|
42 | 42 | require => [Docker::Image[$image]], |
43 | 43 | } |
44 | 44 |
|
| 45 | + file { '/etc/cloud': |
| 46 | + ensure => 'directory', |
| 47 | + owner => 'root', |
| 48 | + group => 'root', |
| 49 | + recurse => true, |
| 50 | + } |
| 51 | + |
45 | 52 | file { '/etc/cloud/cloud.cfg.d': |
46 | 53 | ensure => 'directory', |
47 | 54 | owner => 'root', |
48 | 55 | group => 'root', |
49 | 56 | recurse => true, |
| 57 | + require => [ |
| 58 | + File['/etc/cloud'], |
| 59 | + ], |
50 | 60 | } |
51 | 61 |
|
52 | 62 | # Ensure cloud-init doesn't manage network (netplan config + netplan apply + systemd, in Ubuntu Bionic) |
|
79 | 89 | content => template("${module_name}/openvpn/90-network-config.yaml.erb"), |
80 | 90 | } |
81 | 91 |
|
82 | | - ## Custom routes for peered networks |
83 | | - exec { 'addroute-10.240.0.0': |
84 | | - command => 'ip route add 10.240.0.0/14 via 10.0.2.1 dev eth1', |
85 | | - unless => 'route | grep 10.240.0.0', |
86 | | - path => '/usr/bin:/usr/sbin:/bin:/sbin', |
| 92 | + # The CLI '/sbin/route' included in net-tools is required to create custom routes for peered networks |
| 93 | + package { 'net-tools': |
| 94 | + ensure => present, |
87 | 95 | } |
88 | 96 |
|
| 97 | + # Allow openvpn clients (incoming 443) |
89 | 98 | firewall { '107 accept incoming 443 connections': |
90 | | - proto => 'tcp', |
91 | | - port => 443, |
92 | | - action => 'accept', |
93 | | - } |
94 | | - |
95 | | - # Following firewall rules authorizes different network accesses as defined in https://github.com/jenkins-infra/openvpn |
96 | | - firewall { '100 snat for network public data tier from default vpn network to port 80/443': |
97 | | - chain => 'POSTROUTING', |
98 | | - jump => 'MASQUERADE', |
99 | | - proto => 'tcp', |
100 | | - outiface => 'eth1', |
101 | | - source => '10.8.0.0/24', |
102 | | - dport => [80,443], |
103 | | - destination => '10.0.2.0/24', |
104 | | - table => 'nat', |
105 | | - } |
106 | | - |
107 | | - # Admin Rules |
108 | | - firewall { '100 snat for network public dmz tier from admin vpn network': |
109 | | - chain => 'POSTROUTING', |
110 | | - jump => 'MASQUERADE', |
111 | | - proto => 'all', |
112 | | - outiface => 'eth0', |
113 | | - source => '10.8.1.0/24', |
114 | | - destination => '10.0.99.0/24', |
115 | | - table => 'nat', |
116 | | - } |
117 | | - |
118 | | - firewall { '100 snat for network public data tier from admin vpn network': |
119 | | - chain => 'POSTROUTING', |
120 | | - jump => 'MASQUERADE', |
121 | | - proto => 'all', |
122 | | - outiface => 'eth1', |
123 | | - source => '10.8.1.0/24', |
124 | | - destination => '10.0.2.0/24', |
125 | | - table => 'nat', |
126 | | - } |
127 | | - |
128 | | - firewall { '100 snat for network public app tier from admin vpn network': |
129 | | - chain => 'POSTROUTING', |
130 | | - jump => 'MASQUERADE', |
131 | | - proto => 'all', |
132 | | - outiface => 'eth2', |
133 | | - source => '10.8.1.0/24', |
134 | | - destination => '10.0.1.0/24', |
135 | | - table => 'nat', |
| 99 | + proto => 'tcp', |
| 100 | + dport => 443, |
| 101 | + action => 'accept', |
| 102 | + iniface => 'eth0', |
136 | 103 | } |
137 | 104 |
|
138 | | - firewall { '100 snat for network private-vnet default tier from default vpn network (peered with public network)': |
139 | | - chain => 'POSTROUTING', |
140 | | - jump => 'MASQUERADE', |
141 | | - proto => 'all', |
142 | | - outiface => 'eth1', |
143 | | - source => '10.8.0.0/24', |
144 | | - destination => '10.240.0.0/14', |
145 | | - table => 'nat', |
| 105 | + # Allow SSH clients (incoming 2) |
