From e9d6f1629c4655e9e99721a2f18d3a04a2a503ba Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 9 Jun 2016 17:33:59 +0200
Subject: git subrepo clone https://leap.se/git/puppet_shorewall
 puppet/modules/shorewall

subrepo:
  subdir:   "puppet/modules/shorewall"
  merged:   "34fbca6"
upstream:
  origin:   "https://leap.se/git/puppet_shorewall"
  branch:   "master"
  commit:   "34fbca6"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo.git"
  commit:   "cb2995b"
---
 .../rules/torify/allow_tor_transparent_proxy.pp     | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp

(limited to 'puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp')

diff --git a/puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp b/puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp
new file mode 100644
index 00000000..3c18db69
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp
@@ -0,0 +1,21 @@
+class shorewall::rules::torify::allow_tor_transparent_proxy {
+
+  $rule = "allow-tor-transparent-proxy"
+
+  if !defined(Shorewall::Rule["$rule"]) {
+    # A weirdness in shorewall forces us to explicitly allow traffic to
+    # net:$tor_transparent_proxy_host:$tor_transparent_proxy_port even
+    # if $FW->$FW traffic is allowed. This anyway avoids us special-casing
+    # the remote Tor transparent proxy situation.
+    shorewall::rule {
+      "$rule":
+        source          => '$FW',
+        destination     => "net:${shorewall::tor_transparent_proxy_host}",
+        proto           => 'tcp',
+        destinationport => $shorewall::tor_transparent_proxy_port,
+        order           => 100,
+        action          => 'ACCEPT';
+    }
+  }
+
+}
-- 
cgit v1.2.3