shorewall/manifests/init.pp

class shorewall {
  include concat::setup

  define shorewallfile () {
     $filename = "/etc/shorewall/${name}"
     $header = "puppet:///modules/shorewall/headers/${name}"
     $footer = "puppet:///modules/shorewall/footers/${name}"
     concat{$filename:
        owner => root,
        group => root,
        mode => 600,
     }

     concat::fragment{"${name}_header":
        target => $filename,
        order => 1,
        source => $header,
     }

     concat::fragment{"${name}_footer":
        target => $filename,
        order => 99,
        source => $footer,
     }
  }

  ### Rules
  shorewallfile{ rules: }
  define rule_line($order = 50) {
     $filename = "/etc/shorewall/rules"
     $line = $name
     concat::fragment{"newline_${name}":
        target => $filename,
        order => $order,
        content => $line,
     }
  }
  class allow_ssh_in {
     rule_line { "ACCEPT all all tcp 22":
        order => 5,
     }
  }
  class allow_dns_in {
     rule_line { "ACCEPT net fw tcp 53" }
     rule_line { "ACCEPT net fw udp 53" }
  }
  class allow_smtp_in {
     rule_line { "ACCEPT net fw tcp 25" }
  }
  class allow_www_in {
     rule_line { "ACCEPT net fw tcp 80" }
  }

  ### Zones
  shorewallfile{ zones: }
  define zone_line($order = 50) {
     $filename = "/etc/shorewall/zones"
     $line = $name
     concat::fragment{"newline_${name}":
        target => $filename,
        order => $order,
        content => $line,
     }
  }
  class default_zones {
     zone_line { "net     ipv4":
        $order => 2,
     }
     zone_line { "fw      firewall":
        $order => 3,
     }
  }

  ### Policy
  shorewallfile{ policy: }
  define policy_line($order = 50) {
     $filename = "/etc/shorewall/policy"
     $line = $name
     concat::fragment{"newline_${name}":
        target => $filename,
        order => $order,
        content => $line,
     }
  }
  class default_policy {
     policy_line{ "fw   net     ACCEPT":
        $order => 2,
     }
     policy_line{ "net  all     DROP    info":
        $order => 3,
     }
     policy_line{ "all  all     REJECT  info":
        $order => 4,
     }
  }

  class default_firewall() {
     include default_zones
     include default_policy
     include allow_ssh_in
  }
}
1	boklm	242	class shorewall {
2			include concat::setup
3
4			define shorewallfile () {
5			$filename = "/etc/shorewall/${name}"
6			$header = "puppet:///modules/shorewall/headers/${name}"
7			$footer = "puppet:///modules/shorewall/footers/${name}"
8			concat{$filename:
9			owner => root,
10			group => root,
11			mode => 600,
12			}
13
14			concat::fragment{"${name}_header":
15			target => $filename,
16			order => 1,
17			source => $header,
18			}
19
20			concat::fragment{"${name}_footer":
21			target => $filename,
22			order => 99,
23			source => $footer,
24			}
25			}
26
27			### Rules
28			shorewallfile{ rules: }
29			define rule_line($order = 50) {
30			$filename = "/etc/shorewall/rules"
31			$line = $name
32			concat::fragment{"newline_${name}":
33			target => $filename,
34			order => $order,
35			content => $line,
36			}
37			}
38			class allow_ssh_in {
39			rule_line { "ACCEPT all all tcp 22":
40			order => 5,
41			}
42			}
43			class allow_dns_in {
44			rule_line { "ACCEPT net fw tcp 53" }
45			rule_line { "ACCEPT net fw udp 53" }
46			}
47			class allow_smtp_in {
48			rule_line { "ACCEPT net fw tcp 25" }
49			}
50			class allow_www_in {
51			rule_line { "ACCEPT net fw tcp 80" }
52			}
53
54			### Zones
55			shorewallfile{ zones: }
56			define zone_line($order = 50) {
57			$filename = "/etc/shorewall/zones"
58			$line = $name
59			concat::fragment{"newline_${name}":
60			target => $filename,
61			order => $order,
62			content => $line,
63			}
64			}
65			class default_zones {
66			zone_line { "net ipv4":
67			$order => 2,
68			}
69			zone_line { "fw firewall":
70			$order => 3,
71			}
72			}
73
74			### Policy
75			shorewallfile{ policy: }
76			define policy_line($order = 50) {
77			$filename = "/etc/shorewall/policy"
78			$line = $name
79			concat::fragment{"newline_${name}":
80			target => $filename,
81			order => $order,
82			content => $line,
83			}
84			}
85			class default_policy {
86			policy_line{ "fw net ACCEPT":
87			$order => 2,
88			}
89			policy_line{ "net all DROP info":
90			$order => 3,
91			}
92			policy_line{ "all all REJECT info":
93			$order => 4,
94			}
95			}
96
97			class default_firewall() {
98			include default_zones
99			include default_policy
100			include allow_ssh_in
101			}
102			}