modules/ferm/manifests/per-host.pp

   1 class ferm::per-host {
   2     case $hostname {
   3         ancina,zandonai,zelenka: {
   4             include ferm::zivit
   5         }
   6     }
   7
   8     case $hostname {
   9         chopin,franck,gluck,kassia,lobos,morricone,ravel,ries,rietz,saens,schein,santoro,steffani,valente,villa,wieck,stabile: {
  10             include ferm::ftp
  11         }
  12     }
  13
  14     case $hostname {
  15         piatti,samosa: {
  16             @ferm::rule { "dsa-udd-stunnel":
  17                 description  => "port 8080 for udd stunnel",
  18                 rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
  19             }
  20         }
  21         danzi: {
  22                 @ferm::rule { "dsa-postgres-danzi":
  23                     description     => "Allow postgress access",
  24                     rule            => "&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 ))"
  25                 }
  26
  27         }
  28         abel,alwyn,rietz: {
  29             @ferm::rule { "dsa-tftp":
  30                 description     => "Allow tftp access",
  31                 rule            => "&SERVICE(udp, 69)"
  32             }
  33         }
  34         paganini: {
  35             @ferm::rule { "dsa-dhcp":
  36                 description     => "Allow dhcp access",
  37                 rule            => "&SERVICE(udp, 67)"
  38             }
  39             @ferm::rule { "dsa-tftp":
  40                 description     => "Allow tftp access",
  41                 rule            => "&SERVICE(udp, 69)"
  42             }
  43         }
  44         handel: {
  45             @ferm::rule { "dsa-puppet":
  46                 description     => "Allow puppet access",
  47                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
  48             }
  49             @ferm::rule { "dsa-puppet-v6":
  50                 domain          => 'ip6',
  51                 description     => "Allow puppet access",
  52                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
  53             }
  54         }
  55         powell: {
  56             @ferm::rule { "dsa-powell-v6-tunnel":
  57                 description     => "Allow powell to use V6 tunnel broker",
  58                 rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
  59             }
  60             @ferm::rule { "dsa-powell-btseed":
  61                 domain          => "(ip ip6)",
  62                 description     => "Allow powell to seed BT",
  63                 rule            => "proto tcp dport 8000:8100 jump ACCEPT"
  64             }
  65         }
  66         heininen,lotti: {
  67             @ferm::rule { "dsa-syslog":
  68                 description     => "Allow syslog access",
  69                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
  70             }
  71             @ferm::rule { "dsa-syslog-v6":
  72                 domain          => 'ip6',
  73                 description     => "Allow syslog access",
  74                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
  75             }
  76         }
  77         kaufmann: {
  78             @ferm::rule { "dsa-hkp":
  79                 domain          => "(ip ip6)",
  80                 description     => "Allow hkp access",
  81                 rule            => "&SERVICE(tcp, 11371)"
  82             }
  83         }
  84         gombert: {
  85             @ferm::rule { "dsa-infinoted":
  86                 domain          => "(ip ip6)",
  87                 description     => "Allow infinoted access",
  88                 rule            => "&SERVICE(tcp, 6523)"
  89             }
  90         }
  91         liszt: {
  92             @ferm::rule { "smtp":
  93                 domain          => "(ip ip6)",
  94                 description     => "Allow smtp access",
  95                 rule            => "&SERVICE(tcp, 25)"
  96             }
  97         }
  98         draghi: {
  99             #@ferm::rule { "dsa-bind":
 100             #    domain          => "(ip ip6)",
 101             #    description     => "Allow nameserver access",
 102             #    rule            => "&TCP_UDP_SERVICE(53)"
 103             #}
 104             @ferm::rule { "dsa-finger":
 105                 domain          => "(ip ip6)",
 106                 description     => "Allow finger access",
 107                 rule            => "&SERVICE(tcp, 79)"
 108             }
 109             @ferm::rule { "dsa-ldap":
 110                 domain          => "(ip ip6)",
 111                 description     => "Allow ldap access",
 112                 rule            => "&SERVICE(tcp, 389)"
 113             }
 114             @ferm::rule { "dsa-ldaps":
 115                 domain          => "(ip ip6)",
 116                 description     => "Allow ldaps access",
 117                 rule            => "&SERVICE(tcp, 636)"
 118             }
 119         }
 120         cilea: {
 121             file {
 122                 "/etc/ferm/conf.d/load_sip_conntrack.conf":
 123                     source => "puppet:///modules/ferm/conntrack_sip.conf",
 124                     require => Package["ferm"],
 125                     notify  => Exec["ferm restart"];
 126             }
 127             @ferm::rule { "dsa-sip":
 128                 domain          => "(ip ip6)",
 129                 description     => "Allow sip access",
 130                 rule            => "&TCP_UDP_SERVICE(5060)"
