I think puppetmaster variable doesn't exist and just @fqdn is used.
So why not just using:
allow <%= @fqdn %> ???