summaryrefslogtreecommitdiff
path: root/manifests/rules
diff options
context:
space:
mode:
Diffstat (limited to 'manifests/rules')
-rw-r--r--manifests/rules/libvirt/host.pp19
-rw-r--r--manifests/rules/libvirt/host/from_vmz.pp14
-rw-r--r--manifests/rules/mosh.pp11
-rw-r--r--manifests/rules/munin.pp31
-rw-r--r--manifests/rules/openvpn.pp26
-rw-r--r--manifests/rules/out/ekeyd.pp2
-rw-r--r--manifests/rules/out/ibackup.pp8
-rw-r--r--manifests/rules/out/imap.pp24
-rw-r--r--manifests/rules/out/pop3.pp24
-rw-r--r--manifests/rules/out/puppet.pp22
-rw-r--r--manifests/rules/out/tor.pp11
-rw-r--r--manifests/rules/puppet.pp37
-rw-r--r--manifests/rules/puppet/master.pp2
13 files changed, 145 insertions, 86 deletions
diff --git a/manifests/rules/libvirt/host.pp b/manifests/rules/libvirt/host.pp
index dc3970d..090a9ca 100644
--- a/manifests/rules/libvirt/host.pp
+++ b/manifests/rules/libvirt/host.pp
@@ -6,21 +6,6 @@ class shorewall::rules::libvirt::host (
$vmz_iface = 'virbr0',
) {
- define shorewall::rule::accept::from_vmz (
- $proto = '-',
- $destinationport = '-',
- $action = 'ACCEPT'
- ) {
- shorewall::rule { $name:
- source => $shorewall::rules::libvirt::host::vmz,
- destination => '$FW',
- order => 300,
- proto => $proto,
- destinationport => $destinationport,
- action => $action;
- }
- }
-
shorewall::policy {
'fw-to-vmz':
sourcezone => '$FW',
@@ -40,7 +25,7 @@ class shorewall::rules::libvirt::host (
order => 800;
}
- shorewall::rule::accept::from_vmz {
+ shorewall::rules::libvirt::host::from_vmz {
'accept_dns_from_vmz':
action => 'DNS(ACCEPT)';
'accept_tftp_from_vmz':
@@ -62,7 +47,7 @@ class shorewall::rules::libvirt::host (
}
if $debproxy_port {
- shorewall::rule::accept::from_vmz { 'accept_debproxy_from_vmz':
+ shorewall::rules::libvirt::host::from_vmz { 'accept_debproxy_from_vmz':
proto => 'tcp',
destinationport => $debproxy_port,
action => 'ACCEPT';
diff --git a/manifests/rules/libvirt/host/from_vmz.pp b/manifests/rules/libvirt/host/from_vmz.pp
new file mode 100644
index 0000000..f25c333
--- /dev/null
+++ b/manifests/rules/libvirt/host/from_vmz.pp
@@ -0,0 +1,14 @@
+define shorewall::rules::libvirt::host::from_vmz (
+ $proto = '-',
+ $destinationport = '-',
+ $action = 'ACCEPT'
+) {
+ shorewall::rule { $name:
+ source => $shorewall::rules::libvirt::host::vmz,
+ destination => '$FW',
+ order => 300,
+ proto => $proto,
+ destinationport => $destinationport,
+ action => $action;
+ }
+}
diff --git a/manifests/rules/mosh.pp b/manifests/rules/mosh.pp
new file mode 100644
index 0000000..1cd3486
--- /dev/null
+++ b/manifests/rules/mosh.pp
@@ -0,0 +1,11 @@
+# enable mosh support
+class shorewall::rules::mosh {
+ shorewall::rule { 'net-me-mosh-udp':
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '60000:61000',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/munin.pp b/manifests/rules/munin.pp
index a20a4e0..9496138 100644
--- a/manifests/rules/munin.pp
+++ b/manifests/rules/munin.pp
@@ -1,16 +1,21 @@
+# outgoing munin rules
class shorewall::rules::munin(
- $munin_port = '4949',
- $munin_collector = ['127.0.0.1'],
- $collector_source = 'net'
+ $munin_port = '4949',
+ $munin_collector = ['127.0.0.1'],
+ $collector_source = 'net',
+ $shorewall6 = true,
){
- shorewall::params { 'MUNINPORT': value => $munin_port }
- shorewall::params { 'MUNINCOLLECTOR': value => join(any2array($munin_collector),',') }
- shorewall::rule{'net-me-munin-tcp':
- source => "${collector_source}:\$MUNINCOLLECTOR",
- destination => '$FW',
- proto => 'tcp',
- destinationport => '$MUNINPORT',
- order => 240,
- action => 'ACCEPT';
- }
+ shorewall::params4{
+ 'MUNINPORT': value => $munin_port;
+ 'MUNINCOLLECTOR': value => join(any2array($munin_collector),',');
+ }
+ shorewall::rule{'net-me-munin-tcp':
+ source => "${collector_source}:\$MUNINCOLLECTOR",
+ destination => '$FW',
+ proto => 'tcp',
+ destinationport => '$MUNINPORT',
+ order => 240,
+ shorewall6 => $shorewall6,
+ action => 'ACCEPT';
+ }
}
diff --git a/manifests/rules/openvpn.pp b/manifests/rules/openvpn.pp
index 55a20d2..842e276 100644
--- a/manifests/rules/openvpn.pp
+++ b/manifests/rules/openvpn.pp
@@ -1,18 +1,12 @@
+# openvpn incoming
class shorewall::rules::openvpn {
- shorewall::rule { 'net-me-openvpn-udp':
- source => 'net',
- destination => '$FW',
- proto => 'udp',
- destinationport => '1194',
- order => 240,
- action => 'ACCEPT';
- }
- shorewall::rule { 'me-net-openvpn-udp':
- source => '$FW',
- destination => 'net',
- proto => 'udp',
- destinationport => '1194',
- order => 240,
- action => 'ACCEPT';
- }
+ shorewall::rule {
+ 'net-me-openvpn-udp':
+ source => 'net',
+ destination => '$FW',
+ proto => 'udp',
+ destinationport => '1194',
+ order => 240,
+ action => 'ACCEPT';
+ }
}
diff --git a/manifests/rules/out/ekeyd.pp b/manifests/rules/out/ekeyd.pp
index 8acdaad..c437f6a 100644
--- a/manifests/rules/out/ekeyd.pp
+++ b/manifests/rules/out/ekeyd.pp
@@ -1,5 +1,5 @@
define shorewall::rules::out::ekeyd($host) {
- shorewall::rule { "me-${name}-tcp_ekeyd":
+ shorewall::rule4{ "me-${name}-tcp_ekeyd":
source => '$FW',
destination => "${name}:${host}",
proto => 'tcp',
diff --git a/manifests/rules/out/ibackup.pp b/manifests/rules/out/ibackup.pp
index 856bcdb..17cc314 100644
--- a/manifests/rules/out/ibackup.pp
+++ b/manifests/rules/out/ibackup.pp
@@ -1,5 +1,7 @@
class shorewall::rules::out::ibackup(
- $backup_host
+ $backup_host,
+ $shorewall = true,
+ $shorewall6 = false,
){
shorewall::rule { 'me-net-tcp_backupssh':
source => '$FW',
@@ -7,6 +9,8 @@ class shorewall::rules::out::ibackup(
proto => 'tcp',
destinationport => 'ssh',
order => 240,
- action => 'ACCEPT';
+ action => 'ACCEPT',
+ shorewall => $shorewall,
+ shorewall6 => $shorewall6,
}
}
diff --git a/manifests/rules/out/imap.pp b/manifests/rules/out/imap.pp
index f1313d2..0cbee50 100644
--- a/manifests/rules/out/imap.pp
+++ b/manifests/rules/out/imap.pp
@@ -1,11 +1,15 @@
-class shorewall::rules::out::imap {
- shorewall::rule {
- 'me-net-tcp_imap_s':
- source => '$FW',
- destination => 'net',
- proto => 'tcp',
- destinationport => '143,993',
- order => 260,
- action => 'ACCEPT';
- }
+# outgoing imap
+class shorewall::rules::out::imap(
+ $shorewall6 = true,
+) {
+ shorewall::rule {
+ 'me-net-tcp_imap_s':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '143,993',
+ order => 260,
+ action => 'ACCEPT',
+ shorewall6 => $shorewall6,
+ }
}
diff --git a/manifests/rules/out/pop3.pp b/manifests/rules/out/pop3.pp
index ebd4828..ea66bf7 100644
--- a/manifests/rules/out/pop3.pp
+++ b/manifests/rules/out/pop3.pp
@@ -1,11 +1,15 @@
-class shorewall::rules::out::pop3 {
- shorewall::rule {
- 'me-net-tcp_pop3_s':
- source => '$FW',
- destination => 'net',
- proto => 'tcp',
- destinationport => 'pop3,pop3s',
- order => 260,
- action => 'ACCEPT';
- }
+# outoging oper3
+class shorewall::rules::out::pop3(
+ $shorewall6 = true,
+) {
+ shorewall::rule {
+ 'me-net-tcp_pop3_s':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => 'pop3,pop3s',
+ order => 260,
+ action => 'ACCEPT',
+ shorewall6 => $shorewall6,
+ }
}
diff --git a/manifests/rules/out/puppet.pp b/manifests/rules/out/puppet.pp
index cbe8cce..ac13bbb 100644
--- a/manifests/rules/out/puppet.pp
+++ b/manifests/rules/out/puppet.pp
@@ -1,20 +1,22 @@
+# outgoing puppet traffic
class shorewall::rules::out::puppet(
- $puppetserver = "puppet.${::domain}",
- $puppetserver_port = 8140,
- $puppetserver_signport = 8141
+ $puppetserver = "puppet.${::domain}",
+ $puppetserver_port = 8140,
+ $shorewall6 = true,
) {
class{'shorewall::rules::puppet':
puppetserver => $puppetserver,
puppetserver_port => $puppetserver_port,
- puppetserver_signport => $puppetserver_signport,
+ shorewall6 => $shorewall6,
}
# we want to connect to the puppet server
shorewall::rule { 'me-net-puppet_tcp':
- source => '$FW',
- destination => 'net:$PUPPETSERVER',
- proto => 'tcp',
- destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
- order => 340,
- action => 'ACCEPT';
+ source => '$FW',
+ destination => 'net:$PUPPETSERVER',
+ proto => 'tcp',
+ destinationport => '$PUPPETSERVER_PORT',
+ order => 340,
+ shorewall6 => $shorewall6,
+ action => 'ACCEPT';
}
}
diff --git a/manifests/rules/out/tor.pp b/manifests/rules/out/tor.pp
new file mode 100644
index 0000000..b4128d0
--- /dev/null
+++ b/manifests/rules/out/tor.pp
@@ -0,0 +1,11 @@
+# open outgoing port to connect to the network
+class shorewall::rules::out::tor {
+ shorewall::rule{'me-net-tor-tcp':
+ source => '$FW',
+ destination => 'net',
+ proto => 'tcp',
+ destinationport => '9001',
+ order => 240,
+ action => 'ACCEPT';
+ }
+}
diff --git a/manifests/rules/puppet.pp b/manifests/rules/puppet.pp
index 84e7d81..3c90370 100644
--- a/manifests/rules/puppet.pp
+++ b/manifests/rules/puppet.pp
@@ -1,11 +1,36 @@
+# outgoing puppet params
class shorewall::rules::puppet(
- $puppetserver = "puppet.${::domain}",
- $puppetserver_port = 8140,
- $puppetserver_signport = 8141
+ $puppetserver = "puppet.${::domain}",
+ $puppetserver_v6 = undef,
+ $puppetserver_port = 8140,
+ $shorewall6 = true,
){
shorewall::params{
- 'PUPPETSERVER': value => $puppetserver;
- 'PUPPETSERVER_PORT': value => $puppetserver_port;
- 'PUPPETSERVER_SIGN_PORT': value => $puppetserver_signport;
+ 'PUPPETSERVER_PORT':
+ value => $puppetserver_port,
+ shorewall6 => $shorewall6;
+ }
+ if is_ipv4_address($puppetserver){
+ shorewall::params4{
+ 'PUPPETSERVER':
+ value => $puppetserver;
+ }
+ if $puppetserver_v6 {
+ shorewall::params6{
+ 'PUPPETSERVER':
+ value => $puppetserver_v6;
+ }
+ }
+ } elsif is_ipv6_address($puppetserver){
+ shorewall::params6{
+ 'PUPPETSERVER':
+ value => $puppetserver;
+ }
+ } else {
+ shorewall::params{
+ 'PUPPETSERVER':
+ value => $puppetserver,
+ shorewall6 => $shorewall6;
+ }
}
}
diff --git a/manifests/rules/puppet/master.pp b/manifests/rules/puppet/master.pp
index 925979c..56b9f0b 100644
--- a/manifests/rules/puppet/master.pp
+++ b/manifests/rules/puppet/master.pp
@@ -3,7 +3,7 @@ class shorewall::rules::puppet::master {
source => 'net',
destination => '$FW',
proto => 'tcp',
- destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
+ destinationport => '$PUPPETSERVER_PORT',
order => 240,
action => 'ACCEPT';
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-19 19:51:27 +0000