Allow br1 stuff on luchesi

[dsa-puppet.git] / modules / ferm / manifests / per-host.pp

diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp
index 83e289470804dd7d9bc0b1eef7b50e39d42fd58f..65b056d872b293407dd351fc6754e0e1f9e56c89 100644 (file)
--- a/modules/ferm/manifests/per-host.pp
+++ b/modules/ferm/manifests/per-host.pp
@@ -47,12 +47,12 @@ class ferm::per-host {
                handel: {
                        @ferm::rule { 'dsa-puppet':
                                description     => 'Allow puppet access',
-                               rule            => '&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)'
+                               rule            => '&SERVICE_RANGE(tcp, 8140, $HOST_DEBIAN_V4)'
                        }
                        @ferm::rule { 'dsa-puppet-v6':
                                domain          => 'ip6',
                                description     => 'Allow puppet access',
-                               rule            => '&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)'
+                               rule            => '&SERVICE_RANGE(tcp, 8140, $HOST_DEBIAN_V6)'
                        }
                }
                powell: {
@@ -69,12 +69,12 @@ class ferm::per-host {
                heininen,lotti: {
                        @ferm::rule { 'dsa-syslog':
                                description     => 'Allow syslog access',
-                               rule            => '&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)'
+                               rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V4)'
                        }
                        @ferm::rule { 'dsa-syslog-v6':
                                domain          => 'ip6',
                                description     => 'Allow syslog access',
-                               rule            => '&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)'
+                               rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V6)'
                        }
                }
                kaufmann: {
@@ -125,7 +125,7 @@ class ferm::per-host {
                                '/etc/ferm/conf.d/load_sip_conntrack.conf':
                                        source => 'puppet:///modules/ferm/conntrack_sip.conf',
                                        require => Package['ferm'],
-                                       notify  => Exec['ferm restart'];
+                                       notify  => Service['ferm'],
                        }
                        @ferm::rule { 'dsa-sip':
                                domain          => '(ip ip6)',
@@ -202,6 +202,7 @@ def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
 policy ACCEPT;
 mod state state (ESTABLISHED RELATED) ACCEPT;
 interface br0 outerface br0 ACCEPT;
+interface br1 outerface br1 ACCEPT;
 
 interface br2 outerface br0 jump from-kfreebsd;
 interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
@@ -238,7 +239,7 @@ REJECT reject-with icmp-admin-prohibited
                default: {}
        }
 
-       if $::rsyncd == true {
+       if $::rsyncd {
                include ferm::rsync
        }
 }