1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
class site_shorewall::eip {
include site_shorewall::defaults
include site_config::params
include site_shorewall::ip_forward
# define macro for incoming services
file { '/etc/shorewall/macro.leap_eip':
content => "PARAM - - tcp 1194
PARAM - - udp 1194
",
notify => Service['shorewall'],
require => Package['shorewall']
}
shorewall::interface {
'tun0':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
'tun1':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
'tun2':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
'tun3':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
}
shorewall::zone {
'eip':
type => 'ipv4';
}
$interface = $site_config::params::interface
shorewall::masq {
"${interface}_unlimited_tcp":
interface => $interface,
source => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}";
"${interface}_unlimited_udp":
interface => $interface,
source => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}";
}
if ! $::ec2_instance_id {
shorewall::masq {
"${interface}_limited_tcp":
interface => $interface,
source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}";
"${interface}_limited_udp":
interface => $interface,
source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}";
}
}
shorewall::policy {
'eip-to-all':
sourcezone => 'eip',
destinationzone => 'all',
policy => 'ACCEPT',
order => 100;
}
shorewall::rule {
'net2fw-openvpn':
source => 'net',
destination => '$FW',
action => 'leap_eip(ACCEPT)',
order => 200;
'block_eip_dns_udp':
action => 'REJECT',
source => 'eip',
destination => 'net',
proto => 'udp',
destinationport => 'domain',
order => 300;
'block_eip_dns_tcp':
action => 'REJECT',
source => 'eip',
destination => 'net',
proto => 'tcp',
destinationport => 'domain',
order => 301;
'accept_all_eip_to_eip_gateway_udp_unlimited':
action => 'ACCEPT',
source => 'eip',
destination => 'eip:10.41.0.1',
proto => 'all',
order => 302;
'accept_all_eip_to_eip_gateway_tcp_unlimited':
action => 'ACCEPT',
source => 'eip',
destination => 'eip:10.42.0.1',
proto => 'all',
order => 303;
'accept_all_eip_to_eip_gateway_udp_limited':
action => 'ACCEPT',
source => 'eip',
destination => 'eip:10.43.0.1',
proto => 'all',
order => 304;
'accept_all_eip_to_eip_gateway_tcp_limited':
action => 'ACCEPT',
source => 'eip',
destination => 'eip:10.44.0.1',
order => 305;
'reject_all_other_eip_to_eip':
action => 'REJECT',
source => 'eip',
destination => 'eip',
order => 306;
}
# create dnat rule for each port
site_shorewall::dnat_rule { $site_openvpn::openvpn_ports: }
}
|
