modules/ferm/manifests/per-host.pp

   1 class ferm::per-host {
   2         if $::hostname in [ancina,zandonai,zelenka] {
   3                 include ferm::zivit
   4         }
   5
   6         if $::hostname in [glinka,klecker,ravel,rietz,senfl,sibelius,stabile] {
   7                 ferm::rule { 'dsa-rsync':
   8                         domain      => '(ip ip6)',
   9                         description => 'Allow rsync access',
  10                         rule        => '&SERVICE(tcp, 873)'
  11                 }
  12         }
  13
  14         case $::hostname {
  15                 oyens: {
  16                         @ferm::rule { 'dsa-amqp':
  17                                 description     => 'Allow upsmon access',
  18                                 rule            => '&SERVICE_RANGE(tcp, 5672, ( 5.153.231.240/27 172.29.123.0/24 ))'
  19                         }
  20                 }
  21         }
  22         case $::hostname {
  23                 czerny,clementi: {
  24                         @ferm::rule { 'dsa-upsmon':
  25                                 description     => 'Allow upsmon access',
  26                                 rule            => '&SERVICE_RANGE(tcp, 3493, ( 82.195.75.64/26 192.168.43.0/24 ))'
  27                         }
  28                 }
  29                 bendel: {
  30                         @ferm::rule { 'listmaster-ontp-in':
  31                                 description => 'ONTP has a broken mail setup',
  32                                 table       => 'filter',
  33                                 chain       => 'INPUT',
  34                                 rule        => 'source 188.165.23.89/32 proto tcp dport 25 jump DROP',
  35                         }
  36                         @ferm::rule { 'listmaster-ontp-out':
  37                                 description => 'ONTP has a broken mail setup',
  38                                 table       => 'filter',
  39                                 chain       => 'OUTPUT',
  40                                 rule        => 'destination 78.8.208.246/32 proto tcp dport 25 jump DROP',
  41                         }
  42                 }
  43                 abel,alwyn,rietz,jenkins: {
  44                         @ferm::rule { 'dsa-tftp':
  45                                 description     => 'Allow tftp access',
  46                                 rule            => '&SERVICE(udp, 69)'
  47                         }
  48                 }
  49                 lotti,lully: {
  50                         @ferm::rule { 'dsa-syslog':
  51                                 description     => 'Allow syslog access',
  52                                 rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V4)'
  53                         }
  54                         @ferm::rule { 'dsa-syslog-v6':
  55                                 domain          => 'ip6',
  56                                 description     => 'Allow syslog access',
  57                                 rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V6)'
  58                         }
  59                 }
  60                 kaufmann: {
  61                         @ferm::rule { 'dsa-hkp':
  62                                 domain          => '(ip ip6)',
  63                                 description     => 'Allow hkp access',
  64                                 rule            => '&SERVICE(tcp, 11371)'
  65                         }
  66                 }
  67                 gombert: {
  68                         @ferm::rule { 'dsa-infinoted':
  69                                 domain          => '(ip ip6)',
  70                                 description     => 'Allow infinoted access',
  71                                 rule            => '&SERVICE(tcp, 6523)'
  72                         }
  73                 }
  74                 draghi: {
  75                         @ferm::rule { 'dsa-finger':
  76                                 domain          => '(ip ip6)',
  77                                 description     => 'Allow finger access',
  78                                 rule            => '&SERVICE(tcp, 79)'
  79                         }
  80                         @ferm::rule { 'dsa-ldap':
  81                                 domain          => '(ip ip6)',
  82                                 description     => 'Allow ldap access',
  83                                 rule            => '&SERVICE(tcp, 389)'
  84                         }
  85                         @ferm::rule { 'dsa-ldaps':
  86                                 domain          => '(ip ip6)',
  87                                 description     => 'Allow ldaps access',
  88                                 rule            => '&SERVICE(tcp, 636)'
  89                         }
  90                 }
  91                 cilea: {
  92                         ferm::module { 'nf_conntrack_sip': }
  93                         ferm::module { 'nf_conntrack_h323': }
  94
  95                         @ferm::rule { 'dsa-sip':
  96                                 domain          => '(ip ip6)',
  97                                 description     => 'Allow sip access',
  98                                 rule            => '&TCP_UDP_SERVICE(5060)'
  99                         }
 100                         @ferm::rule { 'dsa-sipx':
 101                                 domain          => '(ip ip6)',
 102                                 description     => 'Allow sipx access',
 103                                 rule            => '&TCP_UDP_SERVICE(5080)'
 104                         }
 105                 }
 106                 sonntag: {
 107                         @ferm::rule { 'dsa-bugs-search':
