modules/ferm/manifests/per-host.pp

   1 class ferm::per-host {
   2     case $hostname {
   3         ancina,zandonai,zelenka: {
   4             include ferm::zivit
   5         }
   6     }
   7
   8     case $hostname {
   9         chopin,franck,gluck,kassia,klecker,lobos,morricone,ravel,ries,rietz,saens,schein,steffani,valente,villa,wieck,stabile: {
  10             include ferm::ftp
  11         }
  12     }
  13
  14     case $hostname {
  15         piatti,samosa: {
  16             @ferm::rule { "dsa-udd-stunnel":
  17                 description  => "port 8080 for udd stunnel",
  18                 rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
  19             }
  20         }
  21         danzi: {
  22                 @ferm::rule { "dsa-postgres-danzi":
  23                     description     => "Allow postgress access",
  24                     rule            => "&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 ))"
  25                 }
  26
  27         }
  28         paganini: {
  29             @ferm::rule { "dsa-dhcp":
  30                 description     => "Allow dhcp access",
  31                 rule            => "&SERVICE(udp, 67)"
  32             }
  33             @ferm::rule { "dsa-tftp":
  34                 description     => "Allow tftp access",
  35                 rule            => "&SERVICE(udp, 69)"
  36             }
  37         }
  38         handel: {
  39             @ferm::rule { "dsa-puppet":
  40                 description     => "Allow puppet access",
  41                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
  42             }
  43             @ferm::rule { "dsa-puppet-v6":
  44                 domain          => 'ip6',
  45                 description     => "Allow puppet access",
  46                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
  47             }
  48         }
  49         powell: {
  50             @ferm::rule { "dsa-powell-v6-tunnel":
  51                 description     => "Allow powell to use V6 tunnel broker",
  52                 rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
  53             }
  54             @ferm::rule { "dsa-powell-btseed":
  55                 domain          => "(ip ip6)",
  56                 description     => "Allow powell to seed BT",
  57                 rule            => "proto tcp dport 8000:8100 jump ACCEPT"
  58             }
  59         }
  60         heininen,lotti: {
  61             @ferm::rule { "dsa-syslog":
  62                 description     => "Allow syslog access",
  63                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
  64             }
  65             @ferm::rule { "dsa-syslog-v6":
  66                 domain          => 'ip6',
  67                 description     => "Allow syslog access",
  68                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
  69             }
  70         }
  71         kaufmann: {
  72             @ferm::rule { "dsa-hkp":
  73                 domain          => "(ip ip6)",
  74                 description     => "Allow hkp access",
  75                 rule            => "&SERVICE(tcp, 11371)"
  76             }
  77         }
  78         liszt: {
  79             @ferm::rule { "smtp":
  80                 domain          => "(ip ip6)",
  81                 description     => "Allow smtp access",
  82                 rule            => "&SERVICE(tcp, 25)"
  83             }
  84         }
  85         draghi: {
  86             #@ferm::rule { "dsa-bind":
  87             #    domain          => "(ip ip6)",
  88             #    description     => "Allow nameserver access",
  89             #    rule            => "&TCP_UDP_SERVICE(53)"
  90             #}
  91             @ferm::rule { "dsa-finger":
  92                 domain          => "(ip ip6)",
  93                 description     => "Allow finger access",
  94                 rule            => "&SERVICE(tcp, 79)"
  95             }
  96             @ferm::rule { "dsa-ldap":
  97                 domain          => "(ip ip6)",
  98                 description     => "Allow ldap access",
  99                 rule            => "&SERVICE(tcp, 389)"
 100             }
 101             @ferm::rule { "dsa-ldaps":
 102                 domain          => "(ip ip6)",
 103                 description     => "Allow ldaps access",
 104                 rule            => "&SERVICE(tcp, 636)"
 105             }
 106         }
 107         cilea: {
 108             file {
 109                 "/etc/ferm/conf.d/load_sip_conntrack.conf":
 110                     source => "puppet:///modules/ferm/conntrack_sip.conf",
 111                     require => Package["ferm"],
 112                     notify  => Exec["ferm restart"];
 113             }
 114             @ferm::rule { "dsa-sip":
 115                 domain          => "(ip ip6)",
 116                 description     => "Allow sip access",
 117                 rule            => "&TCP_UDP_SERVICE(5060)"
 118             }
 119             @ferm::rule { "dsa-sipx":
