Decommission merikanto host

[mirror/dsa-puppet.git] / modules / ferm / manifests / per-host.pp

diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp
index 4a1f371..319c792 100644 (file)
--- a/modules/ferm/manifests/per-host.pp
+++ b/modules/ferm/manifests/per-host.pp
@@ -3,7 +3,7 @@ class ferm::per-host {
                include ferm::zivit
        }
 
-       if $::hostname in [glinka,klecker,merikanto,ravel,rietz,senfl,sibelius,stabile] {
+       if $::hostname in [glinka,klecker,ravel,rietz,senfl,sibelius,stabile] {
                ferm::rule { 'dsa-rsync':
                        domain      => '(ip ip6)',
                        description => 'Allow rsync access',
@@ -113,29 +113,6 @@ class ferm::per-host {
                                description     => 'Allow ldaps access',
                                rule            => '&SERVICE(tcp, 636)'
                        }
-                       @ferm::rule { 'dsa-vpn':
-                               description     => 'Allow openvpn access',
-                               rule            => '&SERVICE(udp, 17257)'
-                       }
-                       @ferm::rule { 'dsa-routing':
-                               description     => 'forward chain',
-                               chain           => 'FORWARD',
-                               rule            => 'policy ACCEPT;
-mod state state (ESTABLISHED RELATED) ACCEPT;
-interface tun+ ACCEPT;
-REJECT reject-with icmp-admin-prohibited
-'
-                       }
-                       @ferm::rule { 'dsa-vpn-mark':
-                               table           => 'mangle',
-                               chain           => 'PREROUTING',
-                               rule            => 'interface tun+ MARK set-mark 1',
-                       }
-                       @ferm::rule { 'dsa-vpn-nat':
-                               table           => 'nat',
-                               chain           => 'POSTROUTING',
-                               rule            => 'outerface !tun+ mod mark mark 1 MASQUERADE',
-                       }
                }
                cilea: {
                        ferm::module { 'nf_conntrack_sip': }
@@ -301,4 +278,32 @@ REJECT reject-with icmp-admin-prohibited
                        }
                }
        }
+       # vpn fu
+       case $::hostname {
+               draghi,eysler: {
+                       @ferm::rule { 'dsa-vpn':
+                               description     => 'Allow openvpn access',
+                               rule            => '&SERVICE(udp, 17257)'
+                       }
+                       @ferm::rule { 'dsa-routing':
+                               description     => 'forward chain',
+                               chain           => 'FORWARD',
+                               rule            => 'policy ACCEPT;
+mod state state (ESTABLISHED RELATED) ACCEPT;
+interface tun+ ACCEPT;
+REJECT reject-with icmp-admin-prohibited
+'
+                       }
+                       @ferm::rule { 'dsa-vpn-mark':
+                               table           => 'mangle',
+                               chain           => 'PREROUTING',
+                               rule            => 'interface tun+ MARK set-mark 1',
+                       }
+                       @ferm::rule { 'dsa-vpn-nat':
+                               table           => 'nat',
+                               chain           => 'POSTROUTING',
+                               rule            => 'outerface !tun+ mod mark mark 1 MASQUERADE',
+                       }
+               }
+       }
 }