swellpath/puppet-icinga — comment on commit bdeb4bab9d85fb9621bf5824fe3f3b1b85003627
File:  line 0
By cwarden:

Yes, that's correct. If you're allowing connections from localhost, I figured you might as well connections from the machine to itself on the external IP address as well.

You could put the whitelist declaration into the master class as exported resource that each node collects.