modules/ferm/manifests/per-host.pp

   1 class ferm::per-host {
   2     case $::hostname {
   3         ancina,zandonai,zelenka: {
   4             include ferm::zivit
   5         }
   6     }
   7
   8     case $::hostname {
   9         chopin,franck,gluck,kassia,klecker,lobos,morricone,ravel,ries,rietz,saens,schein,santoro,steffani,valente,villa,wieck,stabile,bizet: {
  10             include ferm::ftp
  11         }
  12     }
  13
  14     case $::hostname {
  15         piatti,samosa: {
  16             @ferm::rule { "dsa-udd-stunnel":
  17                 description  => "port 8080 for udd stunnel",
  18                 rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
  19             }
  20         }
  21         danzi: {
  22                 @ferm::rule {
  23                     "dsa-postgres-danzi":
  24                         description     => "Allow postgress access",
  25                         rule            => "&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 ))"
  26                         ;
  27                     "dsa-postgres2-danzi":
  28                         description     => "Allow postgress access2",
  29                         rule            => "&SERVICE_RANGE(tcp, 5437, ( 206.12.19.0/24 ))"
  30                         ;
  31                     "dsa-postgres3-danzi":
  32                         description     => "Allow postgress access2",
  33                         rule            => "&SERVICE_RANGE(tcp, 5436, ( 206.12.19.0/24 ))"
  34                         ;
  35                 }
  36
  37         }
  38         abel,alwyn,rietz: {
  39             @ferm::rule { "dsa-tftp":
  40                 description     => "Allow tftp access",
  41                 rule            => "&SERVICE(udp, 69)"
  42             }
  43         }
  44         paganini: {
  45             @ferm::rule { "dsa-dhcp":
  46                 description     => "Allow dhcp access",
  47                 rule            => "&SERVICE(udp, 67)"
  48             }
  49             @ferm::rule { "dsa-tftp":
  50                 description     => "Allow tftp access",
  51                 rule            => "&SERVICE(udp, 69)"
  52             }
  53         }
  54         handel: {
  55             @ferm::rule { "dsa-puppet":
  56                 description     => "Allow puppet access",
  57                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
  58             }
  59             @ferm::rule { "dsa-puppet-v6":
  60                 domain          => 'ip6',
  61                 description     => "Allow puppet access",
  62                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
  63             }
  64         }
  65         powell: {
  66             @ferm::rule { "dsa-powell-v6-tunnel":
  67                 description     => "Allow powell to use V6 tunnel broker",
  68                 rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
  69             }
  70             @ferm::rule { "dsa-powell-btseed":
  71                 domain          => "(ip ip6)",
  72                 description     => "Allow powell to seed BT",
  73                 rule            => "proto tcp dport 8000:8100 jump ACCEPT"
  74             }
  75         }
  76         heininen,lotti: {
  77             @ferm::rule { "dsa-syslog":
  78                 description     => "Allow syslog access",
  79                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
  80             }
  81             @ferm::rule { "dsa-syslog-v6":
  82                 domain          => 'ip6',
  83                 description     => "Allow syslog access",
  84                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
  85             }
  86         }
  87         kaufmann: {
  88             @ferm::rule { "dsa-hkp":
  89                 domain          => "(ip ip6)",
  90                 description     => "Allow hkp access",
  91                 rule            => "&SERVICE(tcp, 11371)"
  92             }
  93         }
  94         gombert: {
  95             @ferm::rule { "dsa-infinoted":
  96                 domain          => "(ip ip6)",
  97                 description     => "Allow infinoted access",
  98                 rule            => "&SERVICE(tcp, 6523)"
  99             }
 100         }
 101         bendel,liszt: {
 102             @ferm::rule { "smtp":
 103                 domain          => "(ip ip6)",
 104                 description     => "Allow smtp access",
 105                 rule            => "&SERVICE(tcp, 25)"
 106             }
 107         }
 108         draghi: {
 109             #@ferm::rule { "dsa-bind":
 110             #    domain          => "(ip ip6)",
 111             #    description     => "Allow nameserver access",
 112             #    rule            => "&TCP_UDP_SERVICE(53)"
 113             #}
 114             @ferm::rule { "dsa-finger":
 115                 domain          => "(ip ip6)",
 116                 description     => "Allow finger access",
 117                 rule            => "&SERVICE(tcp, 79)"
 118             }
 119             @ferm::rule { "dsa-ldap":
 120                 domain          => "(ip ip6)",
 121                 description     => "Allow ldap access",
 122                 rule            => "&SERVICE(tcp, 389)"
 123             }
 124             @ferm::rule { "dsa-ldaps":
 125                 domain          => "(ip ip6)",
 126                 description     => "Allow ldaps access",
 127                 rule            => "&SERVICE(tcp, 636)"
 128             }
 129         }
 130         cilea: {
 131             file {
 132                 "/etc/ferm/conf.d/load_sip_conntrack.conf":
 133                     source => "puppet:///modules/ferm/conntrack_sip.conf",
 134                     require => Package["ferm"],
 135                     notify  => Exec["ferm restart"];