| 106 | + firewall { '107 accept incoming 22 connections': |
| 107 | + proto => 'tcp', |
| 108 | + dport => 22, |
| 109 | + action => 'accept', |
| 110 | + iniface => 'eth0', |
146 | 111 | } |
147 | 112 |
|
148 | | - firewall { '100 snat for network private-vnet default tier from admin vpn network (peered with public network)': |
149 | | - chain => 'POSTROUTING', |
150 | | - jump => 'MASQUERADE', |
151 | | - proto => 'all', |
152 | | - outiface => 'eth1', |
153 | | - source => '10.8.1.0/24', |
154 | | - destination => '10.240.0.0/14', |
155 | | - table => 'nat', |
| 113 | + # Create firewall rules and route for each specified NIC to allow routing from VPN virtual networks to different networks |
| 114 | + lookup('profile::openvpn::networks').each |$network_nic, $network_setup| { |
| 115 | + # Remove the mask from CIDR to only keep the network Ipv4 (`10.0.0.0/24` returns `10.0.0.0`) |
| 116 | + $network_first_ip = split($network_setup['network_cidr'], '/')[1] |
| 117 | + # Only get the 3 first digits of the IPv4 (`10.0.0.0` returns `10.0.0`) |
| 118 | + $network_prefix = join(split($network_setup['network_cidr'], '[.]')[0,3], '.') |
| 119 | + |
| 120 | + # A given NIC has a "main" CIDR (its network) but may also be used for routes to peered networks |
| 121 | + # If there are any peered network, then add a manual route |
| 122 | + if $network_setup['peered_network_cidrs'] and $network_setup['peered_network_cidrs'].length > 0 { |
| 123 | + $network_setup['peered_network_cidrs'].each | $peered_net_cidr | { |
| 124 | + # Remove the mask from CIDR to only keep the network Ipv4 (`10.0.0.0/24` returns `10.0.0.0`) |
| 125 | + $peered_network_ip = split($peered_net_cidr, '/')[0] |
| 126 | + # Only get the 3 first digits of the IPv4 (`10.0.0.0` returns `10.0.0`) |
| 127 | + $peered_network_prefix = join(split($peered_network_ip, '[.]')[0,3], '.') |
| 128 | + |
| 129 | + ## Custom routes for peered networks |
| 130 | + $gateway = "${network_prefix}.1" |
| 131 | + exec { "addroute ${peered_network_prefix}.0 through ${gateway} (NIC ${network_nic})": |
| 132 | + command => "ip route add ${peered_net_cidr} via ${gateway} dev ${network_nic}", |
| 133 | + unless => "route | grep ${peered_network_prefix}.0", |
| 134 | + require => [ |
| 135 | + # The CLI command 'route' is needed |
| 136 | + Package['net-tools'], |
| 137 | + ], |
| 138 | + path => '/usr/bin:/usr/sbin:/bin:/sbin', |
| 139 | + } |
| 140 | + } |
| 141 | + } |
| 142 | + |
| 143 | + # The lambda filter is used to cleanup the array from empty element (when $network_setup['peered_network_cidrs'] is undefined) |
| 144 | + $destinations_cidrs = ([$network_setup['network_cidr']] + $network_setup['peered_network_cidrs']).filter |$item| { |
| 145 | + $item and $item.length > 0 |
| 146 | + } |
| 147 | + |
| 148 | + # For each VPN network, add all the destinations per interface |
| 149 | + lookup('profile::openvpn::vpn_networks_cidr').each |$vpn_network_cidr| { |
| 150 | + $destinations_cidrs.each |$destination_cidr| { |
| 151 | + # Then add firewall rules to allow routing through networks using masquerading |
| 152 | + firewall { "100 allow routing from ${vpn_network_cidr} to ${destination_cidr} on ports 80/443": |
| 153 | + chain => 'POSTROUTING', |
| 154 | + jump => 'MASQUERADE', |
| 155 | + proto => 'tcp', |
| 156 | + outiface => $network_nic, |
| 157 | + source => $vpn_network_cidr, |
| 158 | + dport => [80,443], |
| 159 | + destination => $destination_cidr, |
| 160 | + table => 'nat', |
| 161 | + } |
| 162 | + } |
| 163 | + } |
156 | 164 | } |
157 | 165 | } |
0 commit comments