 131             }
 132             @ferm::rule { "dsa-sipx":
 133                 domain          => "(ip ip6)",
 134                 description     => "Allow sipx access",
 135                 rule            => "&TCP_UDP_SERVICE(5080)"
 136             }
 137         }
 138         scelsi: {
 139             @ferm::rule { "dc11-icecast":
 140                 domain          => "(ip ip6)",
 141                 description     => "Allow icecast access",
 142                 rule            => "&SERVICE(tcp, 8000)"
 143             }
 144         }
 145     }
 146
 147     case $hostname { rautavaara,luchesi: {
 148         @ferm::rule { "dsa-to-kfreebsd":
 149             description     => "Traffic routed to kfreebsd hosts",
 150             chain           => 'to-kfreebsd',
 151             rule            => 'proto icmp ACCEPT;
 152                                 source ($FREEBSD_SSH_ACCESS $HOST_NAGIOS_V4) proto tcp dport 22 ACCEPT;
 153                                 source ($HOST_MAILRELAY_V4 $HOST_NAGIOS_V4) proto tcp dport 25 ACCEPT;
 154                                 source ($HOST_MUNIN_V4 $HOST_NAGIOS_V4) proto tcp dport 4949 ACCEPT;
 155                                 source ($HOST_NAGIOS_V4) proto tcp dport 5666 ACCEPT;
 156                                 source ($HOST_NAGIOS_V4) proto udp dport ntp ACCEPT
 157                                '
 158         }
 159         @ferm::rule { "dsa-from-kfreebsd":
 160             description     => "Traffic routed from kfreebsd vlan/bridge",
 161             chain           => 'from-kfreebsd',
 162             rule            => 'proto icmp ACCEPT;
 163                                 proto tcp dport (21 22 80 53 443) ACCEPT;
 164                                 proto udp dport (53 123) ACCEPT;
 165                                 proto tcp dport 8140 daddr 82.195.75.104 ACCEPT; # puppethost
 166                                 proto tcp dport 5140 daddr (82.195.75.98 206.12.19.121) ACCEPT; # loghost
 167                                 proto tcp dport 11371 daddr 82.195.75.107 ACCEPT; # keyring host
 168                                 proto tcp dport (25 submission) daddr ($HOST_MAILRELAY_V4) ACCEPT
 169                                '
 170         }
 171     }}
 172     case $hostname {
 173         rautavaara: {
 174             @ferm::rule { "dsa-routing":
 175                 description     => "forward chain",
 176                 chain           => "FORWARD",
 177                 rule            => '
 178                                     def $ADDRESS_FASCH=194.177.211.201;
 179                                     def $ADDRESS_FIELD=194.177.211.210;
 180                                     def $FREEBSD_HOSTS=($ADDRESS_FASCH $ADDRESS_FIELD);
 181
 182                                     policy ACCEPT;
 183                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 184                                     interface vlan11 outerface eth0 jump from-kfreebsd;
 185                                     interface eth0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 186                                     ULOG ulog-prefix "REJECT FORWARD: ";
 187                                     REJECT reject-with icmp-admin-prohibited
 188                                     '
 189             }
 190         }
 191         luchesi: {
 192             @ferm::rule { "dsa-routing":
 193                 description     => "forward chain",
 194                 chain           => "FORWARD",
 195                 rule            => '
 196                                     def $ADDRESS_FANO=206.12.19.110;
 197                                     def $ADDRESS_FINZI=206.12.19.111;
 198                                     def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
 199
 200                                     policy ACCEPT;
 201                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 202                                     interface br0 outerface br0 ACCEPT;
 203
 204                                     interface br2 outerface br0 jump from-kfreebsd;
 205                                     interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 206                                     ULOG ulog-prefix "REJECT FORWARD: ";
 207                                     REJECT reject-with icmp-admin-prohibited
 208                                     '
 209             }
 210         }
 211     }
 212
 213     # redirect snapshot into varnish
 214     case $hostname {
 215         sibelius: {
 216             @ferm::rule { "dsa-snapshot-varnish":
 217                 rule            => '&SERVICE(tcp, 6081)',
 218             }
 219             @ferm::rule { "dsa-nat-snapshot-varnish":
 220                 table           => 'nat',
 221                 chain           => 'PREROUTING',
 222                 rule            => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081',
 223             }
 224         }
 225         stabile: {
 226             @ferm::rule { "dsa-snapshot-varnish":
 227                 rule            => '&SERVICE(tcp, 6081)',
 228             }
 229             @ferm::rule { "dsa-nat-snapshot-varnish":
 230                 table           => 'nat',
 231                 chain           => 'PREROUTING',
 232                 rule            => 'proto tcp daddr 206.12.19.150 dport 80 REDIRECT to-ports 6081',
 233             }
 234         }
 235     }
 236 }
 237
 238 # vim:set et:
 239 # vim:set sts=4 ts=4:
 240 # vim:set shiftwidth=4: