rsync on gretchaninov
[mirror/dsa-puppet.git] / modules / ferm / manifests / per-host.pp
1 class ferm::per-host {
2         if $::hostname in [zandonai,zelenka] {
3                 include ferm::zivit
4         }
5
6         if $::hostname in [glinka,gretchaninov] {
7                 ferm::rule { 'dsa-rsync':
8                         domain      => '(ip ip6)',
9                         description => 'Allow rsync access',
10                         rule        => '&SERVICE(tcp, 873)'
11                 }
12         }
13
14         case $::hostname {
15                 bm-bl9: {
16                         @ferm::rule { 'dsa-iscsi':
17                                 description     => 'Allow iscsi access',
18                                 rule            => '&SERVICE_RANGE(tcp, 3260, ( 5.153.231.240/27 172.29.123.0/24 ))'
19                         }
20                 }
21                 oyens: {
22                         @ferm::rule { 'dsa-spice':
23                                 description     => 'Allow spice-console access',
24                                 rule            => '&SERVICE(tcp, 6082)'
25                         }
26                         @ferm::rule { 'dsa-memcache':
27                                 description     => 'Allow memcache access',
28                                 rule            => '&SERVICE_RANGE(tcp, 11211, ( 5.153.231.240/27 172.29.123.0/24 ))'
29                         }
30                         @ferm::rule { 'dsa-memcache6':
31                                 domain          => 'ip6',
32                                 description     => 'Allow memcache access',
33                                 rule            => '&SERVICE_RANGE(tcp, 11211, ( 2001:41c8:1000::/48 ))'
34                         }
35                         @ferm::rule { 'dsa-amqp':
36                                 description     => 'Allow rabbitmq access',
37                                 rule            => '&SERVICE_RANGE(tcp, 5672, ( 5.153.231.240/27 172.29.123.0/24 ))'
38                         }
39                         @ferm::rule { 'dsa-amqp6':
40                                 domain          => 'ip6',
41                                 description     => 'Allow rabbitmq access',
42                                 rule            => '&SERVICE_RANGE(tcp, 5672, ( 2001:41c8:1000::/48 ))'
43                         }
44                         @ferm::rule { 'dsa-keystone':
45                                 description     => 'Allow keystone access',
46                                 rule            => '&SERVICE_RANGE(tcp, 5000, ( 5.153.231.240/27 172.29.123.0/24 ))'
47                         }
48                         @ferm::rule { 'dsa-keystone6':
49                                 domain          => 'ip6',
50                                 description     => 'Allow keystone access',
51                                 rule            => '&SERVICE_RANGE(tcp, 5000, ( 2001:41c8:1000::/48 ))'
52                         }
53                         @ferm::rule { 'dsa-keystone-admin':
54                                 description     => 'Allow keystone access',
55                                 rule            => '&SERVICE_RANGE(tcp, 35357, ( 5.153.231.240/27 172.29.123.0/24 ))'
56                         }
57                         @ferm::rule { 'dsa-keystone-admin6':
58                                 domain          => 'ip6',
59                                 description     => 'Allow keystone access',
60                                 rule            => '&SERVICE_RANGE(tcp, 35357, ( 2001:41c8:1000::/48 ))'
61                         }
62                         @ferm::rule { 'dsa-glance-api':
63                                 description     => 'Allow glance access',
64                                 rule            => '&SERVICE_RANGE(tcp, 9292, ( 5.153.231.240/27 172.29.123.0/24 ))'
65                         }
66                         @ferm::rule { 'dsa-glance-api6':
67                                 domain          => 'ip6',
68                                 description     => 'Allow glance access',
69                                 rule            => '&SERVICE_RANGE(tcp, 9292, ( 2001:41c8:1000::/48 ))'
70                         }
71                         @ferm::rule { 'dsa-glance-registry':
72                                 description     => 'Allow glance access',
73                                 rule            => '&SERVICE_RANGE(tcp, 9191, ( 5.153.231.240/27 172.29.123.0/24 ))'
74                         }
75                         @ferm::rule { 'dsa-glance-registry6':
76                                 domain          => 'ip6',
77                                 description     => 'Allow glance access',
78                                 rule            => '&SERVICE_RANGE(tcp, 9191, ( 2001:41c8:1000::/48 ))'
79                         }
80                         @ferm::rule { 'dsa-neutron':
81                                 description     => 'Allow glance access',
82                                 rule            => '&SERVICE_RANGE(tcp, 9696, ( 5.153.231.240/27 172.29.123.0/24 ))'
83                         }
84                         @ferm::rule { 'dsa-neutron6':
85                                 domain          => 'ip6',
86                                 description     => 'Allow glance access',
87                                 rule            => '&SERVICE_RANGE(tcp, 9696, ( 2001:41c8:1000::/48 ))'
88                         }
89                         @ferm::rule { 'dsa-nova-ec2':
90                                 description     => 'Allow nova access',
91                                 rule            => '&SERVICE_RANGE(tcp, 8773, ( 5.153.231.240/27 172.29.123.0/24 ))'
92                         }
93                         @ferm::rule { 'dsa-nova-ec26':
94                                 domain          => 'ip6',
95                                 description     => 'Allow nova access',
96                                 rule            => '&SERVICE_RANGE(tcp, 8773, ( 2001:41c8:1000::/48 ))'
97                         }
98                         @ferm::rule { 'dsa-nova2':
99                                 description     => 'Allow nova access',
100                                 rule            => '&SERVICE_RANGE(tcp, 8774, ( 5.153.231.240/27 172.29.123.0/24 ))'
101                         }
102                         @ferm::rule { 'dsa-nova26':
103                                 domain          => 'ip6',
104                                 description     => 'Allow nova access',
105                                 rule            => '&SERVICE_RANGE(tcp, 8774, ( 2001:41c8:1000::/48 ))'
106                         }
107                         @ferm::rule { 'dsa-nova-metadata':
108                                 description     => 'Allow nova access',
109                                 rule            => '&SERVICE_RANGE(tcp, 8775, ( 5.153.231.240/27 172.29.123.0/24 ))'
110                         }
111                         @ferm::rule { 'dsa-nova-metadata6':
112                                 domain          => 'ip6',
113                                 description     => 'Allow nova access',
114                                 rule            => '&SERVICE_RANGE(tcp, 8775, ( 2001:41c8:1000::/48 ))'
115                         }
116                         @ferm::rule { 'dsa-cinder':
117                                 description     => 'Allow nova access',
118                                 rule            => '&SERVICE_RANGE(tcp, 8776, ( 5.153.231.240/27 172.29.123.0/24 ))'
119                         }
120                         @ferm::rule { 'dsa-cinder6':
121                                 domain          => 'ip6',
122                                 description     => 'Allow nova access',
123                                 rule            => '&SERVICE_RANGE(tcp, 8776, ( 2001:41c8:1000::/48 ))'
124                         }
125                 }
126         }
127         case $::hostname {
128                 czerny,clementi: {
129                         @ferm::rule { 'dsa-upsmon':
130                                 description     => 'Allow upsmon access',
131                                 rule            => '&SERVICE_RANGE(tcp, 3493, ( 82.195.75.64/26 192.168.43.0/24 ))'
132                         }
133                 }
134                 bendel: {
135                         @ferm::rule { 'listmaster-ontp-in':
136                                 description => 'ONTP has a broken mail setup',
137                                 table       => 'filter',
138                                 chain       => 'INPUT',
139                                 rule        => 'source 188.165.23.89/32 proto tcp dport 25 jump DROP',
140                         }
141                         @ferm::rule { 'listmaster-ontp-out':
142                                 description => 'ONTP has a broken mail setup',
143                                 table       => 'filter',
144                                 chain       => 'OUTPUT',
145                                 rule        => 'destination 78.8.208.246/32 proto tcp dport 25 jump DROP',
146                         }
147                 }
148                 lotti,lully,loghost-grnet-01: {
149                         @ferm::rule { 'dsa-syslog':
150                                 description     => 'Allow syslog access',
151                                 rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V4)'
152                         }
153                         @ferm::rule { 'dsa-syslog-v6':
154                                 domain          => 'ip6',
155                                 description     => 'Allow syslog access',
156                                 rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V6)'
157                         }
158                 }
159                 kaufmann: {
160                         @ferm::rule { 'dsa-hkp':
161                                 domain          => '(ip ip6)',
162                                 description     => 'Allow hkp access',
163                                 rule            => '&SERVICE(tcp, 11371)'
164                         }
165                 }
166                 gombert: {
167                         @ferm::rule { 'dsa-infinoted':
168                                 domain          => '(ip ip6)',
169                                 description     => 'Allow infinoted access',
170                                 rule            => '&SERVICE(tcp, 6523)'
171                         }
172                 }
173                 draghi: {
174                         @ferm::rule { 'dsa-finger':
