Mercurial > repos > other > Puppet

annotate modules/my_fw/manifests/pre.pp @ 279:e36b7f4f85f2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Start to support IPv6 servers * Assumed only one or the other, not dual stack * Removed old VPS setup * Removed "secondary IP", added IPv4-to-6 forwarding * Updated firewall rules * Moved HTTP firewall rules to website module so it can do the right thing based on IP address families
author IBBoard <dev@ibboard.co.uk>
date Sat, 15 Feb 2020 13:52:30 +0000
parents 222904296578
children 11d940c9014e
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1 class my_fw::pre {
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
2 Firewall {
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
3 require => undef,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
4 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 40
diff changeset
5
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 40
diff changeset
6 $icmp_proto = $my_fw::ip_version == "IPv6" ? { true => 'ipv6-icmp', default => 'icmp' }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 40
diff changeset
7 $localhost = $my_fw::ip_version == "IPv6" ? { true => '::1/128', default => '127.0.0.0/8' }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 40
diff changeset
8
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
9 # Default firewall rules
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
10 firewall { '000 accept all icmp':
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 40
diff changeset
11 proto => $icmp_proto,
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
12 action => 'accept',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
13 } ->
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
14 firewall { '001 accept all to lo interface':
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
15 proto => 'all',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
16 iniface => 'lo',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
17 action => 'accept',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
18 } ->
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
19 firewall { "002 reject local traffic not on loopback interface":
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
20 iniface => '! lo',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
21 proto => 'all',
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 40
diff changeset
22 destination => $localhost,
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
23 action => 'reject',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
24 } ->
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
25 firewall { '003 accept related established rules':
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
26 proto => 'all',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
27 state => ['RELATED', 'ESTABLISHED'],
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
28 action => 'accept',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
29 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
30 }