From ad62cfdad04c8f8ed9d6454f716c92e850ac53ba Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Sun, 17 Mar 2013 13:15:51 -0700
Subject: added support for "limited" service levels (although vpn is not yet
 actually rate limited).

---
 puppet/modules/site_shorewall/manifests/eip.pp | 61 +++++++++++++-------------
 1 file changed, 30 insertions(+), 31 deletions(-)

(limited to 'puppet/modules/site_shorewall/manifests/eip.pp')

diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
index d2bf3c4c..95c3920e 100644
--- a/puppet/modules/site_shorewall/manifests/eip.pp
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -3,10 +3,6 @@ class site_shorewall::eip {
   include site_shorewall::defaults
   include site_shorewall::ip_forward
 
-  $openvpn_config = hiera('openvpn')
-  $openvpn_ports  = $openvpn_config['ports']
-  $openvpn_gateway_address = $site_openvpn::openvpn_gateway_address
-
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_eip':
     content => "PARAM   -       -       tcp     1194
@@ -16,41 +12,45 @@ PARAM   -       -       udp     1194
     require => Package['shorewall']
   }
 
-
   shorewall::interface {
     'tun0':
       zone    => 'eip',
       options => 'tcpflags,blacklist,nosmurfs';
     'tun1':
       zone    => 'eip',
-      options => 'tcpflags,blacklist,nosmurfs'
+      options => 'tcpflags,blacklist,nosmurfs';
+    'tun2':
+      zone    => 'eip',
+      options => 'tcpflags,blacklist,nosmurfs';
+    'tun3':
+      zone    => 'eip',
+      options => 'tcpflags,blacklist,nosmurfs';
   }
 
+  shorewall::zone {
+    'eip':
+      type => 'ipv4';
+  }
 
-  shorewall::zone {'eip':
-    type => 'ipv4'; }
-
-  case $::virtual {
-    'virtualbox': {
-      shorewall::masq {
-        'eth0_tcp':
-          interface => 'eth0',
-          source    => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
-        'eth0_udp':
-          interface => 'eth0',
-          source    => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
-    }
-    default: {
-      $interface = $site_shorewall::defaults::interface
-      shorewall::masq {
-        "${interface}_tcp":
-          interface => $interface,
-          source    => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
+  if $::virtual == 'virtualbox' {
+    $interface = 'eth0'
+  } else {
+    $interface = $site_shorewall::defaults::interface
+  }
 
-        "${interface}_udp":
-          interface => $interface,
-          source    => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
-    }
+  shorewall::masq {
+    "${interface}_unlimited_tcp":
+       interface => $interface,
+       source    => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}";
+    "${interface}_unlimited_udp":
+       interface => $interface,
+       source    => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}";
+    "${interface}_limited_tcp":
+       interface => $interface,
+       source    => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}";
+    "${interface}_limited_udp":
+       interface => $interface,
+       source    => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}";
   }
 
   shorewall::policy {
@@ -70,7 +70,6 @@ PARAM   -       -       udp     1194
   }
 
   # create dnat rule for each port
-  #create_resources('site_shorewall::dnat_rule', $openvpn_ports)
-  site_shorewall::dnat_rule { $openvpn_ports: }
+  site_shorewall::dnat_rule { $site_openvpn::openvpn_ports: }
 
 }
-- 
cgit v1.2.3