From fe15f127225c912d5d079ca519a0047e8fe02f8c Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Sat, 30 Jun 2012 09:35:55 +0200 Subject: [PATCH] freebsd routing for czerny --- modules/ferm/manifests/per-host.pp | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp index 996efc083..0f0ca175f 100644 --- a/modules/ferm/manifests/per-host.pp +++ b/modules/ferm/manifests/per-host.pp @@ -159,7 +159,7 @@ class ferm::per-host { default: {} } - if $::hostname in [rautavaara,luchesi] { + if $::hostname in [rautavaara,luchesi,czerny] { @ferm::rule { 'dsa-to-kfreebsd': description => 'Traffic routed to kfreebsd hosts', chain => 'to-kfreebsd', @@ -222,6 +222,25 @@ interface br0 destination ($ADDRESS_FISCHER $ADDRESS_FALLA) proto tcp dport 22 A interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd; ULOG ulog-prefix "REJECT FORWARD: "; REJECT reject-with icmp-admin-prohibited +' + } + } + czerny: { + @ferm::rule { 'dsa-routing': + description => 'forward chain', + chain => 'FORWARD', + rule => 'def $ADDRESS_FILS=82.195.75.89; +def $FREEBSD_HOSTS=($ADDRESS_FILS); + +policy ACCEPT; +mod state state (ESTABLISHED RELATED) ACCEPT; +interface br0 outerface br0 ACCEPT; +interface br1 outerface br1 ACCEPT; + +interface br2 outerface br0 jump from-kfreebsd; +interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd; +ULOG ulog-prefix "REJECT FORWARD: "; +REJECT reject-with icmp-admin-prohibited ' } } -- 2.20.1