 120                 domain          => "(ip ip6)",
 121                 description     => "Allow sipx access",
 122                 rule            => "&TCP_UDP_SERVICE(5080)"
 123             }
 124         }
 125     }
 126
 127     case $hostname { rautavaara,luchesi: {
 128         @ferm::rule { "dsa-to-kfreebsd":
 129             description     => "Traffic routed to kfreebsd hosts",
 130             chain           => 'to-kfreebsd',
 131             rule            => 'proto icmp ACCEPT;
 132                                 source ($FREEBSD_SSH_ACCESS $HOST_NAGIOS_V4) proto tcp dport 22 ACCEPT;
 133                                 source ($HOST_MAILRELAY_V4 $HOST_NAGIOS_V4) proto tcp dport 25 ACCEPT;
 134                                 source ($HOST_MUNIN_V4 $HOST_NAGIOS_V4) proto tcp dport 4949 ACCEPT;
 135                                 source ($HOST_NAGIOS_V4) proto tcp dport 5666 ACCEPT;
 136                                 source ($HOST_NAGIOS_V4) proto udp dport ntp ACCEPT
 137                                '
 138         }
 139         @ferm::rule { "dsa-from-kfreebsd":
 140             description     => "Traffic routed from kfreebsd vlan/bridge",
 141             chain           => 'from-kfreebsd',
 142             rule            => 'proto icmp ACCEPT;
 143                                 proto tcp dport (21 22 80 53 443) ACCEPT;
 144                                 proto udp dport (53 123) ACCEPT;
 145                                 proto tcp dport 8140 daddr 82.195.75.104 ACCEPT; # puppethost
 146                                 proto tcp dport 5140 daddr (82.195.75.98 206.12.19.121) ACCEPT; # loghost
 147                                 proto tcp dport (25 submission) daddr ($HOST_MAILRELAY_V4) ACCEPT
 148                                '
 149         }
 150     }}
 151     case $hostname {
 152         rautavaara: {
 153             @ferm::rule { "dsa-routing":
 154                 description     => "forward chain",
 155                 chain           => "FORWARD",
 156                 rule            => '
 157                                     def $ADDRESS_FASCH=194.177.211.201;
 158                                     def $ADDRESS_FIELD=194.177.211.210;
 159                                     def $FREEBSD_HOSTS=($ADDRESS_FASCH $ADDRESS_FIELD);
 160
 161                                     policy ACCEPT;
 162                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 163                                     interface vlan11 outerface eth0 jump from-kfreebsd;
 164                                     interface eth0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 165                                     ULOG ulog-prefix "REJECT FORWARD: ";
 166                                     REJECT reject-with icmp-admin-prohibited
 167                                     '
 168             }
 169         }
 170         luchesi: {
 171             @ferm::rule { "dsa-routing":
 172                 description     => "forward chain",
 173                 chain           => "FORWARD",
 174                 rule            => '
 175                                     def $ADDRESS_FANO=206.12.19.110;
 176                                     def $ADDRESS_FINZI=206.12.19.111;
 177                                     def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
 178
 179                                     policy ACCEPT;
 180                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 181                                     interface br0 outerface br0 ACCEPT;
 182
 183                                     interface br2 outerface br0 jump from-kfreebsd;
 184                                     interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 185                                     ULOG ulog-prefix "REJECT FORWARD: ";
 186                                     REJECT reject-with icmp-admin-prohibited
 187                                     '
 188             }
 189         }
 190     }
 191
 192     # redirect snapshot into varnish
 193     case $hostname {
 194         sibelius: {
 195             @ferm::rule { "dsa-snapshot-varnish":
 196                 rule            => '&SERVICE(tcp, 6081)',
 197             }
 198             @ferm::rule { "dsa-nat-snapshot-varnish":
 199                 table           => 'nat',
 200                 chain           => 'PREROUTING',
 201                 rule            => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081',
 202             }
 203         }
 204         stabile: {
 205             @ferm::rule { "dsa-snapshot-varnish":
 206                 rule            => '&SERVICE(tcp, 6081)',
 207             }
 208             @ferm::rule { "dsa-nat-snapshot-varnish":
 209                 table           => 'nat',
 210                 chain           => 'PREROUTING',
 211                 rule            => 'proto tcp daddr 206.12.19.150 dport 80 REDIRECT to-ports 6081',
 212             }
 213         }
 214     }
 215 }
 216
 217 # vim:set et:
 218 # vim:set sts=4 ts=4:
 219 # vim:set shiftwidth=4: