notrack diamon on unger

diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp
index 7be941a521216a7c17f5f0758a628958d7a3ddd4..0a9905cff433a050f74b1cc2fade347c612f0d58 100644 (file)
--- a/modules/ferm/manifests/per-host.pp
+++ b/modules/ferm/manifests/per-host.pp
@@ -155,6 +155,22 @@ class ferm::per-host {
                                rule            => '&TCP_UDP_SERVICE(5080)'
                        }
                }
+               unger: {
+                       @ferm::rule { 'dsa-notrack-dns-diamond-in':
+                               domain      => 'ip',
+                               description => 'NOTRACK for nameserver traffic',
+                               table       => 'raw',
+                               chain       => 'PREROUTING',
+                               rule        => 'destination 82.195.75.102 proto (tcp udp) dport 53 jump NOTRACK'
+                       }
+                       @ferm::rule { 'dsa-notrack-dns-diamond-out':
+                               domain      => 'ip',
+                               description => 'NOTRACK for nameserver traffic',
+                               table       => 'raw',
+                               chain       => 'PREROUTING',
+                               rule        => 'source 82.195.75.102 proto (tcp udp) sport 53 jump NOTRACK'
+                       }
+               }
                default: {}
        }