modules/ferm/manifests/per_host.pp

   1 class ferm::per_host {
   2         if $::hostname in [zandonai,zelenka] {
   3                 include ferm::zivit
   4         }
   5
   6         if (getfromhash($site::nodeinfo, 'hoster', 'name') == "aql") {
   7                 include ferm::aql
   8         }
   9
  10         case $::hostname {
  11                 casulana: {
  12                         @ferm::rule { 'dsa-cloud-builds-br1-in':
  13                                 description     => 'br1 virtual machines - in',
  14                                 table           => 'filter',
  15                                 chain           => 'INPUT',
  16                                 rule            => 'interface br1 ACCEPT'
  17                         }
  18                         @ferm::rule { 'dsa-cloud-builds-br1-nat':
  19                                 description     => 'br1 virtual machines - nat',
  20                                 table           => 'nat',
  21                                 chain           => 'POSTROUTING',
  22                                 rule            => 'saddr 172.16.1.0/24 outerface bond0.21 MASQUERADE'
  23                         }
  24                 }
  25                 czerny,clementi: {
  26                         @ferm::rule { 'dsa-upsmon':
  27                                 description     => 'Allow upsmon access',
  28                                 rule            => '&SERVICE_RANGE(tcp, 3493, ( 82.195.75.64/26 192.168.43.0/24 ))'
  29                         }
  30                 }
  31                 bendel: {
  32                         @ferm::rule { 'listmaster-ontp-in':
  33                                 description => 'ONTP has a broken mail setup',
  34                                 table       => 'filter',
  35                                 chain       => 'INPUT',
  36                                 rule        => 'source 188.165.23.89/32 proto tcp dport 25 jump DROP',
  37                         }
  38                         @ferm::rule { 'listmaster-ontp-out':
  39                                 description => 'ONTP has a broken mail setup',
  40                                 table       => 'filter',
  41                                 chain       => 'OUTPUT',
  42                                 rule        => 'destination 78.8.208.246/32 proto tcp dport 25 jump DROP',
  43                         }
  44                 }
  45                 lotti,lully,loghost-grnet-01: {
  46                         @ferm::rule { 'dsa-syslog':
  47                                 description     => 'Allow syslog access',
  48                                 rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V4)'
  49                         }
  50                         @ferm::rule { 'dsa-syslog-v6':
  51                                 domain          => 'ip6',
  52                                 description     => 'Allow syslog access',
  53                                 rule            => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V6)'
  54                         }
  55                         @ferm::rule { 'fastly-syslog':
  56                                 description     => 'Allow syslog access',
  57                                 rule            => '&SERVICE_RANGE(tcp, 5141, $HOST_FASTLY)'
  58                         }
  59                 }
  60                 kaufmann: {
  61                         @ferm::rule { 'dsa-hkp':
  62                                 domain          => '(ip ip6)',
  63                                 description     => 'Allow hkp access',
  64                                 rule            => '&SERVICE(tcp, 11371)'
  65                         }
  66                 }
  67                 gombert: {
  68                         @ferm::rule { 'dsa-infinoted':
  69                                 domain          => '(ip ip6)',
  70                                 description     => 'Allow infinoted access',
  71                                 rule            => '&SERVICE(tcp, 6523)'
  72                         }
  73                 }
  74                 draghi: {
  75                         @ferm::rule { 'dsa-finger':
  76                                 domain          => '(ip ip6)',
  77                                 description     => 'Allow finger access',
  78                                 rule            => '&SERVICE(tcp, 79)'
  79                         }
  80                         @ferm::rule { 'dsa-ldap':
  81                                 domain          => '(ip ip6)',
  82                                 description     => 'Allow ldap access',
  83                                 rule            => '&SERVICE(tcp, 389)'
  84                         }
  85                         @ferm::rule { 'dsa-ldaps':
  86                                 domain          => '(ip ip6)',
  87                                 description     => 'Allow ldaps access',
  88                                 rule            => '&SERVICE(tcp, 636)'
  89                         }
  90                 }
  91                 sonntag: {
  92                         @ferm::rule { 'dsa-bugs-search':
  93                                 description  => 'port 1978 for bugs-search from bug web frontends',
  94                                 rule         => '&SERVICE_RANGE(tcp, 1978, ( 140.211.166.26 209.87.16.39 ))'
  95                         }
  96                 }
  97                 default: {}
  98         }
  99
 100         # redirect snapshot into varnish
 101         case $::hostname {
 102                 sibelius: {
 103                         @ferm::rule { 'dsa-snapshot-varnish':
 104                                 rule            => '&SERVICE(tcp, 6081)',
 105                         }
 106                         @ferm::rule { 'dsa-nat-snapshot-varnish':
 107                                 table           => 'nat',
 108                                 chain           => 'PREROUTING',
 109                                 rule            => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081',
 110                         }
 111                 }
 112                 lw07: {
 113                         @ferm::rule { 'dsa-snapshot-varnish':
 114                                 rule            => '&SERVICE(tcp, 6081)',
 115                         }
 116                         @ferm::rule { 'dsa-nat-snapshot-varnish':
 117                                 table           => 'nat',
 118                                 chain           => 'PREROUTING',
 119                                 rule            => 'proto tcp daddr 185.17.185.185 dport 80 REDIRECT to-ports 6081',
 120                         }
 121                 }
 122                 default: {}
 123         }
 124         case $::hostname {
 125                 bm-bl1,bm-bl2: {
 126                         @ferm::rule { 'dsa-vrrp':
 127                                 rule            => 'proto vrrp daddr 224.0.0.18 jump ACCEPT',
 128                         }
 129                         @ferm::rule { 'dsa-conntrackd':
 130                                 rule            => 'interface vlan2 daddr 225.0.0.50 jump ACCEPT',
 131                         }
 132                         @ferm::rule { 'dsa-bind-notrack-in':
 133                                 domain      => 'ip',
 134                                 description => 'NOTRACK for nameserver traffic',
 135                                 table       => 'raw',
 136                                 chain       => 'PREROUTING',
 137                                 rule        => 'proto (tcp udp) daddr 5.153.231.24 dport 53 jump NOTRACK'
 138                         }
 139
 140                         @ferm::rule { 'dsa-bind-notrack-out':
 141                                 domain      => 'ip',
 142                                 description => 'NOTRACK for nameserver traffic',
 143                                 table       => 'raw',
 144                                 chain       => 'OUTPUT',
 145                                 rule        => 'proto (tcp udp) saddr 5.153.231.24 sport 53 jump NOTRACK'
 146                         }
 147
 148                         @ferm::rule { 'dsa-bind-notrack-in6':
 149                                 domain      => 'ip6',
 150                                 description => 'NOTRACK for nameserver traffic',
 151                                 table       => 'raw',
 152                                 chain       => 'PREROUTING',
 153                                 rule        => 'proto (tcp udp) daddr 2001:41c8:1000:21::21:24 dport 53 jump NOTRACK'
 154                         }
 155
 156                         @ferm::rule { 'dsa-bind-notrack-out6':
 157                                 domain      => 'ip6',
 158                                 description => 'NOTRACK for nameserver traffic',
 159                                 table       => 'raw',
 160                                 chain       => 'OUTPUT',
 161                                 rule        => 'proto (tcp udp) saddr 2001:41c8:1000:21::21:24 sport 53 jump NOTRACK'
 162                         }
 163                 }
 164                 default: {}
 165         }
 166
 167         # postgres stuff
 168         case $::hostname {
 169                 ullmann: {
 170                         @ferm::rule { 'dsa-postgres-udd':
 171                                 description     => 'Allow postgress access',
 172                                 # quantz, moszumanska, master, coccia
 173                                 rule            => '&SERVICE_RANGE(tcp, 5452, ( 5.153.231.28/32 5.153.231.21/32 82.195.75.110/32 5.153.231.11/32 ))'
 174                         }
 175                         @ferm::rule { 'dsa-postgres-udd6':
 176                                 domain          => '(ip6)',
 177                                 description     => 'Allow postgress access',
 178                                 rule            => '&SERVICE_RANGE(tcp, 5452, ( 2001:41c8:1000:21::21:28/128 2001:41b8:202:deb:216:36ff:fe40:4001/128 2001:41c8:1000:21::21:11/32 2001:41c8:1000:21::21:21/128 ))'
 179                         }
 180                 }
 181                 fasolo: {
 182                         @ferm::rule { 'dsa-postgres-fasolo':
 183                                 description     => 'Allow postgress access',
 184                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 5.153.231.10/32 ))'
 185                         }
 186                         @ferm::rule { 'dsa-postgres-fasolo6':
 187                                 domain          => 'ip6',
 188                                 description     => 'Allow postgress access',
 189                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:41c8:1000:21::21:10/128 ))'
 190                         }
 191
 192                         @ferm::rule { 'dsa-postgres-backup':
 193                                 description     => 'Allow postgress access',
 194                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V4 ))'
 195                         }
 196                         @ferm::rule { 'dsa-postgres-backup6':
 197                                 domain          => 'ip6',
 198                                 description     => 'Allow postgress access',
 199                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V6 ))'
 200                         }
 201                 }
 202                 bmdb1: {
 203                         @ferm::rule { 'dsa-postgres-main':
 204                                 description     => 'Allow postgress access',
 205                                 rule            => '&SERVICE_RANGE(tcp, 5435, ( 5.153.231.23/32 5.153.231.25/32 209.87.16.38/32 5.153.231.26/32 5.153.231.18/32 5.153.231.28/32 5.153.231.249/32 5.153.231.29/32 5.153.231.43/32 5.153.231.33/32 ))'
 206                         }
 207                         @ferm::rule { 'dsa-postgres-main6':
 208                                 domain          => 'ip6',
 209                                 description     => 'Allow postgress access',
 210                                 rule            => '&SERVICE_RANGE(tcp, 5435, ( 2001:41c8:1000:21::21:23/128 2001:41c8:1000:21::21:25/128 2607:f8f0:614:1::1274:38/128 2001:41c8:1000:21::21:26/128 2001:41c8:1000:21::21:18/128 2001:41c8:1000:21::21:28/128 2001:41c8:1000:20::20:249/128 2001:41c8:1000:21::21:29/128 2001:41c8:1000:21::21:43/128 2001:41c8:1000:21::21:33/128 ))'
 211                         }
 212                         @ferm::rule { 'dsa-postgres-dak':
 213                                 description     => 'Allow postgress access',
 214                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 5.153.231.11/32 5.153.231.28/32 209.87.16.26/32 5.153.231.21/32 5.153.231.18/32 5.153.231.29/32 128.31.0.69/32 ))'
 215                         }
 216                         @ferm::rule { 'dsa-postgres-dak6':
 217                                 domain          => 'ip6',
 218                                 description     => 'Allow postgress access',
 219                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 2001:41c8:1000:21::21:11/128 2001:41c8:1000:21::21:28/128 2607:f8f0:614:1::1274:26/128 2001:41c8:1000:21::21:21/128 2001:41c8:1000:21::21:18/128 2001:41c8:1000:21::21:29/128 ))'
 220                         }
 221                         @ferm::rule { 'dsa-postgres-wannabuild':
 222                                 # wuiet, ullmann
 223                                 description     => 'Allow postgress access',
 224                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 5.153.231.18/32 209.87.16.38/32 ))'
 225                         }
 226                         @ferm::rule { 'dsa-postgres-wannabuild6':
 227                                 domain          => 'ip6',
 228                                 description     => 'Allow postgress access',
 229                                 rule            => '&SERVICE_RANGE(tcp, 5436, ( 2001:41c8:1000:21::21:18/128 2607:f8f0:614:1::1274:38/128 ))'
 230                         }
 231                         @ferm::rule { 'dsa-postgres-bacula':
 232                                 # dinis
 233                                 description     => 'Allow postgress access1',
 234                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 5.153.231.19/32 93.94.130.161/32 ))'
 235                         }
 236                         @ferm::rule { 'dsa-postgres-bacula6':
 237                                 domain          => 'ip6',
 238                                 description     => 'Allow postgress access1',
 239                                 rule            => '&SERVICE_RANGE(tcp, 5437, ( 2001:41c8:1000:21::21:19/128 2a02:158:380:280::161/128 ))'
 240                         }
 241
 242                         @ferm::rule { 'dsa-postgres-backup':
 243                                 description     => 'Allow postgress access',
 244                                 rule            => '&SERVICE_RANGE(tcp, (5435 5436 5440), ( $HOST_PGBACKUPHOST_V4 ))'
 245                         }
 246                         @ferm::rule { 'dsa-postgres-backup6':
 247                                 domain          => 'ip6',
 248                                 description     => 'Allow postgress access',
 249                                 rule            => '&SERVICE_RANGE(tcp, (5435 5436 5440), ( $HOST_PGBACKUPHOST_V6 ))'
 250                         }
 251
 252                         @ferm::rule { 'dsa-postgres-dedup':
 253                                 # ubc, wuit
 254                                 description     => 'Allow postgress access',
 255                                 rule            => '&SERVICE_RANGE(tcp, (5439), ( 5.153.231.17/32 ))'
 256                         }
 257                         @ferm::rule { 'dsa-postgres-dedup6':
 258                                 domain          => 'ip6',
 259                                 description     => 'Allow postgress access',
 260                                 rule            => '&SERVICE_RANGE(tcp, (5439), ( 2001:41c8:1000:21::21:17/128 ))'
 261                         }
 262
 263                         @ferm::rule { 'dsa-postgres-debsources':
 264                                 description     => 'Allow postgress access',
 265                                 rule            => '&SERVICE_RANGE(tcp, (5440), ( 5.153.231.38/32 ))'
 266                         }
 267                         @ferm::rule { 'dsa-postgres-debsources6':
 268                                 domain          => 'ip6',
 269                                 description     => 'Allow postgress access',
 270                                 rule            => '&SERVICE_RANGE(tcp, (5440), ( 2001:41c8:1000:21::21:38/128 ))'
 271                         }
 272                 }
 273                 danzi: {
 274                         @ferm::rule { 'dsa-postgres-danzi':
 275                                 # ubc, wuiet
 276                                 description     => 'Allow postgress access',
 277                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 209.87.16.0/24 5.153.231.18/32 ))'
 278                         }
 279                         @ferm::rule { 'dsa-postgres-danzi6':
 280                                 domain          => 'ip6',
 281                                 description     => 'Allow postgress access',
 282                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2607:f8f0:610:4000::/64 2607:f8f0:614:1::/64 2001:41c8:1000:21::21:18/128 ))'
 283                         }
 284
 285                         @ferm::rule { 'dsa-postgres2-danzi':
 286                                 description     => 'Allow postgress access2',
 287                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 209.87.16.0/24 ))'
 288                         }
 289                         @ferm::rule { 'dsa-postgres2-danzi6':
 290                                 domain          => 'ip6',
 291                                 description     => 'Allow postgress access2',
 292                                 rule            => '&SERVICE_RANGE(tcp, 5434, ( 2607:f8f0:614:1::/64 ))'
 293                         }
 294                 }
 295                 seger: {
 296                         @ferm::rule { 'dsa-postgres-backup':
 297                                 description     => 'Allow postgress access',
 298                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V4 ))'
 299                         }
 300                         @ferm::rule { 'dsa-postgres-backup6':
 301                                 domain          => 'ip6',
 302                                 description     => 'Allow postgress access',
 303                                 rule            => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V6 ))'
