The current role implementations do not include any kind of management of firewall (iptables) rules.

It is necessary to implement this functionality in order to have properly protected servers. The firewall should be implemented using '''ferm''' (http://ferm.foo-projects.org/), which allows for splitting-up the firewall rules into multiple files, where the files are subsequently combined in order to form the full iptables configuration.

This approach allows for easily splitting-up the deployment of firewall rules amongst the roles, with each role deploying the rules necessary for it to function.

The rules deployed should include the following:

* Role '''common''' (some basic hardening, drop packages by default, allow ssh logins, perform some kind of rate limiting)
* Each role deploying a specific server service should allow access to appropriate ports.