Try a different IP address

[dsa-puppet.git] / modules / ferm / manifests / per-host.pp

diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp
index 7be941a521216a7c17f5f0758a628958d7a3ddd4..d41d2784e214a6929a2297bb27de3f2c6f09ba2d 100644 (file)
--- a/modules/ferm/manifests/per-host.pp
+++ b/modules/ferm/manifests/per-host.pp
@@ -155,6 +155,22 @@ class ferm::per-host {
                                rule            => '&TCP_UDP_SERVICE(5080)'
                        }
                }
+               unger: {
+                       @ferm::rule { 'dsa-notrack-dns-diamond-in':
+                               domain      => 'ip',
+                               description => 'NOTRACK for nameserver traffic',
+                               table       => 'raw',
+                               chain       => 'PREROUTING',
+                               rule        => 'destination 82.195.75.108 proto (tcp udp) dport 53 jump NOTRACK'
+                       }
+                       @ferm::rule { 'dsa-notrack-dns-diamond-out':
+                               domain      => 'ip',
+                               description => 'NOTRACK for nameserver traffic',
+                               table       => 'raw',
+                               chain       => 'PREROUTING',
+                               rule        => 'source 82.195.75.108 proto (tcp udp) sport 53 jump NOTRACK'
+                       }
+               }
                default: {}
        }