modules/ferm/manifests/per-host.pp

   1 class ferm::per-host {
   2     case $hostname {
   3         ancina,zandonai,zelenka: {
   4             include ferm::zivit
   5         }
   6     }
   7
   8     case $hostname {
   9         chopin,franck,gluck,kaufmann,kassia,klecker,lobos,merikanto,merkel,morricone,ravel,ries,rietz,saens,schein,senfl,stabile,steffani,valente,villa,wieck,wolkenstein: {
  10             include ferm::rsync
  11         }
  12     }
  13
  14     case $hostname {
  15         chopin,franck,gluck,kassia,klecker,lobos,morricone,ravel,ries,rietz,saens,schein,steffani,valente,villa,wieck,stabile: {
  16             include ferm::ftp
  17         }
  18     }
  19
  20     case $hostname {
  21         piatti,samosa: {
  22             @ferm::rule { "dsa-udd-stunnel":
  23                 description  => "port 8080 for udd stunnel",
  24                 rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
  25             }
  26         }
  27         danzi: {
  28                 @ferm::rule { "dsa-postgres-danzi":
  29                     description     => "Allow postgress access",
  30                     rule            => "&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 ))"
  31                 }
  32
  33         }
  34         paganini: {
  35             @ferm::rule { "dsa-dhcp":
  36                 description     => "Allow dhcp access",
  37                 rule            => "&SERVICE(udp, 67)"
  38             }
  39             @ferm::rule { "dsa-tftp":
  40                 description     => "Allow tftp access",
  41                 rule            => "&SERVICE(udp, 69)"
  42             }
  43         }
  44         handel: {
  45             @ferm::rule { "dsa-puppet":
  46                 description     => "Allow puppet access",
  47                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
  48             }
  49             @ferm::rule { "dsa-puppet-v6":
  50                 domain          => 'ip6',
  51                 description     => "Allow puppet access",
  52                 rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
  53             }
  54         }
  55         powell: {
  56             @ferm::rule { "dsa-powell-v6-tunnel":
  57                 description     => "Allow powell to use V6 tunnel broker",
  58                 rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
  59             }
  60             @ferm::rule { "dsa-powell-btseed":
  61                 domain          => "(ip ip6)",
  62                 description     => "Allow powell to seed BT",
  63                 rule            => "proto tcp dport 8000:8100 jump ACCEPT"
  64             }
  65             @ferm::rule { "dsa-powell-rsync":
  66                 description     => "Hoster wants to sync from here, and why not",
  67                 rule            => "&SERVICE_RANGE(tcp, rsync, ( 195.20.242.90 192.25.206.33 82.195.75.106 206.12.19.118 ))"
  68             }
  69         }
  70         heininen,lotti: {
  71             @ferm::rule { "dsa-syslog":
  72                 description     => "Allow syslog access",
  73                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
  74             }
  75             @ferm::rule { "dsa-syslog-v6":
  76                 domain          => 'ip6',
  77                 description     => "Allow syslog access",
  78                 rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
  79             }
  80         }
  81         kaufmann: {
  82             @ferm::rule { "dsa-hkp":
  83                 domain          => "(ip ip6)",
  84                 description     => "Allow hkp access",
  85                 rule            => "&SERVICE(tcp, 11371)"
  86             }
  87         }
  88         liszt: {
  89             @ferm::rule { "smtp":
  90                 domain          => "(ip ip6)",
  91                 description     => "Allow smtp access",
  92                 rule            => "&SERVICE(tcp, 25)"
  93             }
  94         }
  95         draghi: {
  96             #@ferm::rule { "dsa-bind":
  97             #    domain          => "(ip ip6)",
  98             #    description     => "Allow nameserver access",
  99             #    rule            => "&TCP_UDP_SERVICE(53)"
 100             #}
 101             @ferm::rule { "dsa-finger":
 102                 domain          => "(ip ip6)",
 103                 description     => "Allow finger access",
 104                 rule            => "&SERVICE(tcp, 79)"
 105             }
 106             @ferm::rule { "dsa-ldap":
 107                 domain          => "(ip ip6)",
 108                 description     => "Allow ldap access",
 109                 rule            => "&SERVICE(tcp, 389)"
 110             }
 111             @ferm::rule { "dsa-ldaps":
 112                 domain          => "(ip ip6)",
 113                 description     => "Allow ldaps access",
 114                 rule            => "&SERVICE(tcp, 636)"
 115             }
 116         }
 117         cilea: {
 118             file {
 119                 "/etc/ferm/conf.d/load_sip_conntrack.conf":
 120                     source => "puppet:///modules/ferm/conntrack_sip.conf",
 121                     require => Package["ferm"],
 122                     notify  => Exec["ferm restart"];
 123             }
 124             @ferm::rule { "dsa-sip":
 125                 domain          => "(ip ip6)",
 126                 description     => "Allow sip access",
 127                 rule            => "&TCP_UDP_SERVICE(5060)"
 128             }
 129             @ferm::rule { "dsa-sipx":
 130                 domain          => "(ip ip6)",
 131                 description     => "Allow sipx access",
 132                 rule            => "&TCP_UDP_SERVICE(5080)"
 133             }
 134         }
 135     }
 136
 137     case $hostname { rautavaara,luchesi: {
 138         @ferm::rule { "dsa-to-kfreebsd":
 139             description     => "Traffic routed to kfreebsd hosts",
 140             chain           => 'to-kfreebsd',
 141             rule            => 'proto icmp ACCEPT;
 142                                 source ($FREEBSD_SSH_ACCESS $HOST_NAGIOS_V4) proto tcp dport 22 ACCEPT;
 143                                 source ($HOST_MAILRELAY_V4 $HOST_NAGIOS_V4) proto tcp dport 25 ACCEPT;
 144                                 source ($HOST_MUNIN_V4 $HOST_NAGIOS_V4) proto tcp dport 4949 ACCEPT;
 145                                 source ($HOST_NAGIOS_V4) proto tcp dport 5666 ACCEPT;
 146                                 source ($HOST_NAGIOS_V4) proto udp dport ntp ACCEPT
 147                                '
 148         }
 149         @ferm::rule { "dsa-from-kfreebsd":
 150             description     => "Traffic routed from kfreebsd vlan/bridge",
 151             chain           => 'from-kfreebsd',
 152             rule            => 'proto icmp ACCEPT;
 153                                 proto tcp dport (21 22 80 53 443) ACCEPT;
 154                                 proto udp dport (53 123) ACCEPT;
 155                                 proto tcp dport 8140 daddr 82.195.75.104 ACCEPT; # puppethost
 156                                 proto tcp dport 5140 daddr (82.195.75.98 206.12.19.121) ACCEPT; # loghost
 157                                 proto tcp dport (25 submission) daddr ($HOST_MAILRELAY_V4) ACCEPT
 158                                '
 159         }
 160     }}
 161     case $hostname {
 162         rautavaara: {
 163             @ferm::rule { "dsa-routing":
 164                 description     => "forward chain",
 165                 chain           => "FORWARD",
 166                 rule            => '
 167                                     def $ADDRESS_FASCH=194.177.211.201;
 168                                     def $ADDRESS_FIELD=194.177.211.210;
 169                                     def $FREEBSD_HOSTS=($ADDRESS_FASCH $ADDRESS_FIELD);
 170
 171                                     policy ACCEPT;
 172                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 173                                     interface vlan11 outerface eth0 jump from-kfreebsd;
 174                                     interface eth0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 175                                     ULOG ulog-prefix "REJECT FORWARD: ";
 176                                     REJECT reject-with icmp-admin-prohibited
 177                                     '
 178             }
 179         }
 180         luchesi: {
 181             @ferm::rule { "dsa-routing":
 182                 description     => "forward chain",
 183                 chain           => "FORWARD",
 184                 rule            => '
 185                                     def $ADDRESS_FANO=206.12.19.110;
 186                                     def $ADDRESS_FINZI=206.12.19.111;
 187                                     def $FREEBSD_HOSTS=($ADDRESS_FANO $ADDRESS_FINZI);
 188
 189                                     policy ACCEPT;
 190                                     mod state state (ESTABLISHED RELATED) ACCEPT;
 191                                     interface br0 outerface br0 ACCEPT;
 192
 193                                     interface br2 outerface br0 jump from-kfreebsd;
 194                                     interface br0 destination ($FREEBSD_HOSTS) jump to-kfreebsd;
 195                                     ULOG ulog-prefix "REJECT FORWARD: ";
 196                                     REJECT reject-with icmp-admin-prohibited
 197                                     '
 198             }
 199         }
 200     }
 201
 202     # redirect snapshot into varnish
 203     case $hostname {
 204         sibelius: {
 205             @ferm::rule { "dsa-snapshot-varnish":
 206                 rule            => '&SERVICE(tcp, 6081)',
 207             }
 208             @ferm::rule { "dsa-nat-snapshot-varnish":
 209                 table           => 'nat',
 210                 chain           => 'PREROUTING',
 211                 rule            => 'proto tcp daddr 193.62.202.28 dport 80 REDIRECT to-ports 6081',
 212             }
 213         }
 214         stabile: {
 215             @ferm::rule { "dsa-snapshot-varnish":
 216                 rule            => '&SERVICE(tcp, 6081)',
 217             }
 218             @ferm::rule { "dsa-nat-snapshot-varnish":
 219                 table           => 'nat',
 220                 chain           => 'PREROUTING',
 221                 rule            => 'proto tcp daddr 206.12.19.150 dport 80 REDIRECT to-ports 6081',
 222             }
 223         }
 224     }
 225 }
 226
 227 # vim:set et:
 228 # vim:set sts=4 ts=4:
 229 # vim:set shiftwidth=4: