- /bin/cp /var/domtool/firewall/{user_chains.conf,users_tcp_in.conf,users_tcp_out.conf} /etc/ferm/
- /etc/init.d/ferm reload
+ /bin/cp /var/domtool/firewall/*.conf /etc/ferm/
+ service ferm reload
+ ;;
+ firewallpuppet)
+ # new firewall publishing method that integrates with puppet (sort of)
+ /bin/cp /var/domtool/firewall/*.conf /etc/ferm/
+ if [ ! -d /etc/puppetlabs ]; then
+ # legacy node
+ service ferm reload
+ exit
+ fi
+ if ( /usr/sbin/ferm --noexec /etc/ferm/ferm.conf ); then
+ for chain in FERM-INPUT FERM-OUTPUT; do
+ /sbin/iptables -F $chain
+ /sbin/ip6tables -F $chain
+
+ /usr/sbin/ferm --domain ip --noexec --lines /etc/ferm/ferm.conf | iptables-restore --noflush
+ /usr/sbin/ferm --domain ip6 --noexec --lines /etc/ferm/ferm.conf | ip6tables-restore --noflush
+ done
+ else
+ echo "firewall: ferm failed, aborting regeneration."
+ fi