From 3d1cf84f39fece3f2a9f8b7247a792212eb81177 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sat, 8 Jan 2022 15:50:26 -0300
Subject: Feat: major refactor

---
 manifests/implementations/shorewall/shaping.pp | 46 ++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 manifests/implementations/shorewall/shaping.pp

(limited to 'manifests/implementations/shorewall/shaping.pp')

diff --git a/manifests/implementations/shorewall/shaping.pp b/manifests/implementations/shorewall/shaping.pp
new file mode 100644
index 0000000..fd86b6e
--- /dev/null
+++ b/manifests/implementations/shorewall/shaping.pp
@@ -0,0 +1,46 @@
+class firewall::implementations::shorewall::shaping(
+  $device         = lookup('firewall::device', undef, undef,         'eth0'),
+  $in_bandwidth   = lookup('firewall::in_bandwidth', undef, undef,   '1000mbps'),
+  $out_bandwidth  = lookup('firewall::out_bandwidth', undef, undef,  '1000mbps')
+) {
+  #
+  # Traffic shaping
+  #
+  shorewall::tcdevices { "${device}":
+    in_bandwidth  => "$in_bandwidth",
+    out_bandwidth => "$out_bandwidth",
+  }
+
+  shorewall::tcrules { "ssh-tcp":
+    order       => "1",
+    source      => "0.0.0.0/0",
+    destination => "0.0.0.0/0",
+    protocol    => "tcp",
+    ports       => "22",
+  }
+
+  shorewall::tcrules { "ssh-udp":
+    order       => "1",
+    source      => "0.0.0.0/0",
+    destination => "0.0.0.0/0",
+    protocol    => "udp",
+    ports       => "22",
+  }
+
+  shorewall::tcclasses { "ssh":
+    order     => "1",
+    interface => "${device}",
+    rate      => "4*full/100",
+    ceil      => "full",
+    priority  => "1",
+  }
+
+  shorewall::tcclasses { "default":
+    order     => "2",
+    interface => "${device}",
+    rate      => "6*full/100",
+    ceil      => "full",
+    priority  => "2",
+    options   => "default",
+  }
+}
-- 
cgit v1.2.3