From c2bf7e71d8598dbb05b5dee9f452b6332e9e916e Mon Sep 17 00:00:00 2001 From: mh Date: Tue, 25 Apr 2017 15:28:26 +0200 Subject: make it possibble to disable ipv6 for these rules --- manifests/rules/out/puppet.pp | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) (limited to 'manifests/rules/out') diff --git a/manifests/rules/out/puppet.pp b/manifests/rules/out/puppet.pp index cbe8cce..827e23a 100644 --- a/manifests/rules/out/puppet.pp +++ b/manifests/rules/out/puppet.pp @@ -1,7 +1,9 @@ +# outgoing puppet traffic class shorewall::rules::out::puppet( - $puppetserver = "puppet.${::domain}", - $puppetserver_port = 8140, - $puppetserver_signport = 8141 + $puppetserver = "puppet.${::domain}", + $puppetserver_port = 8140, + $puppetserver_signport = 8141, + $shorewall6 = true, ) { class{'shorewall::rules::puppet': puppetserver => $puppetserver, @@ -10,11 +12,12 @@ class shorewall::rules::out::puppet( } # we want to connect to the puppet server shorewall::rule { 'me-net-puppet_tcp': - source => '$FW', - destination => 'net:$PUPPETSERVER', - proto => 'tcp', - destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT', - order => 340, - action => 'ACCEPT'; + source => '$FW', + destination => 'net:$PUPPETSERVER', + proto => 'tcp', + destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT', + order => 340, + shorewall6 => $shorewall6, + action => 'ACCEPT'; } } -- cgit v1.2.3 From a5e5276a42745bde23800fb5a614363924351323 Mon Sep 17 00:00:00 2001 From: mh Date: Mon, 1 May 2017 17:37:55 +0200 Subject: this is IPv4 only so far --- manifests/rules/out/ekeyd.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'manifests/rules/out') diff --git a/manifests/rules/out/ekeyd.pp b/manifests/rules/out/ekeyd.pp index 8acdaad..c437f6a 100644 --- a/manifests/rules/out/ekeyd.pp +++ b/manifests/rules/out/ekeyd.pp @@ -1,5 +1,5 @@ define shorewall::rules::out::ekeyd($host) { - shorewall::rule { "me-${name}-tcp_ekeyd": + shorewall::rule4{ "me-${name}-tcp_ekeyd": source => '$FW', destination => "${name}:${host}", proto => 'tcp', -- cgit v1.2.3 From 1643fc0f14aaf4a31f18af8adcf682298a9c8aca Mon Sep 17 00:00:00 2001 From: mh Date: Tue, 29 Aug 2017 12:50:31 +0200 Subject: there is no ipv6 support there yet --- manifests/rules/out/ibackup.pp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'manifests/rules/out') diff --git a/manifests/rules/out/ibackup.pp b/manifests/rules/out/ibackup.pp index 856bcdb..9827426 100644 --- a/manifests/rules/out/ibackup.pp +++ b/manifests/rules/out/ibackup.pp @@ -1,5 +1,7 @@ class shorewall::rules::out::ibackup( - $backup_host + $backup_host, + $shorewall4 = true, + $shorewall6 = false, ){ shorewall::rule { 'me-net-tcp_backupssh': source => '$FW', @@ -7,6 +9,8 @@ class shorewall::rules::out::ibackup( proto => 'tcp', destinationport => 'ssh', order => 240, - action => 'ACCEPT'; + action => 'ACCEPT', + shorewall4 => $shorewall4, + shorewall6 => $shorewall6, } } -- cgit v1.2.3 From 398b8b94cbeedf08615c926a5a37974bca002943 Mon Sep 17 00:00:00 2001 From: mh Date: Tue, 29 Aug 2017 12:52:56 +0200 Subject: fix param name --- manifests/rules/out/ibackup.