Dzahn has uploaded a new change for review. https://gerrit.wikimedia.org/r/185340
Change subject: WIP: add port forwarding to ferm ...................................................................... WIP: add port forwarding to ferm The attempt is to add easy portforwarding to ferm. similar, but not identical to: http://ferm.foo-projects.org/download/2.2/ferm.html#easy_port_forwarding We want to specify source and dest port. Once we'd have this, i would want to use it to forward requests for gerrit on 22 to gerrit's hight port 29418 Bug: T84713 Bug: T37611 Change-Id: Ic4d5f6f341913b5d779b68f1462165c1e52bec23 --- A modules/ferm/manifests/portforward.pp A modules/ferm/templates/portforward.erb 2 files changed, 31 insertions(+), 0 deletions(-) git pull ssh://gerrit.wikimedia.org:29418/operations/puppet refs/changes/40/185340/1 diff --git a/modules/ferm/manifests/portforward.pp b/modules/ferm/manifests/portforward.pp new file mode 100644 index 0000000..0d7a4af --- /dev/null +++ b/modules/ferm/manifests/portforward.pp @@ -0,0 +1,20 @@ +define ferm::portforward( + $proto, + $sport, + $dport, + $dest, + $ensure = 'present', + $desc = '', + $prio = '10', +) { + @file { "/etc/ferm/conf.d/${prio}_${name}": + ensure => $ensure, + owner => root, + group => root, + mode => '0400', + content => template('ferm/portforward.erb'), + require => File['/etc/ferm/conf.d'], + notify => Service['ferm'], + tag => 'ferm', + } +} diff --git a/modules/ferm/templates/portforward.erb b/modules/ferm/templates/portforward.erb new file mode 100644 index 0000000..9d0eedf --- /dev/null +++ b/modules/ferm/templates/portforward.erb @@ -0,0 +1,11 @@ +# Autogenerated by puppet. DO NOT EDIT BY HAND! +# +# <%= @desc %> + +@def &FORWARD_TCP($proto, $sport, $dport, $dest) = { + table filter chain FORWARD interface eth0 outerface $DEV_DMZ daddr $dest proto $proto dport $dport ACCEPT; + table nat chain PREROUTING interface eth0 proto $proto dport $sport DNAT to $dest:$dport; +} + +&FORWARD_TCP(<%= @proto %>, <%= @sport %>, <%= @dport %>, <%= @dest %>); + -- To view, visit https://gerrit.wikimedia.org/r/185340 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: newchange Gerrit-Change-Id: Ic4d5f6f341913b5d779b68f1462165c1e52bec23 Gerrit-PatchSet: 1 Gerrit-Project: operations/puppet Gerrit-Branch: production Gerrit-Owner: Dzahn <[email protected]> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
