From b3aca2b0cd35f9cc921d1703a597ddbc91529044 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 26 Feb 2013 15:07:38 -0500 Subject: missed another require => Package['shorewall'] on the file resources in site_shorewall --- puppet/modules/site_shorewall/manifests/eip.pp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp index 4e5a5d48..d2bf3c4c 100644 --- a/puppet/modules/site_shorewall/manifests/eip.pp +++ b/puppet/modules/site_shorewall/manifests/eip.pp @@ -12,7 +12,8 @@ class site_shorewall::eip { content => "PARAM - - tcp 1194 PARAM - - udp 1194 ", - notify => Service['shorewall'] + notify => Service['shorewall'], + require => Package['shorewall'] } -- cgit v1.2.3 From ffb88e54c5e4e30fa61ea1009f3eee62f98ab17c Mon Sep 17 00:00:00 2001 From: elijah Date: Wed, 27 Feb 2013 23:46:58 -0800 Subject: openvpn -- added support for optional "free" rate-limited service via special client certificates with the FREE prefix in the common name. --- .../modules/site_shorewall/manifests/dnat_rule.pp | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp index 68f480d8..0b4370df 100644 --- a/puppet/modules/site_shorewall/manifests/dnat_rule.pp +++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp @@ -11,7 +11,6 @@ define site_shorewall::dnat_rule { destinationport => $port, order => 100; } - shorewall::rule { "dnat_udp_port_$port": action => 'DNAT', @@ -21,5 +20,25 @@ define site_shorewall::dnat_rule { destinationport => $port, order => 100; } + if $site_openvpn::openvpn_allow_free { + shorewall::rule { + "dnat_free_tcp_port_$port": + action => 'DNAT', + source => 'net', + destination => "\$FW:${site_openvpn::openvpn_free_gateway_address}:1194", + proto => 'tcp', + destinationport => $port, + order => 100; + } + shorewall::rule { + "dnat_free_udp_port_$port": + action => 'DNAT', + source => 'net', + destination => "\$FW:${site_openvpn::openvpn_free_gateway_address}:1194", + proto => 'udp', + destinationport => $port, + order => 100; + } + } } } -- cgit v1.2.3 From ad62cfdad04c8f8ed9d6454f716c92e850ac53ba Mon Sep 17 00:00:00 2001 From: elijah Date: Sun, 17 Mar 2013 13:15:51 -0700 Subject: added support for "limited" service levels (although vpn is not yet actually rate limited). --- .../modules/site_shorewall/manifests/dnat_rule.pp | 40 +++++++------- puppet/modules/site_shorewall/manifests/eip.pp | 61 +++++++++++----------- 2 files changed, 51 insertions(+), 50 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp index 0b4370df..e1ea86ec 100644 --- a/puppet/modules/site_shorewall/manifests/dnat_rule.pp +++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp @@ -2,30 +2,32 @@ define site_shorewall::dnat_rule { $port = $name if $port != 1194 { - shorewall::rule { - "dnat_tcp_port_$port": - action => 'DNAT', - source => 'net', - destination => "\$FW:${site_openvpn::openvpn_gateway_address}:1194", - proto => 'tcp', - destinationport => $port, - order => 100; - } - shorewall::rule { - "dnat_udp_port_$port": - action => 'DNAT', - source => 'net', - destination => "\$FW:${site_openvpn::openvpn_gateway_address}:1194", - proto => 'udp', - destinationport => $port, - order => 100; + if $site_openvpn::openvpn_allow_paid { + shorewall::rule { + "dnat_tcp_port_$port": + action => 'DNAT', + source => 'net', + destination => "\$FW:${site_openvpn::paid_gateway_address}:1194", + proto => 'tcp', + destinationport => $port, + order => 100; + } + shorewall::rule { + "dnat_udp_port_$port": + action => 'DNAT', + source => 'net', + destination => "\$FW:${site_openvpn::paid_gateway_address}:1194", + proto => 'udp', + destinationport => $port, + order => 100; + } } if $site_openvpn::openvpn_allow_free { shorewall::rule { "dnat_free_tcp_port_$port": action => 'DNAT', source => 'net', - destination => "\$FW:${site_openvpn::openvpn_free_gateway_address}:1194", + destination => "\$FW:${site_openvpn::free_gateway_address}:1194", proto => 'tcp', destinationport => $port, order => 100; @@ -34,7 +36,7 @@ define site_shorewall::dnat_rule { "dnat_free_udp_port_$port": action => 'DNAT', source => 'net', - destination => "\$FW:${site_openvpn::openvpn_free_gateway_address}:1194", + destination => "\$FW:${site_openvpn::free_gateway_address}:1194", proto => 'udp', destinationport => $port, order => 100; diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp index d2bf3c4c..95c3920e 100644 --- a/puppet/modules/site_shorewall/manifests/eip.pp +++ b/puppet/modules/site_shorewall/manifests/eip.pp @@ -3,10 +3,6 @@ class site_shorewall::eip { include site_shorewall::defaults include site_shorewall::ip_forward - $openvpn_config = hiera('openvpn') - $openvpn_ports = $openvpn_config['ports'] - $openvpn_gateway_address = $site_openvpn::openvpn_gateway_address - # define macro for incoming services file { '/etc/shorewall/macro.leap_eip': content => "PARAM - - tcp 1194 @@ -16,41 +12,45 @@ PARAM - - udp 1194 require => Package['shorewall'] } - shorewall::interface { 'tun0': zone => 'eip', options => 'tcpflags,blacklist,nosmurfs'; 'tun1': zone => 'eip', - options => 'tcpflags,blacklist,nosmurfs' + options => 'tcpflags,blacklist,nosmurfs'; + 'tun2': + zone => 'eip', + options => 'tcpflags,blacklist,nosmurfs'; + 'tun3': + zone => 'eip', + options => 'tcpflags,blacklist,nosmurfs'; } + shorewall::zone { + 'eip': + type => 'ipv4'; + } - shorewall::zone {'eip': - type => 'ipv4'; } - - case $::virtual { - 'virtualbox': { - shorewall::masq { - 'eth0_tcp': - interface => 'eth0', - source => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}"; - 'eth0_udp': - interface => 'eth0', - source => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; } - } - default: { - $interface = $site_shorewall::defaults::interface - shorewall::masq { - "${interface}_tcp": - interface => $interface, - source => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}"; + if $::virtual == 'virtualbox' { + $interface = 'eth0' + } else { + $interface = $site_shorewall::defaults::interface + } - "${interface}_udp": - interface => $interface, - source => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; } - } + shorewall::masq { + "${interface}_unlimited_tcp": + interface => $interface, + source => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}"; + "${interface}_unlimited_udp": + interface => $interface, + source => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}"; + "${interface}_limited_tcp": + interface => $interface, + source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}"; + "${interface}_limited_udp": + interface => $interface, + source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}"; } shorewall::policy { @@ -70,7 +70,6 @@ PARAM - - udp 1194 } # create dnat rule for each port - #create_resources('site_shorewall::dnat_rule', $openvpn_ports) - site_shorewall::dnat_rule { $openvpn_ports: } + site_shorewall::dnat_rule { $site_openvpn::openvpn_ports: } } -- cgit v1.2.3 From e0354eda8f1dba999c452caf99c40dcb6f7af33e Mon Sep 17 00:00:00 2001 From: varac Date: Tue, 19 Mar 2013 08:57:35 +0100 Subject: working on stunnel for bigcouch clustering --- puppet/modules/site_shorewall/manifests/couchdb.pp | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 9fa59569..5fa1861b 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -3,10 +3,13 @@ class site_shorewall::couchdb { include site_shorewall::defaults $couchdb_port = '6984' + # Erlang Port Mapper daemon, used for communication between + # bigcouch cluster nodes + $portmapper_port = '5369' # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp $couchdb_port", + content => "PARAM - - tcp $couchdb_port $portmapper_port", notify => Service['shorewall'], require => Package['shorewall'] } @@ -20,4 +23,15 @@ class site_shorewall::couchdb { order => 200; } + shorewall::rule { + 'dnat-bigcouch-clustering-to-stunnel': + destination => "net:${::ipaddress}:8080", + destinationport => $portmapper_port, + source => '$FW', + proto => 'tcp', + order => 200, + action => 'DNAT'; + } + + } -- cgit v1.2.3 From 4b2aa1020d07d0ab25f907fbc6c76a3d78a6a84e Mon Sep 17 00:00:00 2001 From: varac Date: Tue, 19 Mar 2013 15:11:54 +0100 Subject: shorewall couchdb config: get open ports right --- puppet/modules/site_shorewall/manifests/couchdb.pp | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 5fa1861b..f1784a38 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -9,7 +9,7 @@ class site_shorewall::couchdb { # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp $couchdb_port $portmapper_port", + content => "PARAM - - tcp ${couchdb_port},${portmapper_port}", notify => Service['shorewall'], require => Package['shorewall'] } @@ -23,15 +23,15 @@ class site_shorewall::couchdb { order => 200; } - shorewall::rule { - 'dnat-bigcouch-clustering-to-stunnel': - destination => "net:${::ipaddress}:8080", - destinationport => $portmapper_port, - source => '$FW', - proto => 'tcp', - order => 200, - action => 'DNAT'; - } + #shorewall::rule { + # 'dnat-bigcouch-clustering-to-stunnel': + # destination => "net:${::ipaddress}:8080", + # destinationport => $portmapper_port, + # source => '$FW', + # proto => 'tcp', + # order => 200, + # action => 'DNAT'; + #} } -- cgit v1.2.3 From fbcc9e9a93816374e1b53b561df4b9d2a59ae7b8 Mon Sep 17 00:00:00 2001 From: varac Date: Wed, 20 Mar 2013 22:01:41 +0100 Subject: added site_shorewall::dnat to configure DNAT rules --- puppet/modules/site_shorewall/manifests/dnat.pp | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 puppet/modules/site_shorewall/manifests/dnat.pp (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/dnat.pp b/puppet/modules/site_shorewall/manifests/dnat.pp new file mode 100644 index 00000000..5992c91f --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/dnat.pp @@ -0,0 +1,19 @@ +define site_shorewall::dnat ( + $source, + $destination, + $proto, + $destinationport, + $originaldest ) { + + + shorewall::rule { + "dnat_${name}_${destinationport}": + source => $source, + destination => $destination, + destinationport => $destinationport, + originaldest => $originaldest, + proto => $proto, + order => 200, + action => 'DNAT'; + } +} -- cgit v1.2.3 From 40f32a207957293dd7c9a85df3bcccd340e16522 Mon Sep 17 00:00:00 2001 From: varac Date: Wed, 20 Mar 2013 22:02:55 +0100 Subject: added site_shorewall::couchdb::bigcouch bigcouch cluster protocol communicate via the fqdn of the neighbor hosts. So we need to bend all requests to :4369 to localhost:400x (which is the entry of an stunnel connection to the other neighbor) --- puppet/modules/site_shorewall/manifests/couchdb.pp | 11 ----------- puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp | 7 +++++++ 2 files changed, 7 insertions(+), 11 deletions(-) create mode 100644 puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index f1784a38..a448dd42 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -23,15 +23,4 @@ class site_shorewall::couchdb { order => 200; } - #shorewall::rule { - # 'dnat-bigcouch-clustering-to-stunnel': - # destination => "net:${::ipaddress}:8080", - # destinationport => $portmapper_port, - # source => '$FW', - # proto => 'tcp', - # order => 200, - # action => 'DNAT'; - #} - - } diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp new file mode 100644 index 00000000..f96ef87b --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -0,0 +1,7 @@ +class site_shorewall::couchdb::bigcouch inherits site_shorewall::couchdb { + + include site_shorewall::defaults + + create_resources(site_shorewall::dnat, hiera('shorewall_dnat')) + +} -- cgit v1.2.3 From eac4d82da1675d839fcdc2360df5929e41322c2d Mon Sep 17 00:00:00 2001 From: varac Date: Thu, 21 Mar 2013 14:03:07 +0100 Subject: start erlang vm on dedicated port so firewalling is easier --- puppet/modules/site_shorewall/manifests/couchdb.pp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index a448dd42..04b608e2 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -7,9 +7,12 @@ class site_shorewall::couchdb { # bigcouch cluster nodes $portmapper_port = '5369' + # see http://stackoverflow.com/questions/8459949/bigcouch-cluster-connection-issue#comment10467603_8463814 + $erlang_vm_port = '9001' + # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp ${couchdb_port},${portmapper_port}", + content => "PARAM - - tcp ${couchdb_port},${portmapper_port},${erlang_vm_port}", notify => Service['shorewall'], require => Package['shorewall'] } -- cgit v1.2.3 From 8b75721b7941c8ab6b7dc05101e80a121dcb0849 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sun, 31 Mar 2013 12:09:45 -0400 Subject: shorewall: add couch_server stunnel port to macro.leap_couchdb, this is necessary for the stunnel to communicate --- puppet/modules/site_shorewall/manifests/couchdb.pp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 04b608e2..6a8c2cf2 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -2,7 +2,10 @@ class site_shorewall::couchdb { include site_shorewall::defaults - $couchdb_port = '6984' + $stunnel = hiera('stunnel') + $couch_server = $stunnel['couch_server'] + $couch_stunnel_port = $couch_server['accept'] + # Erlang Port Mapper daemon, used for communication between # bigcouch cluster nodes $portmapper_port = '5369' @@ -12,12 +15,11 @@ class site_shorewall::couchdb { # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp ${couchdb_port},${portmapper_port},${erlang_vm_port}", + content => "PARAM - - tcp ${couch_stunnel_port},${portmapper_port},${erlang_vm_port}", notify => Service['shorewall'], require => Package['shorewall'] } - shorewall::rule { 'net2fw-couchdb': source => 'net', -- cgit v1.2.3 From fa65ec5b35433ecc643aa240db4c42e60dac6af9 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sun, 31 Mar 2013 12:16:54 -0400 Subject: remove unnecessary class inheritance --- puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index f96ef87b..2afdea87 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -1,4 +1,4 @@ -class site_shorewall::couchdb::bigcouch inherits site_shorewall::couchdb { +class site_shorewall::couchdb::bigcouch { include site_shorewall::defaults -- cgit v1.2.3 From 128c8ddfd4969a9b9b525cb4f4a34b1e98c2fe76 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sun, 31 Mar 2013 12:39:36 -0400 Subject: shorewall: create a macro for the bigcouch replication server stunnel to enable these connections pulling bigcouch_replication_clients, bigcouch_replication_server_port from hiera create site_shorewall::couchdb::dnat and create_resources to properly setup DNAT for bigcouch_replication_clients --- .../site_shorewall/manifests/couchdb/bigcouch.pp | 30 +++++++++++++++++++++- .../site_shorewall/manifests/couchdb/dnat.pp | 21 +++++++++++++++ 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 puppet/modules/site_shorewall/manifests/couchdb/dnat.pp (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index 2afdea87..a0d63d15 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -2,6 +2,34 @@ class site_shorewall::couchdb::bigcouch { include site_shorewall::defaults - create_resources(site_shorewall::dnat, hiera('shorewall_dnat')) + $stunnel = hiera('stunnel') + $bigcouch_replication_clients = $stunnel['bigcouch_replication_clients'] + + $bigcouch_replication_server = $stunnel['bigcouch_replication_server'] + $bigcouch_replication_server_port = $bigcouch_replication_server['accept'] + + # define macro for incoming services + file { '/etc/shorewall/macro.leap_bigcouch': + content => "PARAM - - tcp ${bigcouch_replication_server_port}", + notify => Service['shorewall'], + require => Package['shorewall'] + } + + shorewall::rule { + 'net2fw-bigcouch': + source => 'net', + destination => '$FW', + action => 'leap_bigcouch(ACCEPT)', + order => 300; + } + + $bigcouch_shorewall_dnat_defaults = { + 'source' => '$FW', + 'proto' => 'tcp', + 'destinationport' => '4369', + } + + create_resources(site_shorewall::couchdb::dnat, $bigcouch_replication_clients, $bigcouch_shorewall_dnat_defaults) } + diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp new file mode 100644 index 00000000..85cea9d5 --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp @@ -0,0 +1,21 @@ +define site_shorewall::couchdb::dnat ( + $source, + $connect, + $connect_port, + $accept_port, + $proto, + $destinationport ) +{ + + + shorewall::rule { + "dnat_${name}_${destinationport}": + source => $source, + destination => "\$FW:127.0.0.1:${accept_port}", + destinationport => $destinationport, + originaldest => $connect, + proto => $proto, + order => 200, + action => 'DNAT'; + } +} -- cgit v1.2.3 From ee1555bd9091e1ffe66e54856d2bde72d50a7e60 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 2 Apr 2013 16:55:12 -0400 Subject: firewall: remove no longer needed epmd port --- puppet/modules/site_shorewall/manifests/couchdb.pp | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 6a8c2cf2..1ef91bb0 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -6,16 +6,12 @@ class site_shorewall::couchdb { $couch_server = $stunnel['couch_server'] $couch_stunnel_port = $couch_server['accept'] - # Erlang Port Mapper daemon, used for communication between - # bigcouch cluster nodes - $portmapper_port = '5369' - # see http://stackoverflow.com/questions/8459949/bigcouch-cluster-connection-issue#comment10467603_8463814 $erlang_vm_port = '9001' # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp ${couch_stunnel_port},${portmapper_port},${erlang_vm_port}", + content => "PARAM - - tcp ${couch_stunnel_port},${erlang_vm_port}", notify => Service['shorewall'], require => Package['shorewall'] } -- cgit v1.2.3 From 0227e03513f38cfae4a041ba6740b425fdc21198 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 2 Apr 2013 17:09:22 -0400 Subject: replace hard-coded port number with hiera determined one, manipulated to remove the 'ip:' from the beginning in bigcouch replication client stunnels --- puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index a0d63d15..85272657 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -7,6 +7,7 @@ class site_shorewall::couchdb::bigcouch { $bigcouch_replication_server = $stunnel['bigcouch_replication_server'] $bigcouch_replication_server_port = $bigcouch_replication_server['accept'] + $bigcouch_replication_connect = $bigcouch_replication_server['connect'] # define macro for incoming services file { '/etc/shorewall/macro.leap_bigcouch': @@ -26,7 +27,7 @@ class site_shorewall::couchdb::bigcouch { $bigcouch_shorewall_dnat_defaults = { 'source' => '$FW', 'proto' => 'tcp', - 'destinationport' => '4369', + 'destinationport' => regsubst($bigcouch_replication_connect, '^([0-9.]+:)([0-9]+)$', '\2') } create_resources(site_shorewall::couchdb::dnat, $bigcouch_replication_clients, $bigcouch_shorewall_dnat_defaults) -- cgit v1.2.3 From 1750bec7032e90ddbe43da35eb5f49066187d1d4 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 2 Apr 2013 17:43:43 -0400 Subject: shorewall: re-order dnat rule variables to match configuration file order --- puppet/modules/site_shorewall/manifests/couchdb/dnat.pp | 6 +++--- puppet/modules/site_shorewall/manifests/dnat.pp | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp index 85cea9d5..f1bc9acf 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp @@ -10,12 +10,12 @@ define site_shorewall::couchdb::dnat ( shorewall::rule { "dnat_${name}_${destinationport}": + action => 'DNAT', source => $source, destination => "\$FW:127.0.0.1:${accept_port}", + proto => $proto, destinationport => $destinationport, originaldest => $connect, - proto => $proto, - order => 200, - action => 'DNAT'; + order => 200 } } diff --git a/puppet/modules/site_shorewall/manifests/dnat.pp b/puppet/modules/site_shorewall/manifests/dnat.pp index 5992c91f..a73294cc 100644 --- a/puppet/modules/site_shorewall/manifests/dnat.pp +++ b/puppet/modules/site_shorewall/manifests/dnat.pp @@ -8,12 +8,12 @@ define site_shorewall::dnat ( shorewall::rule { "dnat_${name}_${destinationport}": + action => 'DNAT', source => $source, destination => $destination, + proto => $proto, destinationport => $destinationport, originaldest => $originaldest, - proto => $proto, - order => 200, - action => 'DNAT'; + order => 200 } } -- cgit v1.2.3 From e530f0c1d1a0a26bd277b70197b1f26871d92b1b Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Thu, 4 Apr 2013 11:40:12 -0400 Subject: rename bigcouch.port to more accurate bigcouch.epmd_port --- .../modules/site_shorewall/manifests/couchdb/bigcouch.pp | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index 85272657..a8320df8 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -3,15 +3,15 @@ class site_shorewall::couchdb::bigcouch { include site_shorewall::defaults $stunnel = hiera('stunnel') - $bigcouch_replication_clients = $stunnel['bigcouch_replication_clients'] + $epmd_clients = $stunnel['epmd_clients'] - $bigcouch_replication_server = $stunnel['bigcouch_replication_server'] - $bigcouch_replication_server_port = $bigcouch_replication_server['accept'] - $bigcouch_replication_connect = $bigcouch_replication_server['connect'] + $epmd_server = $stunnel['epmd_server'] + $epmd_server_port = $epmd_server['accept'] + $epmd_server_connect = $epmd_server['connect'] # define macro for incoming services file { '/etc/shorewall/macro.leap_bigcouch': - content => "PARAM - - tcp ${bigcouch_replication_server_port}", + content => "PARAM - - tcp ${epmd_server_port}", notify => Service['shorewall'], require => Package['shorewall'] } @@ -24,13 +24,13 @@ class site_shorewall::couchdb::bigcouch { order => 300; } - $bigcouch_shorewall_dnat_defaults = { + $epmd_shorewall_dnat_defaults = { 'source' => '$FW', 'proto' => 'tcp', - 'destinationport' => regsubst($bigcouch_replication_connect, '^([0-9.]+:)([0-9]+)$', '\2') + 'destinationport' => regsubst($epmd_server_connect, '^([0-9.]+:)([0-9]+)$', '\2') } - create_resources(site_shorewall::couchdb::dnat, $bigcouch_replication_clients, $bigcouch_shorewall_dnat_defaults) + create_resources(site_shorewall::couchdb::dnat, $epmd_clients, $epmd_shorewall_dnat_defaults) } -- cgit v1.2.3 From 2c53c5023b925cb596e3f450f194482eade1fbeb Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Thu, 4 Apr 2013 12:50:30 -0400 Subject: add Erlang Distributed Node Protocol Port json entry under bigcouch setup ednp_server and ednp_client stunnels update couchdb puppet submodule to support configurable ednp_port parameter and general module cleanup pass ednp_port to couchdb setup so that it is configured in the vm.args template clarify in comments the difference between the epmd and ednp ports remove hard-coded erlang_vm_port variable and instead setup shorewall to allow for the stunnel connection only setup dnat rules for the ednp client connections --- puppet/modules/site_shorewall/manifests/couchdb.pp | 5 +---- .../site_shorewall/manifests/couchdb/bigcouch.pp | 21 ++++++++++++++++++--- 2 files changed, 19 insertions(+), 7 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 1ef91bb0..73bed62b 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -6,12 +6,9 @@ class site_shorewall::couchdb { $couch_server = $stunnel['couch_server'] $couch_stunnel_port = $couch_server['accept'] - # see http://stackoverflow.com/questions/8459949/bigcouch-cluster-connection-issue#comment10467603_8463814 - $erlang_vm_port = '9001' - # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp ${couch_stunnel_port},${erlang_vm_port}", + content => "PARAM - - tcp ${couch_stunnel_port}", notify => Service['shorewall'], require => Package['shorewall'] } diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index a8320df8..20740650 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -3,15 +3,22 @@ class site_shorewall::couchdb::bigcouch { include site_shorewall::defaults $stunnel = hiera('stunnel') - $epmd_clients = $stunnel['epmd_clients'] + # Erlang Port Mapper Daemon (epmd) stunnel server/clients + $epmd_clients = $stunnel['epmd_clients'] $epmd_server = $stunnel['epmd_server'] $epmd_server_port = $epmd_server['accept'] $epmd_server_connect = $epmd_server['connect'] + # Erlang Distributed Node Protocol (ednp) stunnel server/clients + $ednp_clients = $stunnel['ednp_clients'] + $ednp_server = $stunnel['ednp_server'] + $ednp_server_port = $ednp_server['accept'] + $ednp_server_connect = $ednp_server['connect'] + # define macro for incoming services file { '/etc/shorewall/macro.leap_bigcouch': - content => "PARAM - - tcp ${epmd_server_port}", + content => "PARAM - - tcp ${epmd_server_port},${ednp_server_port}", notify => Service['shorewall'], require => Package['shorewall'] } @@ -24,13 +31,21 @@ class site_shorewall::couchdb::bigcouch { order => 300; } + # setup DNAT rules for each epmd $epmd_shorewall_dnat_defaults = { 'source' => '$FW', 'proto' => 'tcp', 'destinationport' => regsubst($epmd_server_connect, '^([0-9.]+:)([0-9]+)$', '\2') } - create_resources(site_shorewall::couchdb::dnat, $epmd_clients, $epmd_shorewall_dnat_defaults) + # setup DNAT rules for each ednp + $ednp_shorewall_dnat_defaults = { + 'source' => '$FW', + 'proto' => 'tcp', + 'destinationport' => regsubst($ednp_server_connect, '^([0-9.]+:)([0-9]+)$', '\2') + } + create_resources(site_shorewall::couchdb::dnat, $ednp_clients, $ednp_shorewall_dnat_defaults) + } -- cgit v1.2.3 From 8e5716518b361aceac5c2cc5433148edf8785d89 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 30 Apr 2013 17:17:54 -0400 Subject: setup a site_config::params class that can be used to set some common variables that are used in different places to start with we setup the $interface variable, based on logic as defined in #2213 change the various places that were looking up this value to use site_config::params::interface instead --- puppet/modules/site_shorewall/manifests/defaults.pp | 14 +++----------- puppet/modules/site_shorewall/manifests/eip.pp | 7 ++----- 2 files changed, 5 insertions(+), 16 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp index d5639a90..c62c9307 100644 --- a/puppet/modules/site_shorewall/manifests/defaults.pp +++ b/puppet/modules/site_shorewall/manifests/defaults.pp @@ -1,17 +1,10 @@ class site_shorewall::defaults { include shorewall + include site_config::params # be safe for development #if ( $::virtual == 'virtualbox') { $shorewall_startup='0' } - $ip_address = hiera('ip_address') - # a special case for vagrant interfaces - $interface = $::virtual ? { - virtualbox => [ 'eth0', 'eth1' ], - default => getvar("interface_${ip_address}") - } - - # If you want logging: shorewall::params { 'LOG': value => 'debug'; @@ -19,14 +12,13 @@ class site_shorewall::defaults { shorewall::zone {'net': type => 'ipv4'; } - # define interfaces - shorewall::interface { $interface: + shorewall::interface { $site_config::params::interface: zone => 'net', options => 'tcpflags,blacklist,nosmurfs'; } - shorewall::routestopped { $interface: } + shorewall::routestopped { $site_config::params::interface: } shorewall::policy { 'fw-to-all': diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp index 95c3920e..2f84d45c 100644 --- a/puppet/modules/site_shorewall/manifests/eip.pp +++ b/puppet/modules/site_shorewall/manifests/eip.pp @@ -1,6 +1,7 @@ class site_shorewall::eip { include site_shorewall::defaults + include site_config::params include site_shorewall::ip_forward # define macro for incoming services @@ -32,11 +33,7 @@ PARAM - - udp 1194 type => 'ipv4'; } - if $::virtual == 'virtualbox' { - $interface = 'eth0' - } else { - $interface = $site_shorewall::defaults::interface - } + $interface = $site_config::params::interface shorewall::masq { "${interface}_unlimited_tcp": -- cgit v1.2.3 From b54161a12561c5983f6bc5215f764a1f46a4bd1f Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 30 Apr 2013 17:18:19 -0400 Subject: minor spacing changes --- puppet/modules/site_shorewall/manifests/eip.pp | 30 +++++++++++++------------- 1 file changed, 15 insertions(+), 15 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp index 2f84d45c..8a986d28 100644 --- a/puppet/modules/site_shorewall/manifests/eip.pp +++ b/puppet/modules/site_shorewall/manifests/eip.pp @@ -7,8 +7,8 @@ class site_shorewall::eip { # define macro for incoming services file { '/etc/shorewall/macro.leap_eip': content => "PARAM - - tcp 1194 -PARAM - - udp 1194 -", + PARAM - - udp 1194 + ", notify => Service['shorewall'], require => Package['shorewall'] } @@ -37,17 +37,17 @@ PARAM - - udp 1194 shorewall::masq { "${interface}_unlimited_tcp": - interface => $interface, - source => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}"; + interface => $interface, + source => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}"; "${interface}_unlimited_udp": - interface => $interface, - source => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}"; + interface => $interface, + source => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}"; "${interface}_limited_tcp": - interface => $interface, - source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}"; + interface => $interface, + source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}"; "${interface}_limited_udp": - interface => $interface, - source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}"; + interface => $interface, + source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}"; } shorewall::policy { @@ -59,11 +59,11 @@ PARAM - - udp 1194 } shorewall::rule { - 'net2fw-openvpn': - source => 'net', - destination => '$FW', - action => 'leap_eip(ACCEPT)', - order => 200; + 'net2fw-openvpn': + source => 'net', + destination => '$FW', + action => 'leap_eip(ACCEPT)', + order => 200; } # create dnat rule for each port -- cgit v1.2.3 From 8087a374429c1b1be5a766e6e89cdeb02de292a3 Mon Sep 17 00:00:00 2001 From: elijah Date: Thu, 2 May 2013 14:01:35 -0700 Subject: fixed dnat_rules --- puppet/modules/site_shorewall/manifests/dnat_rule.pp | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp index e1ea86ec..aa298408 100644 --- a/puppet/modules/site_shorewall/manifests/dnat_rule.pp +++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp @@ -2,12 +2,12 @@ define site_shorewall::dnat_rule { $port = $name if $port != 1194 { - if $site_openvpn::openvpn_allow_paid { + if $site_openvpn::openvpn_allow_unlimited { shorewall::rule { "dnat_tcp_port_$port": action => 'DNAT', source => 'net', - destination => "\$FW:${site_openvpn::paid_gateway_address}:1194", + destination => "\$FW:${site_openvpn::unlimited_gateway_address}:1194", proto => 'tcp', destinationport => $port, order => 100; @@ -16,18 +16,18 @@ define site_shorewall::dnat_rule { "dnat_udp_port_$port": action => 'DNAT', source => 'net', - destination => "\$FW:${site_openvpn::paid_gateway_address}:1194", + destination => "\$FW:${site_openvpn::unlimited_gateway_address}:1194", proto => 'udp', destinationport => $port, order => 100; } } - if $site_openvpn::openvpn_allow_free { + if $site_openvpn::openvpn_allow_limited { shorewall::rule { "dnat_free_tcp_port_$port": action => 'DNAT', source => 'net', - destination => "\$FW:${site_openvpn::free_gateway_address}:1194", + destination => "\$FW:${site_openvpn::limited_gateway_address}:1194", proto => 'tcp', destinationport => $port, order => 100; @@ -36,7 +36,7 @@ define site_shorewall::dnat_rule { "dnat_free_udp_port_$port": action => 'DNAT', source => 'net', - destination => "\$FW:${site_openvpn::free_gateway_address}:1194", + destination => "\$FW:${site_openvpn::limited_gateway_address}:1194", proto => 'udp', destinationport => $port, order => 100; -- cgit v1.2.3 From 0f6d2ebd6467d1c793d1907d677ca374a1efe477 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sat, 11 May 2013 14:05:14 -0400 Subject: special casing for pistoncloud/openstack/ec2 --- puppet/modules/site_shorewall/manifests/eip.pp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp index 8a986d28..7109b770 100644 --- a/puppet/modules/site_shorewall/manifests/eip.pp +++ b/puppet/modules/site_shorewall/manifests/eip.pp @@ -42,12 +42,16 @@ class site_shorewall::eip { "${interface}_unlimited_udp": interface => $interface, source => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}"; - "${interface}_limited_tcp": - interface => $interface, - source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}"; - "${interface}_limited_udp": - interface => $interface, - source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}"; + } + if ! $::ec2_instance_id { + shorewall::masq { + "${interface}_limited_tcp": + interface => $interface, + source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}"; + "${interface}_limited_udp": + interface => $interface, + source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}"; + } } shorewall::policy { -- cgit v1.2.3 From d10240be7ac7116e86cee32f5b8d5b90768e7094 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Wed, 12 Jun 2013 14:01:24 -0400 Subject: webapp should be available over http so a proper redirect can be done to https without this rule, one just gets a 'site is unavailable' result Change-Id: I27b80a0044e9fe4e87e607412c8d0a089d4866a6 --- puppet/modules/site_shorewall/manifests/webapp.pp | 1 + 1 file changed, 1 insertion(+) (limited to 'puppet/modules/site_shorewall/manifests') diff --git a/puppet/modules/site_shorewall/manifests/webapp.pp b/puppet/modules/site_shorewall/manifests/webapp.pp index d12bbc8f..a8d2aa5b 100644 --- a/puppet/modules/site_shorewall/manifests/webapp.pp +++ b/puppet/modules/site_shorewall/manifests/webapp.pp @@ -2,5 +2,6 @@ class site_shorewall::webapp { include site_shorewall::defaults include site_shorewall::service::https + include site_shorewall::service::http include site_shorewall::service::webapp_api } -- cgit v1.2.3