modules/ferm/manifests/per-host.pp

   1 class ferm::per-host {
   2     case $hostname {
   3         ancina,zandonai,zelenka: {
   4             include ferm::zivit
   5         }
   6     }
   7
   8     case $hostname {
   9         chopin,franck,gluck,kassia,klecker,lobos,morricone,ravel,ries,rietz,saens,schein,santoro,steffani,valente,villa,wieck,stabile: {
  10             include ferm::ftp
  11         }
  12     }
  13
  14     case $hostname {
  15         piatti,samosa: {
  16             @ferm::rule { "dsa-udd-stunnel":
  17                 description  => "port 8080 for udd stunnel",
  18                 rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
  19             }
  20         }
  21         danzi: {
  22                 @ferm::rule {
  23                     "dsa-postgres-danzi":
  24                         description     => "Allow postgress access",
  25                         rule            => "&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 ))"
  26                         ;
  27                     "dsa-postgres2-danzi":
  28                         description     => "Allow postgress access2",
  29                         rule            => "&SERVICE_RANGE(tcp, 5437, ( 206.12.19.0/24 ))"
  30                         ;
  31                 }
  32
  33         }
  34         abel,alwyn,rietz: {
  35             @ferm::rule { "dsa-tftp":
  36                 description     => "Allow tftp access",
  37                 rule            => "&SERVICE(udp, 69)"
  38             }
  39         }
  40         paganini: {
  41             @ferm::rule { "dsa-dhcp":
  42                 description     => "Allow dhcp access",
  43                 rule            => "&SERVICE(udp, 67)"
  44             }
  45             @ferm::rule { "dsa-tftp":
  46                 description     => "Allow tftp access",
  47                 rule            => "&SERVICE(udp, 69)"
  48             }
  49         }
  50         handel: {
  51             @ferm::rule { "dsa-puppet":
  52                 description     => "Allow puppet access",
  53                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
  54             }
  55             @ferm::rule { "dsa-puppet-v6":
  56                 domain          => 'ip6',
  57                 description     => "Allow puppet access",
  58                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
  59             }
  60         }
  61         powell: {
  62             @ferm::rule { "dsa-powell-v6-tunnel":
  63                 description     => "Allow powell to use V6 tunnel broker",
  64                 rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
  65             }
  66             @ferm::rule { "dsa-powell-btseed":
  67                 domain          => "(ip ip6)",
  68                 description     => "Allow powell to seed BT",
  69                 rule            => "proto tcp dport 8000:8100 jump ACCEPT"
  70             }
  71         }
  72         heininen,lotti: {
  73             @ferm::rule { "dsa-syslog":
  74                 description     => "Allow syslog access",
  75                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
  76             }
  77             @ferm::rule { "dsa-syslog-v6":
  78                 domain          => 'ip6',
  79                 description     => "Allow syslog access",
  80                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
  81             }
  82         }
  83         kaufmann: {
  84             @ferm::rule { "dsa-hkp":
  85                 domain          => "(ip ip6)",
  86                 description     => "Allow hkp access",
  87                 rule            => "&SERVICE(tcp, 11371)"
  88             }
  89         }
  90         gombert: {
  91             @ferm::rule { "dsa-infinoted":
  92                 domain          => "(ip ip6)",
  93                 description     => "Allow infinoted access",
  94                 rule            => "&SERVICE(tcp, 6523)"
  95             }
  96         }
  97         liszt: {
  98             @ferm::rule { "smtp":
  99                 domain          => "(ip ip6)",
 100                 description     => "Allow smtp access",
 101                 rule            => "&SERVICE(tcp, 25)"
 102             }
 103         }
 104         draghi: {
 105             #@ferm::rule { "dsa-bind":
 106             #    domain          => "(ip ip6)",
 107             #    description     => "Allow nameserver access",
 108             #    rule            => "&TCP_UDP_SERVICE(53)"
 109             #}
 110             @ferm::rule { "dsa-finger":
 111                 domain          => "(ip ip6)",
 112                 description     => "Allow finger access",
 113                 rule            => "&SERVICE(tcp, 79)"
 114             }
 115             @ferm::rule { "dsa-ldap":
 116                 domain          => "(ip ip6)",
 117                 description     => "Allow ldap access",
 118                 rule            => "&SERVICE(tcp, 389)"
 119             }
 120             @ferm::rule { "dsa-ldaps":
 121                 domain          => "(ip ip6)",
 122                 description     => "Allow ldaps access",
 123                 rule            => "&SERVICE(tcp, 636)"
 124             }
 125         }
 126         cilea: {
 127             file {
 128                 "/etc/ferm/conf.d/load_sip_conntrack.conf":
 129                     source => "puppet:///modules/ferm/conntrack_sip.conf",
 130                     require => Package["ferm"],
 131                     notify  => Exec["ferm restart"];
 132             }
 133             @ferm::rule { "dsa-sip":
