X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fferm%2Fmanifests%2Fper-host.pp;h=a459169f4cf27f57b9cd1e43b7e5580d59b7e4d5;hb=f23179a9e0959a728bd7530db74d537509bf774a;hp=ff4d8d76cc936f6f25313c942f79d9c581af37a1;hpb=b8f656975abbb0fdd4e26be35ad9342203d8ee27;p=mirror%2Fdsa-puppet.git diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp index ff4d8d76c..a459169f4 100644 --- a/modules/ferm/manifests/per-host.pp +++ b/modules/ferm/manifests/per-host.pp @@ -12,7 +12,7 @@ class ferm::per-host { } case $::hostname { - piatti,samosa: { + samosa: { @ferm::rule { 'dsa-udd-stunnel': description => 'port 8080 for udd stunnel', rule => '&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))' @@ -51,26 +51,37 @@ class ferm::per-host { bendel: { @ferm::rule { 'listmaster-ontp-in': description => 'ONTP has a broken mail setup', - table => 'filter' - chain => 'INPUT' + table => 'filter', + chain => 'INPUT', rule => 'source 188.165.23.89/32 proto tcp dport 25 jump DROP', } - @ferm::rule { 'listmaster-ontp-in': + @ferm::rule { 'listmaster-ontp-out': description => 'ONTP has a broken mail setup', - table => 'filter' - chain => 'OUTPUT' + table => 'filter', + chain => 'OUTPUT', rule => 'destination 78.8.208.246/32 proto tcp dport 25 jump DROP', } } + franck: { + @ferm::rule { 'dsa-postgres-danzi': + description => 'Allow postgress access', + rule => '&SERVICE_RANGE(tcp, 5433, ( 5.153.231.10/32 ))' + } + @ferm::rule { 'dsa-postgres-danzi6': + domain => 'ip6', + description => 'Allow postgress access', + rule => '&SERVICE_RANGE(tcp, 5433, ( 2001:41c8:1000:21::21:10/128 ))' + } + } danzi: { @ferm::rule { 'dsa-postgres-danzi': description => 'Allow postgress access', - rule => '&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 ))' + rule => '&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 194.177.211.200/32 ))' } @ferm::rule { 'dsa-postgres-danzi6': domain => 'ip6', description => 'Allow postgress access', - rule => '&SERVICE_RANGE(tcp, 5433, ( 2607:f8f0:610:4000::/64 ))' + rule => '&SERVICE_RANGE(tcp, 5433, ( 2607:f8f0:610:4000::/64 2001:648:2ffc:deb:214:22ff:fe74:1fa/128 ))' } @ferm::rule { 'dsa-postgres2-danzi': @@ -85,6 +96,16 @@ class ferm::per-host { description => 'Allow postgress access4', rule => '&SERVICE_RANGE(tcp, 5438, ( 206.12.19.0/24 ))' } + + @ferm::rule { 'dsa-postgres-bacula-danzi': + description => 'Allow postgress access1', + rule => '&SERVICE_RANGE(tcp, 5434, ( 206.12.19.139/32 ))' + } + @ferm::rule { 'dsa-postgres-bacula-danzi6': + domain => 'ip6', + description => 'Allow postgress access1', + rule => '&SERVICE_RANGE(tcp, 5434, ( 2607:f8f0:610:4000:6564:a62:ce0c:138b/128 ))' + } } abel,alwyn,rietz: { @ferm::rule { 'dsa-tftp': @@ -212,73 +233,22 @@ REJECT reject-with icmp-admin-prohibited default: {} } - if $::hostname in [rautavaara,luchesi] { - @ferm::rule { 'dsa-to-kfreebsd': - description => 'Traffic routed to kfreebsd hosts', - chain => 'to-kfreebsd', - rule => 'proto icmp ACCEPT; -source ($FREEBSD_SSH_ACCESS $HOST_NAGIOS_V4) proto tcp dport 22 ACCEPT; -source ($HOST_MAILRELAY_V4 $HOST_NAGIOS_V4) proto tcp dport 25 ACCEPT; -source ($HOST_MUNIN_V4 $HOST_NAGIOS_V4) proto tcp dport 4949 ACCEPT; -source ($HOST_NAGIOS_V4) proto tcp dport 5666 ACCEPT; -source ($HOST_NAGIOS_V4) proto udp dport ntp ACCEPT -' + if $::hostname in [rautavaara] { + @ferm::rule { 'dsa-from-mgmt': + description => 'Traffic routed from mgmt net vlan/bridge', + chain => 'INPUT', + rule => 'interface eth1 ACCEPT' } - @ferm::rule { 'dsa-from-kfreebsd': - description => 'Traffic routed from kfreebsd vlan/bridge', - chain => 'from-kfreebsd', - rule => 'proto icmp ACCEPT; -proto tcp dport (21 22 80 53 443) ACCEPT; -proto udp dport (53 123) ACCEPT; -proto tcp dport 8140 daddr 82.195.75.104 ACCEPT; # puppethost -proto tcp dport 5140 daddr (82.195.75.99 206.12.19.121) ACCEPT; # loghost -proto tcp dport 11371 daddr 82.195.75.107 ACCEPT; # keyring host -proto tcp dport (25 submission) daddr ($HOST_MAILRELAY_V4) ACCEPT -' + @ferm::rule { 'dsa-mgmt-mark': + table => 'mangle', + chain => 'PREROUTING', + rule => 'interface eth1 MARK set-mark 1', } - } - case $::hostname { - rautavaara: { - @ferm::rule { 'dsa-routing': - description => 'forward chain', - chain => 'FORWARD', - rule => 'def $ADDRESS_FASCH=194.177.211.201; -def $ADDRESS_FIELD=194.177.211.210; -def $FREEBSD_HOSTS=($ADDRESS_FASCH $ADDRESS_FIELD); - -policy ACCEPT; -mod state state (ESTABLISHED RELATED) ACCEPT; -interface vlan11 outerface eth0 jump from-kfreebsd; -interface eth0 destination ($FREEBSD_HOSTS) jump to-kfreebsd; -ULOG ulog-prefix "REJECT FORWARD: "; -REJECT reject-with icmp-admin-prohibited -' - } - } - luchesi: { - @ferm::rule { 'dsa-routing': - description => 'forward chain', - chain => 'FORWARD', - rule => 'def $ADDRESS_FANO=206.12.19.110; -def $ADDRESS_FINZI=206.12.19.111; -def $ADDRESS_FISCHER=206.12.19.112; -def $ADDRESS_FALLA=206.12.19.117; -def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI $ADDRESS_FISCHER $ADDRESS_FALLA); - -policy ACCEPT; -mod state state (ESTABLISHED RELATED) ACCEPT; -interface br0 outerface br0 ACCEPT; -interface br1 outerface br1 ACCEPT; - -interface br2 outerface br0 jump from-kfreebsd; -interface br0 destination ($ADDRESS_FISCHER $ADDRESS_FALLA) proto tcp dport 22 ACCEPT; -interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd; -ULOG ulog-prefix "REJECT FORWARD: "; -REJECT reject-with icmp-admin-prohibited -' - } + @ferm::rule { 'dsa-mgmt-nat': + table => 'nat', + chain => 'POSTROUTING', + rule => 'outerface eth1 mod mark mark 1 MASQUERADE', } - default: {} } # redirect snapshot into varnish @@ -316,12 +286,4 @@ REJECT reject-with icmp-admin-prohibited } default: {} } - case $::hostname { - bm-bl1,bm-bl2,bm-bl3,bm-bl4,bm-bl5,bm-bl6,bm-bl7,bm-bl8,bm-bl9,bm-bl10,bm-bl11,bm-bl12,bm-bl13,bm-bl14: { - @ferm::rule { 'dsa-hwnet-vlan20': - rule => 'interface vlan20 jump ACCEPT', - } - } - default: {} - } }