# git clone https://github.com/duritong/puppet-shorewall.git /etc/puppet/modules/shorewall/

class { 'shorewall':
  startup => 1,
}

shorewall::routestopped { 'eth0':
  host => '10.1.10.0/24',
}

$shorewall_ipv4_zones = ['net']

shorewall::zone { $shorewall_ipv4_zones:
  type => 'ipv4',
}

shorewall::policy { 'fw-to-net':
  sourcezone      => 'fw',
  destinationzone => 'net',
  policy          => 'ACCEPT',
  order           => 100,
}

shorewall::policy { 'net-to-all':
  sourcezone      => 'net',
  destinationzone => 'all',
  policy          => 'DROP',
  shloglevel      => 'info',
  order           => 110,
}

shorewall::policy { 'all-to-all':
  sourcezone      => 'all',
  destinationzone => 'all',
  policy          => 'REJECT',
  shloglevel      => 'info',
  order           => 999,
}

shorewall::interface { 'eth0':
  zone    => 'net',
  rfc1918 => true,
}

shorewall::rule_section { 'NEW':
  order   => 100,
}

shorewall::rule { 'ping':
  action      => 'Ping(ACCEPT)',
  source      => 'all',
  destination => 'all',
  order       => 110,
}

shorewall::rule { 'ssh':
  action          => 'ACCEPT',
  source          => 'net:10.1.10.0/24',
  destination     => 'fw',
  proto           => 'tcp',
  destinationport => 'ssh',
  order           => 120,
}