 136             }
 137             @ferm::rule { "dsa-sip":
 138                 domain          => "(ip ip6)",
 139                 description     => "Allow sip access",
 140                 rule            => "&TCP_UDP_SERVICE(5060)"
 141             }
 142             @ferm::rule { "dsa-sipx":
 143                 domain          => "(ip ip6)",
 144                 description     => "Allow sipx access",
 145                 rule            => "&TCP_UDP_SERVICE(5080)"
 146             }
 147         }
 148         scelsi: {
 149             @ferm::rule { "dc11-icecast":
 150                 domain          => "(ip ip6)",
 151                 description     => "Allow icecast access",
 152                 rule            => "&SERVICE(tcp, 8000)"
 153             }
 154         }
 155     }
 156
 157     case $hostname { rautavaara,luchesi: {
 158         @ferm::rule { "dsa-to-kfreebsd":
 159             description     => "Traffic routed to kfreebsd hosts",
 160             chain           => 'to-kfreebsd',
 161             rule            => 'proto icmp ACCEPT;
 162                                 source ($FREEBSD_SSH_ACCESS $HOST_NAGIOS_V4) proto tcp dport 22 ACCEPT;
 163                                 source ($HOST_MAILRELAY_V4 $HOST_NAGIOS_V4) proto tcp dport 25 ACCEPT;
 164                                 source ($HOST_MUNIN_V4 $HOST_NAGIOS_V4) proto tcp dport 4949 ACCEPT;
 165                                 source ($HOST_NAGIOS_V4) proto tcp dport 5666 ACCEPT;
 166                                 source ($HOST_NAGIOS_V4) proto udp dport ntp ACCEPT
 167                                '
 168         }
 169         @ferm::rule { "dsa-from-kfreebsd":
 170             description     => "Traffic routed from kfreebsd vlan/bridge",
 171             chain           => 'from-kfreebsd',
 172             rule            => 'proto icmp ACCEPT;
 173                                 proto tcp dport (21 22 80 53 443) ACCEPT;
 174                                 proto udp dport (53 123) ACCEPT;
 175                                 proto tcp dport 8140 daddr 82.195.75.104 ACCEPT; # puppethost
 176                                 proto tcp dport 5140 daddr (82.195.75.98 206.12.19.121) ACCEPT; # loghost
 177                                 proto tcp dport 11371 daddr 82.195.75.107 ACCEPT; # keyring host
 178                                 proto tcp dport (25 submission) daddr ($HOST_MAILRELAY_V4) ACCEPT
 179                                '
 180         }
 181     }}
 182     case $hostname {
 183         rautavaara: {
 184             @ferm::rule { "dsa-routing":
 185                 description     => "forward chain",
 186                 chain           => "FORWARD",
 187                 rule            => '
 188                                     def $ADDRESS_FASCH=194.177.211.201;
 189                                     def $ADDRESS_FIELD=194.177.211.210;
 190                                     def $FREEBSD_HOSTS=($ADDRESS_FASCH $ADDRESS_FIELD);
 191
 192                                     policy ACCEPT;
 193                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 194                                     interface vlan11 outerface eth0 jump from-kfreebsd;
 195                                     interface eth0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 196                                     ULOG ulog-prefix "REJECT FORWARD: ";
 197                                     REJECT reject-with icmp-admin-prohibited
 198                                     '
 199             }
 200         }
 201         luchesi: {
 202             @ferm::rule { "dsa-routing":
 203                 description     => "forward chain",
 204                 chain           => "FORWARD",
 205                 rule            => '
 206                                     def $ADDRESS_FANO=206.12.19.110;
 207                                     def $ADDRESS_FINZI=206.12.19.111;
 208                                     def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
 209
 210                                     policy ACCEPT;
 211                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 212                                     interface br0 outerface br0 ACCEPT;
 213
 214                                     interface br2 outerface br0 jump from-kfreebsd;
 215                                     interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 216                                     ULOG ulog-prefix "REJECT FORWARD: ";
 217                                     REJECT reject-with icmp-admin-prohibited
 218                                     '
 219             }
 220         }
 221     }
 222
 223     # redirect snapshot into varnish
 224     case $::hostname {
 225         sibelius: {
 226             @ferm::rule { "dsa-snapshot-varnish":
 227                 rule            => '&SERVICE(tcp, 6081)',
 228             }
 229             @ferm::rule { "dsa-nat-snapshot-varnish":
 230                 table           => 'nat',
 231                 chain           => 'PREROUTING',
 232                 rule            => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081',
 233             }
 234         }
 235         stabile: {
 236             @ferm::rule { "dsa-snapshot-varnish":
 237                 rule            => '&SERVICE(tcp, 6081)',
 238             }
 239             @ferm::rule { "dsa-nat-snapshot-varnish":
 240                 table           => 'nat',
 241                 chain           => 'PREROUTING',
 242                 rule            => 'proto tcp daddr 206.12.19.150 dport 80 REDIRECT to-ports 6081',
 243             }
 244         }
 245     }
 246
 247     if $::rsyncd == 'true' {
 248         include ferm::rsync
 249     }
 250 }
 251
 252 # vim:set et:
 253 # vim:set sts=4 ts=4:
 254 # vim:set shiftwidth=4: