1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
# Configure shorewall on eip/vpn nodes
class site_shorewall::eip {
include site_shorewall::defaults
include site_config::params
include site_shorewall::ip_forward
# define macro for incoming services
file { '/etc/shorewall/macro.leap_eip':
content => "PARAM - - tcp 1194
PARAM - - udp 1194
",
notify => Exec['shorewall_check'],
require => Package['shorewall']
}
shorewall::interface {
'tun0':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
'tun1':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
'tun2':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
'tun3':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
}
shorewall::zone {
'eip':
type => 'ipv4';
}
$interface = $site_config::params::interface
shorewall::masq {
"${interface}_unlimited_tcp":
interface => $interface,
source => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}";
"${interface}_unlimited_udp":
interface => $interface,
source => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}";
}
if ! $::ec2_instance_id {
shorewall::masq {
"${interface}_limited_tcp":
interface => $interface,
source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}";
"${interface}_limited_udp":
interface => $interface,
source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}";
}
}
shorewall::policy {
'eip-to-all':
sourcezone => 'eip',
destinationzone => 'all',
policy => 'ACCEPT',
order => 100;
}
shorewall::rule {
'net2fw-openvpn':
source => 'net',
destination => '$FW',
action => 'leap_eip(ACCEPT)',
order => 200;
'block_eip_dns_udp':
action => 'REJECT',
source => 'eip',
destination => 'net',
proto => 'udp',
destinationport => 'domain',
order => 300;
'block_eip_dns_tcp':
action => 'REJECT',
source => 'eip',
destination => 'net',
proto => 'tcp',
destinationport => 'domain',
order => 301;
}
# create dnat rule for each port
site_shorewall::dnat_rule { $site_openvpn::openvpn_ports: }
}
|
