87e1b0c8bdddadec2afe89bbde8e89516dda68af
[mirror/dsa-puppet.git] / modules / ferm / manifests / ftp_conntrack.pp
1 class ferm::ftp_conntrack {
2         # This also works for jessie hosts, but requires a reboot
3         if (versioncmp($::lsbmajdistrelease, '9') >= 0) {
4                 # Allow non-passive connections to an FTP server
5                 ferm::rule { 'dsa-ftp-conntrack-client':
6                         domain      => '(ip ip6)',
7                         description => 'ftp client connection tracking',
8                         table       => 'raw',
9                         chain       => 'OUTPUT',
10                         rule        => 'proto tcp dport 21 CT helper ftp'
11                 }
12
13                 # Allow passive connections from an FTP client
14                 ferm::rule { 'dsa-ftp-conntrack-server':
15                         domain      => '(ip ip6)',
16                         description => 'ftp server connection tracking',
17                         table       => 'raw',
18                         chain       => 'PREROUTING',
19                         rule        => 'proto tcp dport 21 CT helper ftp'
20                 }
21         } else {
22                 ferm::module { 'nf_conntrack_ftp': }
23         }
24 }