2 munin::check { 'bind': }
4 site::aptrepo { 'bind-ratelimit':
5 url => 'http://db.debian.org/debian-admin',
6 suite => 'bind-ratelimit',
18 @ferm::rule { '00-dsa-bind-no-ddos-any':
20 description => 'Allow nameserver access',
21 rule => 'proto udp dport 53 mod string from 32 to 64 algo bm hex-string \'|0000ff0001|\' jump DROP'
24 if has_role('dns_primary') {
25 @ferm::rule { '01-dsa-bind-4':
27 description => 'Allow nameserver access',
28 rule => '&TCP_UDP_SERVICE_RANGE(53, ( $HOST_DNS_SECONDARY_V4 $HOST_NAGIOS_V4 ) )',
30 @ferm::rule { '01-dsa-bind-6':
32 description => 'Allow nameserver access',
33 rule => '&TCP_UDP_SERVICE_RANGE(53, ( $HOST_DNS_SECONDARY_V6 $HOST_NAGIOS_V6 ) )',
36 @ferm::rule { '01-dsa-bind':
38 description => 'Allow nameserver access',
39 rule => '&TCP_UDP_SERVICE(53)'
43 @ferm::rule { 'dsa-bind-notrack':
45 description => 'NOTRACK for nameserver traffic',
47 chain => 'PREROUTING',
48 rule => 'proto (tcp udp) dport 53 jump NOTRACK'
51 @ferm::rule { 'dsa-bind-notrack-out':
53 description => 'NOTRACK for nameserver traffic',
56 rule => 'proto (tcp udp) sport 53 jump NOTRACK'
59 file { '/var/log/bind9':