175                                 domain          => '(ip ip6)',
176                                 description     => 'Allow finger access',
177                                 rule            => '&SERVICE(tcp, 79)'
178                         }
179                         @ferm::rule { 'dsa-ldap':
180                                 domain          => '(ip ip6)',
181                                 description     => 'Allow ldap access',
182                                 rule            => '&SERVICE(tcp, 389)'
183                         }
184                         @ferm::rule { 'dsa-ldaps':
185                                 domain          => '(ip ip6)',
186                                 description     => 'Allow ldaps access',
187                                 rule            => '&SERVICE(tcp, 636)'
188                         }
189                 }
190                 sonntag: {
191                         @ferm::rule { 'dsa-bugs-search':
192                                 description  => 'port 1978 for bugs-search from bug web frontends',
193                                 rule         => '&SERVICE_RANGE(tcp, 1978, ( 140.211.166.26 209.87.16.39 ))'
194                         }
195                 }
196                 default: {}
197         }
198
199         # redirect snapshot into varnish
200         case $::hostname {
201                 sibelius: {
202                         @ferm::rule { 'dsa-snapshot-varnish':
203                                 rule            => '&SERVICE(tcp, 6081)',
204                         }
205                         @ferm::rule { 'dsa-nat-snapshot-varnish':
206                                 table           => 'nat',
207                                 chain           => 'PREROUTING',
208                                 rule            => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081',
209                         }
210                 }
211                 lw07: {
212                         @ferm::rule { 'dsa-snapshot-varnish':
213                                 rule            => '&SERVICE(tcp, 6081)',
214                         }
215                         @ferm::rule { 'dsa-nat-snapshot-varnish':
216                                 table           => 'nat',
217                                 chain           => 'PREROUTING',
218                                 rule            => 'proto tcp daddr 185.17.185.185 dport 80 REDIRECT to-ports 6081',
219                         }
220                 }
221                 default: {}
222         }
223         case $::hostname {
224                 bm-bl1,bm-bl2: {
225                         @ferm::rule { 'dsa-vrrp':
226                                 rule            => 'proto vrrp daddr 224.0.0.18 jump ACCEPT',
227                         }
228                         @ferm::rule { 'dsa-conntrackd':
229                                 rule            => 'interface vlan2 daddr 225.0.0.50 jump ACCEPT',
230                         }
231                         @ferm::rule { 'dsa-bind-notrack-in':
232                                 domain      => 'ip',
233                                 description => 'NOTRACK for nameserver traffic',
234                                 table       => 'raw',
235                                 chain       => 'PREROUTING',
236                                 rule        => 'proto (tcp udp) daddr 5.153.231.24 dport 53 jump NOTRACK'
237                         }
238
239                         @ferm::rule { 'dsa-bind-notrack-out':
240                                 domain      => 'ip',
241                                 description => 'NOTRACK for nameserver traffic',
242                                 table       => 'raw',
243                                 chain       => 'OUTPUT',
244                                 rule        => 'proto (tcp udp) saddr 5.153.231.24 sport 53 jump NOTRACK'
245                         }
246
247                         @ferm::rule { 'dsa-bind-notrack-in6':
248                                 domain      => 'ip6',
249                                 description => 'NOTRACK for nameserver traffic',
250                                 table       => 'raw',
251                                 chain       => 'PREROUTING',
252                                 rule        => 'proto (tcp udp) daddr 2001:41c8:1000:21::21:24 dport 53 jump NOTRACK'
253                         }
254
255                         @ferm::rule { 'dsa-bind-notrack-out6':
256                                 domain      => 'ip6',
257                                 description => 'NOTRACK for nameserver traffic',
258                                 table       => 'raw',
259                                 chain       => 'OUTPUT',
260                                 rule        => 'proto (tcp udp) saddr 2001:41c8:1000:21::21:24 sport 53 jump NOTRACK'
261                         }
262                 }
263                 default: {}
264         }
265
266         # elasticsearch stuff
267         case $::hostname {
268                 stockhausen: {
269                         @ferm::rule { 'dsa-elasticsearch-bendel':
270                                 domain          => '(ip)',
271                                 description     => 'Allow elasticsearch access from bendel',
272                                 rule            => '&SERVICE_RANGE(tcp, 9200:9300, ( 82.195.75.100/32 ))'