 134                 domain          => "(ip ip6)",
 135                 description     => "Allow sip access",
 136                 rule            => "&TCP_UDP_SERVICE(5060)"
 137             }
 138             @ferm::rule { "dsa-sipx":
 139                 domain          => "(ip ip6)",
 140                 description     => "Allow sipx access",
 141                 rule            => "&TCP_UDP_SERVICE(5080)"
 142             }
 143         }
 144         scelsi: {
 145             @ferm::rule { "dc11-icecast":
 146                 domain          => "(ip ip6)",
 147                 description     => "Allow icecast access",
 148                 rule            => "&SERVICE(tcp, 8000)"
 149             }
 150         }
 151     }
 152
 153     case $hostname { rautavaara,luchesi: {
 154         @ferm::rule { "dsa-to-kfreebsd":
 155             description     => "Traffic routed to kfreebsd hosts",
 156             chain           => 'to-kfreebsd',
 157             rule            => 'proto icmp ACCEPT;
 158                                 source ($FREEBSD_SSH_ACCESS $HOST_NAGIOS_V4) proto tcp dport 22 ACCEPT;
 159                                 source ($HOST_MAILRELAY_V4 $HOST_NAGIOS_V4) proto tcp dport 25 ACCEPT;
 160                                 source ($HOST_MUNIN_V4 $HOST_NAGIOS_V4) proto tcp dport 4949 ACCEPT;
 161                                 source ($HOST_NAGIOS_V4) proto tcp dport 5666 ACCEPT;
 162                                 source ($HOST_NAGIOS_V4) proto udp dport ntp ACCEPT
 163                                '
 164         }
 165         @ferm::rule { "dsa-from-kfreebsd":
 166             description     => "Traffic routed from kfreebsd vlan/bridge",
 167             chain           => 'from-kfreebsd',
 168             rule            => 'proto icmp ACCEPT;
 169                                 proto tcp dport (21 22 80 53 443) ACCEPT;
 170                                 proto udp dport (53 123) ACCEPT;
 171                                 proto tcp dport 8140 daddr 82.195.75.104 ACCEPT; # puppethost
 172                                 proto tcp dport 5140 daddr (82.195.75.98 206.12.19.121) ACCEPT; # loghost
 173                                 proto tcp dport 11371 daddr 82.195.75.107 ACCEPT; # keyring host
 174                                 proto tcp dport (25 submission) daddr ($HOST_MAILRELAY_V4) ACCEPT
 175                                '
 176         }
 177     }}
 178     case $hostname {
 179         rautavaara: {
 180             @ferm::rule { "dsa-routing":
 181                 description     => "forward chain",
 182                 chain           => "FORWARD",
 183                 rule            => '
 184                                     def $ADDRESS_FASCH=194.177.211.201;
 185                                     def $ADDRESS_FIELD=194.177.211.210;
 186                                     def $FREEBSD_HOSTS=($ADDRESS_FASCH $ADDRESS_FIELD);
 187
 188                                     policy ACCEPT;
 189                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 190                                     interface vlan11 outerface eth0 jump from-kfreebsd;
 191                                     interface eth0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 192                                     ULOG ulog-prefix "REJECT FORWARD: ";
 193                                     REJECT reject-with icmp-admin-prohibited
 194                                     '
 195             }
 196         }
 197         luchesi: {
 198             @ferm::rule { "dsa-routing":
 199                 description     => "forward chain",
 200                 chain           => "FORWARD",
 201                 rule            => '
 202                                     def $ADDRESS_FANO=206.12.19.110;
 203                                     def $ADDRESS_FINZI=206.12.19.111;
 204                                     def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
 205
 206                                     policy ACCEPT;
 207                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 208                                     interface br0 outerface br0 ACCEPT;
 209
 210                                     interface br2 outerface br0 jump from-kfreebsd;
 211                                     interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 212                                     ULOG ulog-prefix "REJECT FORWARD: ";
 213                                     REJECT reject-with icmp-admin-prohibited
 214                                     '
 215             }
 216         }
 217     }
 218
 219     # redirect snapshot into varnish
 220     case $hostname {
 221         sibelius: {
 222             @ferm::rule { "dsa-snapshot-varnish":
 223                 rule            => '&SERVICE(tcp, 6081)',
 224             }
 225             @ferm::rule { "dsa-nat-snapshot-varnish":
 226                 table           => 'nat',
 227                 chain           => 'PREROUTING',
 228                 rule            => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081',
 229             }
 230         }
 231         stabile: {
 232             @ferm::rule { "dsa-snapshot-varnish":
 233                 rule            => '&SERVICE(tcp, 6081)',
 234             }
 235             @ferm::rule { "dsa-nat-snapshot-varnish":
 236                 table           => 'nat',
 237                 chain           => 'PREROUTING',
 238                 rule            => 'proto tcp daddr 206.12.19.150 dport 80 REDIRECT to-ports 6081',
 239             }
 240         }
 241     }
 242 }
 243
 244 # vim:set et:
 245 # vim:set sts=4 ts=4:
 246 # vim:set shiftwidth=4: