Make an explicit iptables ssh chain

diff --git a/modules/ssh/manifests/init.pp b/modules/ssh/manifests/init.pp
index 367cae6..566a3f1 100644 (file)
--- a/modules/ssh/manifests/init.pp
+++ b/modules/ssh/manifests/init.pp
@@ -1,5 +1,4 @@
 class ssh {
-
        package { [ 'openssh-client', 'openssh-server']:
                ensure => installed
        }
@@ -9,14 +8,15 @@ class ssh {
                require => Package['openssh-server']
        }
 
-       ferm::rule { 'dsa-ssh':
-               description => 'Allow SSH from DSA',
-               rule        => '&SERVICE_RANGE(tcp, ssh, $SSH_SOURCES)'
+       ferm::rule::simple { 'dsa-ssh':
+               description => 'check ssh access',
+               port        => 'ssh',
+               target      => 'ssh',
        }
-       ferm::rule { 'dsa-ssh-v6':
+       ferm::rule { 'dsa-ssh-sources':
                description => 'Allow SSH from DSA',
-               domain      => 'ip6',
-               rule        => '&SERVICE_RANGE(tcp, ssh, $SSH_V6_SOURCES)'
+               chain       => 'ssh',
+               rule        => 'saddr ($SSH_SOURCES) ACCEPT'
        }
 
        file { '/etc/ssh/ssh_config':