modules/ferm/manifests/per-host.pp

   1 class ferm::per-host {
   2
   3     case $hostname {
   4         ancina,zandonai,zelenka: {
   5            include ferm::zivit
   6         }
   7     }
   8     case $hostname {
   9         chopin,franck,gluck,kaufmann,kassia,klecker,lobos,merikanto,morricone,raff,ravel,ries,rietz,saens,schein,senfl,stabile,steffani,valente,villa,wieck: {
  10            include ferm::rsync
  11         }
  12     }
  13
  14     case $hostname {
  15         chopin,franck,gluck,kassia,klecker,lobos,morricone,ravel,raff,ries,rietz,saens,schein,steffani,valente,villa,wieck: {
  16            include ferm::ftp
  17         }
  18     }
  19
  20     case $hostname {
  21         piatti,samosa: {
  22            @ferm::rule { "dsa-udd-stunnel":
  23                description  => "port 8080 for udd stunnel",
  24                rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
  25            }
  26         }
  27
  28         paganini: {
  29            @ferm::rule { "dsa-dhcp":
  30                     description     => "Allow dhcp access",
  31                     rule            => "&SERVICE(udp, 67)"
  32            }
  33            @ferm::rule { "dsa-tftp":
  34                     description     => "Allow tftp access",
  35                     rule            => "&SERVICE(udp, 69)"
  36            }
  37         }
  38         handel: {
  39            @ferm::rule { "dsa-puppet":
  40                     description     => "Allow puppet access",
  41                     rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
  42            }
  43            @ferm::rule { "dsa-puppet-v6":
  44                     domain          => 'ip6',
  45                     description     => "Allow puppet access",
  46                     rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
  47            }
  48         }
  49         powell: {
  50            @ferm::rule { "dsa-powell-v6-tunnel":
  51                     description     => "Allow powell to use V6 tunnel broker",
  52                     rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
  53            }
  54            @ferm::rule { "dsa-powell-btseed":
  55                     domain          => "(ip ip6)",
  56                     description     => "Allow powell to seed BT",
  57                     rule            => "proto tcp dport 8000:8100 jump ACCEPT"
  58            }
  59            @ferm::rule { "dsa-powell-rsync":
  60                     description     => "Hoster wants to sync from here, and why not",
  61                     rule            => "&SERVICE_RANGE(tcp, rsync, ( 195.20.242.90 192.25.206.33 82.195.75.106 206.12.19.118 ))"
  62            }
  63         }
  64         heininen: {
  65            @ferm::rule { "dsa-syslog":
  66                     description     => "Allow syslog access",
  67                     rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
  68            }
  69            @ferm::rule { "dsa-syslog-v6":
  70                     domain          => 'ip6',
  71                     description     => "Allow syslog access",
  72                     rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
  73            }
  74         }
  75         kaufmann: {
  76            @ferm::rule { "dsa-hkp":
  77                     domain          => "(ip ip6)",
  78                     description     => "Allow hkp access",
  79                     rule            => "&SERVICE(tcp, 11371)"
  80            }
  81         }
  82         liszt: {
  83            @ferm::rule { "smtp":
  84                     domain          => "(ip ip6)",
  85                     description     => "Allow smtp access",
  86                     rule            => "&SERVICE(tcp, 25)"
  87            }
  88         }
  89         draghi: {
  90             @ferm::rule { "dsa-bind":
  91                     domain          => "(ip ip6)",
  92                     description     => "Allow nameserver access",
  93                     rule            => "&TCP_UDP_SERVICE(53)"
  94             }
  95             @ferm::rule { "dsa-finger":
  96                     domain          => "(ip ip6)",
  97                     description     => "Allow finger access",
  98                     rule            => "&SERVICE(tcp, 79)"
  99             }
 100             @ferm::rule { "dsa-ldap":
 101                     domain          => "(ip ip6)",
 102                     description     => "Allow ldap access",
 103                     rule            => "&SERVICE(tcp, 389)"
 104             }
 105             @ferm::rule { "dsa-ldaps":
 106                     domain          => "(ip ip6)",
 107                     description     => "Allow ldaps access",
 108                     rule            => "&SERVICE(tcp, 636)"
 109             }
 110         }
 111         cilea: {
 112             file {
 113                 "/etc/ferm/conf.d/load_sip_conntrack.conf":
 114                     source => "puppet:///modules/ferm/conntrack_sip.conf",