273                         }
274                         @ferm::rule { 'dsa-elasticsearch-bendel6':
275                                 domain          => '(ip6)',
276                                 description     => 'Allow elasticsearch access from bendel',
277                                 rule            => '&SERVICE_RANGE(tcp, 9200:9300, ( 2001:41b8:202:deb:216:36ff:fe40:4002/128 ))'
278                         }
279                 }
280         }
281
282         # postgres stuff
283         case $::hostname {
284                 ullmann: {
285                         @ferm::rule { 'dsa-postgres-udd':
286                                 description     => 'Allow postgress access',
287                                 # quantz, moszumanska, master, coccia, franck
288                                 rule            => '&SERVICE_RANGE(tcp, 5452, ( 5.153.231.28/32 5.153.231.21/32 82.195.75.110/32 5.153.231.11/32 138.16.160.12/32 ))'
289                         }
290                         @ferm::rule { 'dsa-postgres-udd6':
291                                 domain          => '(ip6)',
292                                 description     => 'Allow postgress access',
293                                 rule            => '&SERVICE_RANGE(tcp, 5452, ( 2001:41c8:1000:21::21:28/128 2001:41b8:202:deb:216:36ff:fe40:4001/128 2001:41c8:1000:21::21:11/32 2001:41c8:1000:21::21:21/128 ))'
294                         }
295                 }
296                 franck: {
297                         @ferm::rule { 'dsa-postgres-franck':
298                                 description     => 'Allow postgress access',
299                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 5.153.231.10/32 ))'
300                         }
301                         @ferm::rule { 'dsa-postgres-franck6':
302                                 domain          => 'ip6',
303                                 description     => 'Allow postgress access',
304                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:41c8:1000:21::21:10/128 ))'
305                         }
306
307                         @ferm::rule { 'dsa-postgres-backup':
308                                 description     => 'Allow postgress access',
309                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V4 ))'
310                         }
311                         @ferm::rule { 'dsa-postgres-backup6':
312                                 domain          => 'ip6',
313                                 description     => 'Allow postgress access',
314                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V6 ))'
315                         }
316                 }
317                 bmdb1: {
318                         @ferm::rule { 'dsa-postgres-main':
319                                 description     => 'Allow postgress access',
320                                 rule            => '&SERVICE_RANGE(tcp, 5435, ( 5.153.231.23/32 5.153.231.25/32 209.87.16.38/32 5.153.231.26/32 5.153.231.18/32 5.153.231.28/32 5.153.231.249/32 5.153.231.29/32 5.153.231.43/32 5.153.231.33/32 ))'
321                         }
322                         @ferm::rule { 'dsa-postgres-main6':
323                                 domain          => 'ip6',
324                                 description     => 'Allow postgress access',
325                                 rule            => '&SERVICE_RANGE(tcp, 5435, ( 2001:41c8:1000:21::21:23/128 2001:41c8:1000:21::21:25/128 2607:f8f0:614:1::1274:38/128 2001:41c8:1000:21::21:26/128 2001:41c8:1000:21::21:18/128 2001:41c8:1000:21::21:28/128 2001:41c8:1000:20::20:249/128 2001:41c8:1000:21::21:29/128 2001:41c8:1000:21::21:43/128 2001:41c8:1000:21::21:33/128 ))'
326                         }
327                         @ferm::rule { 'dsa-postgres-dak':
328                                 description     => 'Allow postgress access',
329                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 5.153.231.11/32 5.153.231.28/32 209.87.16.26/32 5.153.231.21/32 5.153.231.18/32 5.153.231.29/32 ))'
330                         }
331                         @ferm::rule { 'dsa-postgres-dak6':
332                                 domain          => 'ip6',
333                                 description     => 'Allow postgress access',
334                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 2001:41c8:1000:21::21:11/128 2001:41c8:1000:21::21:28/128 2607:f8f0:614:1::1274:26/128 2001:41c8:1000:21::21:21/128 2001:41c8:1000:21::21:18/128 2001:41c8:1000:21::21:29/128 ))'
335                         }
336                         @ferm::rule { 'dsa-postgres-wannabuild':
337                                 # wuiet, ullmann, franck
338                                 description     => 'Allow postgress access',
339                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 5.153.231.18/32 209.87.16.38/32 138.16.160.12/32 ))'
340                         }
341                         @ferm::rule { 'dsa-postgres-wannabuild6':
342                                 domain          => 'ip6',
343                                 description     => 'Allow postgress access',
344                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 2001:41c8:1000:21::21:18/128 2607:f8f0:614:1::1274:38/128 ))'
345                         }
346                         @ferm::rule { 'dsa-postgres-bacula':
347                                 # dinis
348                                 description     => 'Allow postgress access1',
349                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 5.153.231.19/32 ))'
350                         }
351                         @ferm::rule { 'dsa-postgres-bacula6':
352                                 domain          => 'ip6',
353                                 description     => 'Allow postgress access1',
354                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 2001:41c8:1000:21::21:19/128 ))'
355                         }
356
357                         @ferm::rule { 'dsa-postgres-backup':
358                                 # ubc, wuit
359                                 description     => 'Allow postgress access',
360                                 rule            => '&SERVICE_RANGE(tcp, (5435 5436), ( $HOST_PGBACKUPHOST_V4 ))'
361                         }
362                         @ferm::rule { 'dsa-postgres-backup6':
363                                 domain          => 'ip6',
364                                 description     => 'Allow postgress access',
365                                 rule            => '&SERVICE_RANGE(tcp, (5435 5436), ( $HOST_PGBACKUPHOST_V6 ))'
366                         }
367
368                         @ferm::rule { 'dsa-postgres-dedup':
369                                 # ubc, wuit
370                                 description     => 'Allow postgress access',
371                                 rule            => '&SERVICE_RANGE(tcp, (5439), ( 5.153.231.17/32 ))'
372                         }
373                         @ferm::rule { 'dsa-postgres-dedup6':
374                                 domain          => 'ip6',
375                                 description     => 'Allow postgress access',
376                                 rule            => '&SERVICE_RANGE(tcp, (5439), ( 2001:41c8:1000:21::21:17/128 ))'
377                         }
378
379                         @ferm::rule { 'dsa-postgres-debsources':
380                                 description     => 'Allow postgress access',
381                                 rule            => '&SERVICE_RANGE(tcp, (5440), ( 5.153.231.38/32 ))'
382                         }
383                         @ferm::rule { 'dsa-postgres-debsources6':
384                                 domain          => 'ip6',
385                                 description     => 'Allow postgress access',
386                                 rule            => '&SERVICE_RANGE(tcp, (5440), ( 2001:41c8:1000:21::21:38/128 ))'
387                         }
388                 }
389                 danzi: {
390                         @ferm::rule { 'dsa-postgres-danzi':
391                                 # ubc, wuit
392                                 description     => 'Allow postgress access',
393                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 209.87.16.0/24 5.153.231.18/32 ))'
394                         }
395                         @ferm::rule { 'dsa-postgres-danzi6':
396                                 domain          => 'ip6',
397                                 description     => 'Allow postgress access',
398                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2607:f8f0:610:4000::/64 2607:f8f0:614:1::/64 2001:41c8:1000:21::21:18/128 ))'
399                         }
400
401                         @ferm::rule { 'dsa-postgres2-danzi':
402                                 description     => 'Allow postgress access2',
403                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 206.12.19.0/24 209.87.16.0/24 ))'
404                         }
405                         @ferm::rule { 'dsa-postgres3-danzi':
406                                 description     => 'Allow postgress access3',
407                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 206.12.19.0/24 209.87.16.0/24 ))'
408                         }
409                         @ferm::rule { 'dsa-postgres4-danzi':
410                                 description     => 'Allow postgress access4',
411                                 rule            => '&SERVICE_RANGE(tcp, 5438, ( 206.12.19.0/24 209.87.16.0/24 ))'
412                         }
413
414                         @ferm::rule { 'dsa-postgres-backup':
415                                 description     => 'Allow postgress access',
416                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V4 ))'
417                         }
418                         @ferm::rule { 'dsa-postgres-backup6':
419                                 domain          => 'ip6',
420                                 description     => 'Allow postgress access',
421                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V6 ))'
422                         }
423                 }
424                 seger: {
425                         @ferm::rule { 'dsa-postgres-backup':
426                                 description     => 'Allow postgress access',
427                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V4 ))'
428                         }
429                         @ferm::rule { 'dsa-postgres-backup6':
430                                 domain          => 'ip6',
431                                 description     => 'Allow postgress access',
432                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V6 ))'
433                         }
434                 }
435                 sibelius: {
436                         @ferm::rule { 'dsa-postgres-backup':
437                                 description     => 'Allow postgress access',
438                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V4 ))'
439                         }
440                         @ferm::rule { 'dsa-postgres-backup6':
441                                 domain          => 'ip6',
442                                 description     => 'Allow postgress access',
443                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V6 ))'
444                         }
445                         @ferm::rule { 'dsa-postgres-replication':
446                                 description     => 'Allow postgress access',
447                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 185.17.185.187/32 ))'
448                         }
449                         @ferm::rule { 'dsa-postgres-replication6':
450                                 domain          => 'ip6',
451                                 description     => 'Allow postgress access',
452                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:1af8:4020:b030:deb::187/128 ))'
453                         }
454                 }
455                 lw07: {
456                         @ferm::rule { 'dsa-postgres-snapshot':
457                                 description     => 'Allow postgress access',
458                                 rule            => '&SERVICE_RANGE(tcp, 5439, ( 185.17.185.176/28 ))'
459                         }
460                         @ferm::rule { 'dsa-postgres-snapshot6':
461                                 domain          => 'ip6',
462                                 description     => 'Allow postgress access',
463                                 rule            => '&SERVICE_RANGE(tcp, 5439, ( 2001:1af8:4020:b030::/64 ))'
464                         }
465                 }
466                 vittoria: {
467                         @ferm::rule { 'dsa-postgres-backup':
468                                 description     => 'Allow postgress access',
469                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V4 ))'
470                         }
471                         @ferm::rule { 'dsa-postgres-backup6':
472                                 domain          => 'ip6',
473                                 description     => 'Allow postgress access',
474                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V6 ))'
475                         }
476                 }
477                 default: {}
478         }
479         # vpn fu
480         case $::hostname {
481                 draghi: {
482                         @ferm::rule { 'dsa-vpn':
483                                 description     => 'Allow openvpn access',
484                                 rule            => '&SERVICE(udp, 17257)'
485                         }
486                         @ferm::rule { 'dsa-routing':
487                                 description     => 'forward chain',
488                                 chain           => 'FORWARD',
489                                 rule            => 'policy ACCEPT;
490 mod state state (ESTABLISHED RELATED) ACCEPT;
491 interface tun+ ACCEPT;
492 REJECT reject-with icmp-admin-prohibited
493 '
494                         }
495                         @ferm::rule { 'dsa-vpn-mark':
496                                 table           => 'mangle',
497                                 chain           => 'PREROUTING',
498                                 rule            => 'interface tun+ MARK set-mark 1',
499                         }
500                         @ferm::rule { 'dsa-vpn-nat':
501                                 table           => 'nat',
502                                 chain           => 'POSTROUTING',
503                                 rule            => 'outerface !tun+ mod mark mark 1 MASQUERADE',
504                         }
505                 }
506                 ubc-enc2bl1,ubc-enc2bl2,ubc-enc2bl9,ubc-enc2bl10: {
507                         @ferm::rule { 'dsa-luca-fixme':
508                                 description     => 'Allow ssh access from mnt and vpn networks',
509                                 rule            => '&SERVICE_RANGE(tcp, 22, ( 172.29.40.0/22 172.29.203.0/24 ))',
510                         }
511                 }
512                 default: {}
513         }
514         # tftp
515         case $::hostname {
516                 abel: {
517                         @ferm::rule { 'dsa-tftp':
518                                 description     => 'Allow tftp access',
519                                 rule            => '&SERVICE_RANGE(udp, 69, ( 172.28.17.0/24 ))'
520                         }
521                 }
522                 master: {
523                         @ferm::rule { 'dsa-tftp':
524                                 description     => 'Allow tftp access',
525                                 rule            => '&SERVICE_RANGE(udp, 69, ( 82.195.75.64/26 192.168.43.0/24 ))'
526                         }
527                 }
528         }
529 }