 304                         }
 305                 }
 306                 sibelius: {
 307                         @ferm::rule { 'dsa-postgres-backup':
 308                                 description     => 'Allow postgress access',
 309                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V4 ))'
 310                         }
 311                         @ferm::rule { 'dsa-postgres-backup6':
 312                                 domain          => 'ip6',
 313                                 description     => 'Allow postgress access',
 314                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V6 ))'
 315                         }
 316                         @ferm::rule { 'dsa-postgres-replication':
 317                                 description     => 'Allow postgress access',
 318                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 185.17.185.187/32 ))'
 319                         }
 320                         @ferm::rule { 'dsa-postgres-replication6':
 321                                 domain          => 'ip6',
 322                                 description     => 'Allow postgress access',
 323                                 rule            => '&SERVICE_RANGE(tcp, 5433, ( 2001:1af8:4020:b030:deb::187/128 ))'
 324                         }
 325                 }
 326                 lw07: {
 327                         @ferm::rule { 'dsa-postgres-snapshot':
 328                                 description     => 'Allow postgress access',
 329                                 rule            => '&SERVICE_RANGE(tcp, 5439, ( 185.17.185.176/28 ))'
 330                         }
 331                         @ferm::rule { 'dsa-postgres-snapshot6':
 332                                 domain          => 'ip6',
 333                                 description     => 'Allow postgress access',
 334                                 rule            => '&SERVICE_RANGE(tcp, 5439, ( 2001:1af8:4020:b030::/64 ))'
 335                         }
 336                 }
 337                 default: {}
 338         }
 339         # vpn fu
 340         case $::hostname {
 341                 draghi: {
 342                         @ferm::rule { 'dsa-vpn':
 343                                 description     => 'Allow openvpn access',
 344                                 rule            => '&SERVICE(udp, 17257)'
 345                         }
 346                         @ferm::rule { 'dsa-routing':
 347                                 description     => 'forward chain',
 348                                 chain           => 'FORWARD',
 349                                 rule            => 'policy ACCEPT;
 350 mod state state (ESTABLISHED RELATED) ACCEPT;
 351 interface tun+ ACCEPT;
 352 REJECT reject-with icmp-admin-prohibited
 353 '
 354                         }
 355                         @ferm::rule { 'dsa-vpn-mark':
 356                                 table           => 'mangle',
 357                                 chain           => 'PREROUTING',
 358                                 rule            => 'interface tun+ MARK set-mark 1',
 359                         }
 360                         @ferm::rule { 'dsa-vpn-nat':
 361                                 table           => 'nat',
 362                                 chain           => 'POSTROUTING',
 363                                 rule            => 'outerface !tun+ mod mark mark 1 MASQUERADE',
 364                         }
 365                 }
 366                 ubc-enc2bl01,ubc-enc2bl02,ubc-enc2bl09,ubc-enc2bl10: {
 367                         @ferm::rule { 'dsa-luca-fixme':
 368                                 description     => 'Allow ssh access from mnt and vpn networks',
 369                                 rule            => '&SERVICE_RANGE(tcp, 22, ( 172.29.40.0/22 172.29.203.0/24 ))',
 370                         }
 371                 }
 372                 default: {}
 373         }
 374         # tftp
 375         case $::hostname {
 376                 abel: {
 377                         @ferm::rule { 'dsa-tftp':
 378                                 description     => 'Allow tftp access',
 379                                 rule            => '&SERVICE_RANGE(udp, 69, ( 172.28.17.0/24 ))'
 380                         }
 381                 }
 382                 master: {
 383                         @ferm::rule { 'dsa-tftp':
 384                                 description     => 'Allow tftp access',
 385                                 rule            => '&SERVICE_RANGE(udp, 69, ( 82.195.75.64/26 192.168.43.0/24 ))'
 386                         }
 387                 }
 388         }
 389 }