 108                                 description  => 'port 1978 for bugs-search from bug web frontends',
 109                                 rule         => '&SERVICE_RANGE(tcp, 1978, ( 140.211.166.26 206.12.19.140 ))'
 110                         }
 111                 }
 112                 default: {}
 113         }
 114
 115         if $::hostname in [rautavaara] {
 116                 @ferm::rule { 'dsa-from-mgmt':
 117                         description     => 'Traffic routed from mgmt net vlan/bridge',
 118                         chain           => 'INPUT',
 119                         rule            => 'interface eth1 ACCEPT'
 120                 }
 121                 @ferm::rule { 'dsa-mgmt-mark':
 122                         table           => 'mangle',
 123                         chain           => 'PREROUTING',
 124                         rule            => 'interface eth1 MARK set-mark 1',
 125                 }
 126                 @ferm::rule { 'dsa-mgmt-nat':
 127                         table           => 'nat',
 128                         chain           => 'POSTROUTING',
 129                         rule            => 'outerface eth1 mod mark mark 1 MASQUERADE',
 130                 }
 131         }
 132
 133         # redirect snapshot into varnish
 134         case $::hostname {
 135                 sibelius: {
 136                         @ferm::rule { 'dsa-snapshot-varnish':
 137                                 rule            => '&SERVICE(tcp, 6081)',
 138                         }
 139                         @ferm::rule { 'dsa-nat-snapshot-varnish':
 140                                 table           => 'nat',
 141                                 chain           => 'PREROUTING',
 142                                 rule            => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081',
 143                         }
 144                 }
 145                 stabile: {
 146                         @ferm::rule { 'dsa-snapshot-varnish':
 147                                 rule            => '&SERVICE(tcp, 6081)',
 148                         }
 149                         @ferm::rule { 'dsa-nat-snapshot-varnish':
 150                                 table           => 'nat',
 151                                 chain           => 'PREROUTING',
 152                                 rule            => 'proto tcp daddr 206.12.19.150 dport 80 REDIRECT to-ports 6081',
 153                         }
 154                 }
 155                 default: {}
 156         }
 157         case $::hostname {
 158                 bm-bl1,bm-bl2: {
 159                         @ferm::rule { 'dsa-vrrp':
 160                                 rule            => 'proto vrrp daddr 224.0.0.18 jump ACCEPT',
 161                         }
 162                         @ferm::rule { 'dsa-conntrackd':
 163                                 rule            => 'interface vlan2 daddr 225.0.0.50 jump ACCEPT',
 164                         }
 165                         @ferm::rule { 'dsa-bind-notrack-in':
 166                                 domain      => 'ip',
 167                                 description => 'NOTRACK for nameserver traffic',
 168                                 table       => 'raw',
 169                                 chain       => 'PREROUTING',
 170                                 rule        => 'proto (tcp udp) daddr 5.153.231.24 dport 53 jump NOTRACK'
 171                         }
 172
 173                         @ferm::rule { 'dsa-bind-notrack-out':
 174                                 domain      => 'ip',
 175                                 description => 'NOTRACK for nameserver traffic',
 176                                 table       => 'raw',
 177                                 chain       => 'OUTPUT',
 178                                 rule        => 'proto (tcp udp) saddr 5.153.231.24 sport 53 jump NOTRACK'
 179                         }
 180
 181                         @ferm::rule { 'dsa-bind-notrack-in6':
 182                                 domain      => 'ip6',
 183                                 description => 'NOTRACK for nameserver traffic',
 184                                 table       => 'raw',
 185                                 chain       => 'PREROUTING',
 186                                 rule        => 'proto (tcp udp) daddr 2001:41c8:1000:21::21:24 dport 53 jump NOTRACK'
 187                         }
 188
 189                         @ferm::rule { 'dsa-bind-notrack-out6':
 190                                 domain      => 'ip6',
 191                                 description => 'NOTRACK for nameserver traffic',
 192                                 table       => 'raw',
 193                                 chain       => 'OUTPUT',
 194                                 rule        => 'proto (tcp udp) saddr 2001:41c8:1000:21::21:24 sport 53 jump NOTRACK'
 195                         }
 196                 }
 197                 default: {}
 198         }
 199
 200         # solr stuff
 201         case $::hostname {
 202                 stockhausen: {
 203                         @ferm::rule { 'dsa-solr-jetty':
 204                                 description     => 'Allow jetty access',
 205                                 rule            => '&SERVICE_RANGE(tcp, 8080, ( 82.195.75.100/32 ))'
 206                         }
 207                 }
 208         }
 209
 210         # postgres stuff
 211         case $::hostname {
 212                 ullmann: {
 213                         @ferm::rule { 'dsa-postgres-udd':
 214                                 description     => 'Allow postgress access',
 215                                 # quantz, moszumanska, master, couper, coccia, franck
 216                                 rule            => '&SERVICE_RANGE(tcp, 5452, ( 206.12.19.122/32 5.153.231.21/32 82.195.75.110/32 5.153.231.14/32 5.153.231.11/32 138.16.160.12/32 ))'
 217                         }
 218                         @ferm::rule { 'dsa-postgres-udd6':
 219                                 domain          => '(ip6)',
 220                                 description     => 'Allow postgress access',
 221                                 rule            => '&SERVICE_RANGE(tcp, 5452, ( 2607:f8f0:610:4000:216:36ff:fe40:3860/128 2001:41b8:202:deb:216:36ff:fe40:4001/128 2001:41c8:1000:21::21:14/128 2001:41c8:1000:21::21:11/32 2001:41c8:1000:21::21:21/128 ))'
 222                         }
 223                 }
 224                 franck: {
 225                         @ferm::rule { 'dsa-postgres-franck':
 226                                 description     => 'Allow postgress access',
 227                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 5.153.231.10/32 ))'
 228                         }
 229                         @ferm::rule { 'dsa-postgres-franck6':
 230                                 domain          => 'ip6',
 231                                 description     => 'Allow postgress access',
 232                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:41c8:1000:21::21:10/128 ))'
 233                         }
 234
 235                         @ferm::rule { 'dsa-postgres-backup':
 236                                 description     => 'Allow postgress access',
 237                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 5.153.231.12/32 ))'
 238                         }
 239                         @ferm::rule { 'dsa-postgres-backup6':
 240                                 domain          => 'ip6',
 241                                 description     => 'Allow postgress access',
 242                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:41c8:1000:21::21:12/128 ))'
 243                         }
 244                 }
 245                 bmdb1: {
 246                         @ferm::rule { 'dsa-postgres-main':
 247                                 description     => 'Allow postgress access',
 248                                 rule            => '&SERVICE_RANGE(tcp, 5435, ( 5.153.231.14/32 5.153.231.23/32 5.153.231.25/32 206.12.19.141/32 5.153.231.26/32 ))'
 249                         }
 250                         @ferm::rule { 'dsa-postgres-main6':
 251                                 domain          => 'ip6',
 252                                 description     => 'Allow postgress access',
 253                                 rule            => '&SERVICE_RANGE(tcp, 5435, ( 2001:41c8:1000:21::21:14/128 2001:41c8:1000:21::21:23/128 2001:41c8:1000:21::21:25/128 2607:f8f0:610:4000:6564:a62:ce0c:138d/128 2001:41c8:1000:21::21:26/128 ))'
 254                         }
 255                         @ferm::rule { 'dsa-postgres-dak':
 256                                 description     => 'Allow postgress access',
 257                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 5.153.231.11/32 206.12.19.122/32 206.12.19.123/32 206.12.19.134/32 5.153.231.21/32 ))'
 258                         }
 259                         @ferm::rule { 'dsa-postgres-dak6':
 260                                 domain          => 'ip6',
 261                                 description     => 'Allow postgress access',
 262                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 2001:41c8:1000:21::21:11/128 2607:f8f0:610:4000:216:36ff:fe40:3860/128 2607:f8f0:610:4000:216:36ff:fe40:3861/128 2607:f8f0:610:4000:6564:a62:ce0c:1386/128 2001:41c8:1000:21::21:21/128 ))'
 263                         }
 264                         @ferm::rule { 'dsa-postgres-wanna-build':
 265                                 # wuiet, ullmann, franck
 266                                 description     => 'Allow postgress access',
 267                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 5.153.231.18/32 206.12.19.141/32 138.16.160.12/32 ))'
 268                         }
 269                         @ferm::rule { 'dsa-postgres-wanna-build6':
 270                                 domain          => 'ip6',
 271                                 description     => 'Allow postgress access',
 272                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 2001:41c8:1000:21::21:18/128 2607:f8f0:610:4000:6564:a62:ce0c:138d/128 ))'
 273                         }
 274                         @ferm::rule { 'dsa-postgres-bacula':
 275                                 # dinis
 276                                 description     => 'Allow postgress access1',
 277                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 5.153.231.19/32 ))'
 278                         }
 279                         @ferm::rule { 'dsa-postgres-bacula6':
 280                                 domain          => 'ip6',
 281                                 description     => 'Allow postgress access1',
 282                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 2001:41c8:1000:21::21:19/128 ))'
 283                         }
 284
 285                         @ferm::rule { 'dsa-postgres-backup':
 286                                 # ubc, wuit
 287                                 description     => 'Allow postgress access',
 288                                 rule            => '&SERVICE_RANGE(tcp, (5435 5436), ( 5.153.231.12/32 ))'
 289                         }
 290                         @ferm::rule { 'dsa-postgres-backup6':
 291                                 domain          => 'ip6',
 292                                 description     => 'Allow postgress access',
 293                                 rule            => '&SERVICE_RANGE(tcp, (5435 5436), ( 2001:41c8:1000:21::21:12/128 ))'
 294                         }
 295
 296                         @ferm::rule { 'dsa-postgres-dedup':
 297                                 # ubc, wuit
 298                                 description     => 'Allow postgress access',
 299                                 rule            => '&SERVICE_RANGE(tcp, (5439), ( 5.153.231.17/32 ))'
 300                         }
 301                         @ferm::rule { 'dsa-postgres-dedup6':
 302                                 domain          => 'ip6',
 303                                 description     => 'Allow postgress access',
 304                                 rule            => '&SERVICE_RANGE(tcp, (5439), ( 2001:41c8:1000:21::21:17/128 ))'
 305                         }
 306                 }
 307                 danzi: {
 308                         @ferm::rule { 'dsa-postgres-danzi':
 309                                 # ubc, wuit
 310                                 description     => 'Allow postgress access',
 311                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 5.153.231.18/32 ))'
 312                         }
 313                         @ferm::rule { 'dsa-postgres-danzi6':
 314                                 domain          => 'ip6',
 315                                 description     => 'Allow postgress access',
 316                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2607:f8f0:610:4000::/64 2001:41c8:1000:21::21:18/128 ))'
 317                         }
 318
 319                         @ferm::rule { 'dsa-postgres2-danzi':
 320                                 description     => 'Allow postgress access2',
 321                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 206.12.19.0/24 ))'
 322                         }
 323                         @ferm::rule { 'dsa-postgres3-danzi':
 324                                 description     => 'Allow postgress access3',
 325                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 206.12.19.0/24 ))'
 326                         }
 327                         @ferm::rule { 'dsa-postgres4-danzi':
 328                                 description     => 'Allow postgress access4',
 329                                 rule            => '&SERVICE_RANGE(tcp, 5438, ( 206.12.19.0/24 ))'
 330                         }
 331
 332                         @ferm::rule { 'dsa-postgres-backup':
 333                                 description     => 'Allow postgress access',
 334                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 5.153.231.12/32 ))'
 335                         }
 336                         @ferm::rule { 'dsa-postgres-backup6':
 337                                 domain          => 'ip6',
 338                                 description     => 'Allow postgress access',
 339                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:41c8:1000:21::21:12/128 ))'
 340                         }
 341                 }
 342                 chopin: {
 343                         @ferm::rule { 'dsa-postgres-backup':
 344                                 description     => 'Allow postgress access',
 345                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( 5.153.231.12/32 ))'
 346                         }
 347                         @ferm::rule { 'dsa-postgres-backup6':
 348                                 domain          => 'ip6',
 349                                 description     => 'Allow postgress access',
 350                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( 2001:41c8:1000:21::21:12/128 ))'
 351                         }
 352                 }
 353                 sibelius: {
 354                         @ferm::rule { 'dsa-postgres-backup':
 355                                 description     => 'Allow postgress access',
 356                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 5.153.231.12/32 ))'
 357                         }
 358                         @ferm::rule { 'dsa-postgres-backup6':
 359                                 domain          => 'ip6',
 360                                 description     => 'Allow postgress access',
 361                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:41c8:1000:21::21:12/128 ))'
 362                         }
 363                 }
 364                 default: {}
 365         }
 366         # vpn fu
 367         case $::hostname {
 368                 draghi,eysler: {
 369                         @ferm::rule { 'dsa-vpn':
 370                                 description     => 'Allow openvpn access',
 371                                 rule            => '&SERVICE(udp, 17257)'
 372                         }
 373                         @ferm::rule { 'dsa-routing':
 374                                 description     => 'forward chain',
 375                                 chain           => 'FORWARD',
 376                                 rule            => 'policy ACCEPT;
 377 mod state state (ESTABLISHED RELATED) ACCEPT;
 378 interface tun+ ACCEPT;
 379 REJECT reject-with icmp-admin-prohibited
 380 '
 381                         }
 382                         @ferm::rule { 'dsa-vpn-mark':
 383                                 table           => 'mangle',
 384                                 chain           => 'PREROUTING',
 385                                 rule            => 'interface tun+ MARK set-mark 1',
 386                         }
 387                         @ferm::rule { 'dsa-vpn-nat':
 388                                 table           => 'nat',
 389                                 chain           => 'POSTROUTING',
 390                                 rule            => 'outerface !tun+ mod mark mark 1 MASQUERADE',
 391                         }
 392                 }
 393                 default: {}
 394         }
 395 }