puppet allow node rules

node default{
  @@firewall { "200 Allow agent ${hostname} to connect to master":
    tag     => "puppet_agent",
    chain   => 'INPUT',
    proto   => 'tcp',
    state   => 'NEW',
    source  => $ipaddress,
    dport   => ['8140','61613'],
    action  => 'accept',
  }
}
node 'puppet.domain.tld' {
  Firewall <<| tag == "puppet_agent" |>>
}