projects
/
mirror
/
dsa-puppet.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge branch 'rsync-shuffle'
[mirror/dsa-puppet.git]
/
modules
/
ferm
/
manifests
/
per-host.pp
diff --git
a/modules/ferm/manifests/per-host.pp
b/modules/ferm/manifests/per-host.pp
index
70e0e73
..
2756e59
100644
(file)
--- a/
modules/ferm/manifests/per-host.pp
+++ b/
modules/ferm/manifests/per-host.pp
@@
-180,7
+180,9
@@
REJECT reject-with icmp-admin-prohibited
chain => 'FORWARD',
rule => 'def $ADDRESS_FANO=206.12.19.110;
def $ADDRESS_FINZI=206.12.19.111;
chain => 'FORWARD',
rule => 'def $ADDRESS_FANO=206.12.19.110;
def $ADDRESS_FINZI=206.12.19.111;
-def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
+def $ADDRESS_FISCHER=206.12.19.112;
+def $ADDRESS_FALLA=206.12.19.117;
+def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI $ADDRESS_FISCHER $ADDRESS_FALLA);
policy ACCEPT;
mod state state (ESTABLISHED RELATED) ACCEPT;
policy ACCEPT;
mod state state (ESTABLISHED RELATED) ACCEPT;
@@
-188,6
+190,7
@@
interface br0 outerface br0 ACCEPT;
interface br1 outerface br1 ACCEPT;
interface br2 outerface br0 jump from-kfreebsd;
interface br1 outerface br1 ACCEPT;
interface br2 outerface br0 jump from-kfreebsd;
+interface br0 destination ($ADDRESS_FISCHER $ADDRESS_FALLA) proto tcp dport 22 ACCEPT;
interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
ULOG ulog-prefix "REJECT FORWARD: ";
REJECT reject-with icmp-admin-prohibited
interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
ULOG ulog-prefix "REJECT FORWARD: ";
REJECT reject-with icmp-admin-prohibited