc.pp
new file mode 100644
index 00000000..9c8590ab
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/irc.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::irc {
+    shorewall::rule{'me-net-irc-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '6667',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ircs.pp b/puppet/modules/shorewall/manifests/rules/out/ircs.pp
new file mode 100644
index 00000000..a71585d8
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ircs.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::ircs {
+    shorewall::rule{'me-net-ircs-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '6669',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/keyserver.pp b/puppet/modules/shorewall/manifests/rules/out/keyserver.pp
new file mode 100644
index 00000000..aa7147e0
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/keyserver.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::keyserver {
+  shorewall::rule {
+    'me-net-tcp_keyserver':
+      source          =>  '$FW',
+      destination     =>  'net',
+      proto           =>  'tcp',
+      destinationport =>  '11371,11372',
+      order           =>  240,
+      action          => 'ACCEPT'; 
+ }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/managesieve.pp b/puppet/modules/shorewall/manifests/rules/out/managesieve.pp
new file mode 100644
index 00000000..c4147d4b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/managesieve.pp
@@ -0,0 +1,25 @@
+# manage outgoing traffic to managesieve
+class shorewall::rules::out::managesieve(
+  $legacy_port = false
+) {
+  shorewall::rule {
+    'me-net-tcp_managesieve':
+      source          =>      '$FW',
+      destination     =>      'net',
+      proto           =>      'tcp',
+      destinationport =>      '4190',
+      order           =>      260,
+      action          =>      'ACCEPT';
+  }
+  if $legacy_port {
+    shorewall::rule {
+      'me-net-tcp_managesieve_legacy':
+        source          =>      '$FW',
+        destination     =>      'net',
+        proto           =>      'tcp',
+        destinationport =>      '2000',
+        order           =>      260,
+        action          =>      'ACCEPT';
+    }
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/munin.pp b/puppet/modules/shorewall/manifests/rules/out/munin.pp
new file mode 100644
index 00000000..004a3d5b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/munin.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::munin {
+  shorewall::rule { 'me-net-rcp_muninhost':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'tcp',
+    destinationport => '4949',
+    order           => 340,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/mysql.pp b/puppet/modules/shorewall/manifests/rules/out/mysql.pp
new file mode 100644
index 00000000..1334ba6a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/mysql.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::mysql {
+    shorewall::rule {
+        'me-net-tcp_mysql':
+            source          =>  '$FW',
+            destination     =>  'net',
+            proto           =>  'tcp',
+            destinationport =>  '3306',
+            order           =>  240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/pop3.pp b/puppet/modules/shorewall/manifests/rules/out/pop3.pp
new file mode 100644
index 00000000..ebd4828f
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/pop3.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::pop3 {
+    shorewall::rule {
+        'me-net-tcp_pop3_s':
+            source          =>      '$FW',
+            destination     =>      'net',
+            proto           =>      'tcp',
+            destinationport =>      'pop3,pop3s',
+            order           =>      260,
+            action          =>      'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/postgres.pp b/puppet/modules/shorewall/manifests/rules/out/postgres.pp
new file mode 100644
index 00000000..a62d75d7
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/postgres.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::postgres {
+    shorewall::rule {
+        'me-net-tcp_postgres':
+            source          =>  '$FW',
+            destination     =>  'net',
+            proto           =>  'tcp',
+            destinationport =>  '5432',
+            order           =>  240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/puppet.pp b/puppet/modules/shorewall/manifests/rules/out/puppet.pp
new file mode 100644
index 00000000..cbe8cce7
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/puppet.pp
@@ -0,0 +1,20 @@
+class shorewall::rules::out::puppet(
+  $puppetserver = "puppet.${::domain}",
+  $puppetserver_port = 8140,
+  $puppetserver_signport = 8141
+) {
+  class{'shorewall::rules::puppet':
+    puppetserver          => $puppetserver,
+    puppetserver_port     => $puppetserver_port,
+    puppetserver_signport => $puppetserver_signport,
+  }
+  # we want to connect to the puppet server
+  shorewall::rule { 'me-net-puppet_tcp':
+    source          =>      '$FW',
+    destination     =>      'net:$PUPPETSERVER',
+    proto           =>      'tcp',
+    destinationport =>      '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
+    order           =>      340,
+    action          =>      'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/pyzor.pp b/puppet/modules/shorewall/manifests/rules/out/pyzor.pp
new file mode 100644
index 00000000..f4f5151a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/pyzor.pp
@@ -0,0 +1,12 @@
+# pyzor calls out on 24441
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::pyzor {
+  shorewall::rule { 'me-net-udp_pyzor':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'udp',
+    destinationport => '24441',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/razor.pp b/puppet/modules/shorewall/manifests/rules/out/razor.pp
new file mode 100644
index 00000000..1f8397ce
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/razor.pp
@@ -0,0 +1,12 @@
+# razor calls out on 2703
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::razor {
+  shorewall::rule { 'me-net-tcp_razor':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'tcp',
+    destinationport => '2703',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/silc.pp b/puppet/modules/shorewall/manifests/rules/out/silc.pp
new file mode 100644
index 00000000..830df9c3
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/silc.pp
@@ -0,0 +1,19 @@
+class shorewall::rules::out::silc {
+  shorewall::rule{
+    'me-net-silc-tcp':
+      source          => '$FW',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '706',
+      order           => 240,
+      action          => 'ACCEPT';
+    'me-net-silc-udp':
+      source          => '$FW',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => '706',
+      order           => 240,
+      action          => 'ACCEPT';
+
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/smtp.pp b/puppet/modules/shorewall/manifests/rules/out/smtp.pp
new file mode 100644
index 00000000..2cc77cc3
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/smtp.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::smtp {
+    shorewall::rule {
+        'me-net-tcp_smtp':
+            source          =>  '$FW',
+            destination     =>  'net',
+            proto           =>  'tcp',
+            destinationport =>  'smtp',
+            order           =>  240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ssh.pp b/puppet/modules/shorewall/manifests/rules/out/ssh.pp
new file mode 100644
index 00000000..c18e299b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ssh.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::ssh {
+    shorewall::rule { 'me-net-tcp_ssh':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => 'ssh',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp b/puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp
new file mode 100644
index 00000000..223bf73b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::out::ssh::disable inherits shorewall::rules::out::ssh {
+  Shorewall::Rule['me-net-tcp_ssh']{
+    action => 'DROP',
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp b/puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp
new file mode 100644
index 00000000..bc0acf37
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::out::ssh::remove inherits shorewall::rules::out::ssh {
+  Shorewall::Rule['me-net-tcp_ssh']{
+    ensure => absent,
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/whois.pp b/puppet/modules/shorewall/manifests/rules/out/whois.pp
new file mode 100644
index 00000000..d003d5c1
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/whois.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::whois {
+    # open whois tcp port 
+    shorewall::rule {'me-net-tcp_whois':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '43',
+        order           => 251,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/xmpp.pp b/puppet/modules/shorewall/manifests/rules/out/xmpp.pp
new file mode 100644
index 00000000..a1b4577c
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/xmpp.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::xmpp {
+    shorewall::rule{'me-net-xmpp-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '5222',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
-- 
cgit v1.2.3