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'manifests/rules/out') diff --git a/manifests/rules/out/ibackup.pp b/manifests/rules/out/ibackup.pp index 9827426..17cc314 100644 --- a/manifests/rules/out/ibackup.pp +++ b/manifests/rules/out/ibackup.pp @@ -1,6 +1,6 @@ class shorewall::rules::out::ibackup( $backup_host, - $shorewall4 = true, + $shorewall = true, $shorewall6 = false, ){ shorewall::rule { 'me-net-tcp_backupssh': @@ -10,7 +10,7 @@ class shorewall::rules::out::ibackup( destinationport => 'ssh', order => 240, action => 'ACCEPT', - shorewall4 => $shorewall4, + shorewall => $shorewall, shorewall6 => $shorewall6, } } -- cgit v1.2.3 From 983ae4c5bc61b09422b671123e670d62cb4e2e59 Mon Sep 17 00:00:00 2001 From: mh Date: Tue, 29 Aug 2017 22:14:33 +0200 Subject: correctly set shorewall6 option for puppetserver config --- manifests/rules/out/puppet.pp | 1 + 1 file changed, 1 insertion(+) (limited to 'manifests/rules/out') diff --git a/manifests/rules/out/puppet.pp b/manifests/rules/out/puppet.pp index 827e23a..2444dcb 100644 --- a/manifests/rules/out/puppet.pp +++ b/manifests/rules/out/puppet.pp @@ -9,6 +9,7 @@ class shorewall::rules::out::puppet( puppetserver => $puppetserver, puppetserver_port => $puppetserver_port, puppetserver_signport => $puppetserver_signport, + shorewall6 => $shorewall6, } # we want to connect to the puppet server shorewall::rule { 'me-net-puppet_tcp': -- cgit v1.2.3 From 213a4254c03db1477f584972519b1fe3b351074b Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 30 Aug 2017 00:39:26 +0200 Subject: make ipv6 tuneable --- manifests/rules/out/imap.pp | 24 ++++++++++++++---------- manifests/rules/out/pop3.pp | 24 ++++++++++++++---------- 2 files changed, 28 insertions(+), 20 deletions(-) (limited to 'manifests/rules/out') diff --git a/manifests/rules/out/imap.pp b/manifests/rules/out/imap.pp index f1313d2..0cbee50 100644 --- a/manifests/rules/out/imap.pp +++ b/manifests/rules/out/imap.pp @@ -1,11 +1,15 @@ -class shorewall::rules::out::imap { - shorewall::rule { - 'me-net-tcp_imap_s': - source => '$FW', - destination => 'net', - proto => 'tcp', - destinationport => '143,993', - order => 260, - action => 'ACCEPT'; - } +# outgoing imap +class shorewall::rules::out::imap( + $shorewall6 = true, +) { + shorewall::rule { + 'me-net-tcp_imap_s': + source => '$FW', + destination => 'net', + proto => 'tcp', + destinationport => '143,993', + order => 260, + action => 'ACCEPT', + shorewall6 => $shorewall6, + } } diff --git a/manifests/rules/out/pop3.pp b/manifests/rules/out/pop3.pp index ebd4828..ea66bf7 100644 --- a/manifests/rules/out/pop3.pp +++ b/manifests/rules/out/pop3.pp @@ -1,11 +1,15 @@ -class shorewall::rules::out::pop3 { - shorewall::rule { - 'me-net-tcp_pop3_s': - source => '$FW', - destination => 'net', - proto => 'tcp', - destinationport => 'pop3,pop3s', - order => 260, - action => 'ACCEPT'; - } +# outoging oper3 +class shorewall::rules::out::pop3( + $shorewall6 = true, +) { + shorewall::rule { + 'me-net-tcp_pop3_s': + source => '$FW', + destination => 'net', + proto => 'tcp', + destinationport => 'pop3,pop3s', + order => 260, + action => 'ACCEPT', + shorewall6 => $shorewall6, + } } -- cgit v1.2.3