 115                     require => Package["ferm"],
 116                     notify  => Exec["ferm restart"];
 117             }
 118             @ferm::rule { "dsa-sip":
 119                     domain          => "(ip ip6)",
 120                     description     => "Allow sip access",
 121                     rule            => "&TCP_UDP_SERVICE(5060)"
 122             }
 123             @ferm::rule { "dsa-sipx":
 124                     domain          => "(ip ip6)",
 125                     description     => "Allow sipx access",
 126                     rule            => "&TCP_UDP_SERVICE(5080)"
 127             }
 128         }
 129     }
 130
 131
 132
 133
 134     case $hostname { rautavaara,luchesi: {
 135         @ferm::rule { "dsa-to-kfreebsd":
 136             description     => "Traffic routed to kfreebsd hosts",
 137             chain           => 'to-kfreebsd',
 138             rule            => 'proto icmp ACCEPT;
 139                                 source ($FREEBSD_SSH_ACCESS $HOST_NAGIOS_V4) proto tcp dport 22 ACCEPT;
 140                                 source ($HOST_MAILRELAY_V4 $HOST_NAGIOS_V4) proto tcp dport 25 ACCEPT;
 141                                 source ($HOST_MUNIN_V4 $HOST_NAGIOS_V4) proto tcp dport 4949 ACCEPT;
 142                                 source ($HOST_NAGIOS_V4) proto tcp dport 5666 ACCEPT;
 143                                 source ($HOST_NAGIOS_V4) proto udp dport ntp ACCEPT;
 144                                '
 145         }
 146         @ferm::rule { "dsa-from-kfreebsd":
 147             description     => "Traffic routed from kfreebsd vlan/bridge",
 148             chain           => 'from-kfreebsd',
 149             rule            => 'proto icmp ACCEPT;
 150                                 proto tcp dport (21 22 80 53 443) ACCEPT;
 151                                 proto udp dport (53 123) ACCEPT;
 152                                 proto tcp dport 8140 daddr 82.195.75.104 ACCEPT; # puppethost
 153                                 proto tcp dport 5140 daddr 82.195.75.98 ACCEPT; # loghost
 154                                 proto tcp dport (25 submission) daddr ($HOST_MAILRELAY_V4) ACCEPT;
 155                                '
 156         }
 157     }}
 158     case $hostname {
 159         rautavaara: {
 160             @ferm::rule { "dsa-routing":
 161                 description     => "forward chain",
 162                 chain           => "FORWARD",
 163                 rule            => '
 164                                     def $ADDRESS_FASCH=194.177.211.201;
 165                                     def $ADDRESS_FIELD=194.177.211.210;
 166                                     def $FREEBSD_HOSTS=($ADDRESS_FASCH $ADDRESS_FIELD);
 167
 168                                     policy ACCEPT;
 169                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 170                                     interface vlan11 outerface eth0 jump from-kfreebsd;
 171                                     interface eth0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 172                                     ULOG ulog-prefix "REJECT FORWARD: ";
 173                                     REJECT reject-with icmp-admin-prohibited;
 174                                     '
 175             }
 176         }
 177         luchesi: {
 178             @ferm::rule { "dsa-routing":
 179                 description     => "forward chain",
 180                 chain           => "FORWARD",
 181                 rule            => '
 182                                     def $ADDRESS_FANO=206.12.19.110;
 183                                     def $ADDRESS_FINZI=206.12.19.111;
 184                                     def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
 185
 186                                     policy ACCEPT;
 187                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 188                                     interface br0 outerface br0 ACCEPT;
 189
 190                                     interface br2 outerface br0 jump from-kfreebsd;
 191                                     interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 192                                     ULOG ulog-prefix "REJECT FORWARD: ";
 193                                     REJECT reject-with icmp-admin-prohibited;
 194                                     '
 195             }
 196         }
 197     }
 198
 199     # redirect snapshot into varnish
 200     case $hostname {
 201         sibelius: {
 202             @ferm::rule { "dsa-snapshot-varnish":
 203                 rule            => '&SERVICE(tcp, 6081)',
 204             }
 205             @ferm::rule { "dsa-nat-snapshot-varnish":
 206                 table           => 'nat',
 207                 chain           => 'PREROUTING',
 208                 rule            => 'proto tcp daddr 193.62.202.28 dport 80 REDIRECT to-ports 6081',
 209             }
 210         }
 211     }
 212 }
 213
 214 # vim:set et:
 215 # vim:set sts=4 ts=4:
 216 # vim:set shiftwidth=4: