Puppet Module for Shorewall
---------------------------
This module manages the configuration of Shorewall (http://www.shorewall.net/)

Versions
--------
- forked from http://git.puppet.immerda.ch/?p=module-shorewall.git;a=summary

Todo
----
- check if shorewall compiles without errors, otherwise fail !

Documentation
-------------

see also: http://reductivelabs.com/trac/puppet/wiki/Recipes/AqueosShorewall
 
Example
-------

Example from node.pp:

node xy {
	class{'config::site_shorewall':
	  startup => "0"  # create shorewall ruleset but don't startup
  }
	shorewall::rule {
		'incoming-ssh': source => 'all', destination => '$FW',  action  => 'SSH/ACCEPT', order => 200;
		'incoming-puppetmaster': source => 'all', destination => '$FW',  action  => 'Puppetmaster/ACCEPT', order => 300;
		'incoming-imap': source => 'all', destination => '$FW',  action  => 'IMAP/ACCEPT', order => 300;
		'incoming-smtp': source => 'all', destination => '$FW',  action  => 'SMTP/ACCEPT', order => 300;
	}
}


class config::site_shorewall($startup = '1') {
  class{'shorewall':
    startup => $startup
  }

  # If you want logging:
  #shorewall::params {
  # 'LOG':  value => 'debug';
  #}

  shorewall::zone {'net':
    type => 'ipv4';
  }

  shorewall::rule_section { 'NEW':
    order => 100;
  }

  shorewall::interface { 'eth0':
    zone    => 'net',
    rfc1918  => true,
    options => 'tcpflags,blacklist,nosmurfs';
  }

  shorewall::policy {
    'fw-to-fw':
      sourcezone              =>      '$FW',
      destinationzone         =>      '$FW',
      policy                  =>      'ACCEPT',
      order                   =>      100;
    'fw-to-net':
      sourcezone              =>      '$FW',
      destinationzone         =>      'net',
      policy                  =>      'ACCEPT',
      shloglevel              =>      '$LOG',
      order                   =>      110;
    'net-to-fw':
      sourcezone              =>      'net',
      destinationzone         =>      '$FW',
      policy                  =>      'DROP',
      shloglevel              =>      '$LOG',
      order                   =>      120;
  }       

        
  # default Rules : ICMP 
  shorewall::rule {
    'allicmp-to-host':
      source => 'all',
      destination => '$FW',
      order  => 200,
      action  => 'AllowICMPs/ACCEPT';
  }
}