tmakinen/puppet
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial support for firewall on debian and ubuntu systems.

Browse source
This commit is contained in:
Timo Mkinen 2010-10-28 22:37:01 +03:00
parent cfe4157f36
commit 5b36025d6c
1 changed files with 54 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

82
firewall/manifests/init.pp
View file

@ -27,7 +27,7 @@ class firewall {
} }
case $operatingsystem { case $operatingsystem {
centos,fedora: { centos,debian,fedora,ubuntu: {
include firewall::iptables include firewall::iptables
} }
openbsd: { openbsd: {
@ -54,7 +54,7 @@ class firewall {
class firewall::custom { class firewall::custom {
case $operatingsystem { case $operatingsystem {
centos,fedora: { centos,debian,fedora,ubuntu: {
include firewall::custom::iptables include firewall::custom::iptables
} }
openbsd: { openbsd: {
@ -72,13 +72,21 @@ class firewall::custom {
# #
class firewall::common::iptables { class firewall::common::iptables {
package { [ "iptables", "iptables-ipv6" ]: package { "iptables":
ensure => installed, name => $operatingsystem ? {
centos => [ "iptables", "iptables-ipv6" ],
debian => [ "iptables", "iptables-persistent" ],
fedora => [ "iptables", "iptables-ipv6" ],
ubuntu => [ "iptables", "iptables-persistent" ],
},
} }
$ip6states = versioncmp($kernelversion, "2.6.20")
file { "/etc/sysconfig/iptables": file { "/etc/sysconfig/iptables":
name => $operatingsystem ? {
debian => "/etc/iptables/rules",
ubuntu => "/etc/iptables/rules",
default => "/etc/sysconfig/iptables",
},
ensure => present, ensure => present,
mode => 0600, mode => 0600,
owner => root, owner => root,
@ -87,29 +95,43 @@ class firewall::common::iptables {
notify => Service["iptables"], notify => Service["iptables"],
} }
file { "/etc/sysconfig/ip6tables": case $operatingsystem {
ensure => present, centos,fedora: {
mode => 0600, $ip6states = versioncmp($kernelversion, "2.6.20")
owner => root, file { "/etc/sysconfig/ip6tables":
group => root, ensure => present,
require => Package["iptables-ipv6"], mode => 0600,
notify => Service["ip6tables"], owner => root,
} group => root,
require => Package["iptables-ipv6"],
service { "iptables": notify => Service["ip6tables"],
ensure => running, }
enable => true, service { "ip6tables":
hasstatus => true, ensure => running,
hasrestart => true, enable => true,
require => Package["iptables"], hasstatus => true,
hasrestart => true,
require => Package["iptables-ipv6"],
}
}
} }
service { "ip6tables": service { "iptables":
name => $operatingsystem ? {
debian => "iptables-persistent",
ubuntu => "iptables-persistent",
default => "iptables",
},
ensure => running, ensure => running,
enable => true, enable => true,
hasstatus => true, hasrestart => $operatingsystem ? {
hasrestart => true, centos => true,
require => Package["iptables-ipv6"], debian => false,
fedora => true,
ubuntu => false,
},
status => "iptables -t filter --list --line-numbers | egrep '^1'",
require => Package["iptables"],
} }
} }
@ -123,10 +145,14 @@ class firewall::iptables inherits firewall::common::iptables {
content => template("firewall/iptables.erb"), content => template("firewall/iptables.erb"),
} }
File["/etc/sysconfig/ip6tables"] { case $operatingsystem {
content => template("firewall/ip6tables.erb"), centos,fedora: {
File["/etc/sysconfig/ip6tables"] {
content => template("firewall/ip6tables.erb"),
}
}
} }
} }