github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity
fail2ban/config/action.d/iptables-ipset.conf

97 lines
2.7 KiB
Plaintext
Raw Normal View History

replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
# Fail2Ban configuration file
#
# Authors: Sergey G Brester (sebres), Daniel Black, Alexander Koeppe
#
# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
# Use ipset -V to see the protocol and version. Version 4 should use
# iptables-ipset-proto4.conf.
#
# This requires the program ipset which is normally in package called ipset.
#
# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
#
# If you are running on an older kernel you make need to patch in external
# modules.
#
[INCLUDES]
before = iptables.conf
[Definition]
# Option: actionstart
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values: CMD
#
action.d/*ipset*: make maxelem ipset option configurable through banaction arguments - previously there was no way to override this value and ipsets would stop being updated when full (Hash is full, cannot add more elements) - preserve ipset's default value of 65536 - update tests - Closes #3549
2023-08-23 10:08:03 +00:00
actionstart = ipset -exist create <ipmset> hash:ip timeout <default-ipsettime> maxelem <maxelem> <familyopt>
iptables and iptables-ipset actions extended to support multiple protocols with single action for multiport or oneport type (back-ported from nftables action); amend to gh-980 fixing several actions (correctly supporting new enhancements now)
2022-01-26 20:51:11 +00:00
<_ipt_add_rules>
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
# Option: actionflush
# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
# Values: CMD
#
actionflush = ipset flush <ipmset>
# Option: actionstop
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
# Values: CMD
#
iptables and iptables-ipset actions extended to support multiple protocols with single action for multiport or oneport type (back-ported from nftables action); amend to gh-980 fixing several actions (correctly supporting new enhancements now)
2022-01-26 20:51:11 +00:00
actionstop = <_ipt_del_rules>
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
<actionflush>
ipset destroy <ipmset>
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
make ipset actions more breakdown-safe: start wouldn't fail if set with this name already exists (e. g. created by previous instance and don't deleted properly)
2022-01-24 21:56:16 +00:00
actionban = ipset -exist add <ipmset> <ip> timeout <ipsettime>
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
Merge remote-tracking branch 'remotes/sebres/1.0-breakdown-safe-actions' with master; conflicts resolved
2022-01-24 21:30:33 +00:00
# actionprolong = %(actionban)s
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
make ipset actions more breakdown-safe: start wouldn't fail if set with this name already exists (e. g. created by previous instance and don't deleted properly)
2022-01-24 21:56:16 +00:00
actionunban = ipset -exist del <ipmset> <ip>
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
[DATALAD RUNCMD] run codespell throughout fixing typo automagically === Do not change lines below === { "chain": [], "cmd": "codespell -w", "exit": 0, "extra_inputs": [], "inputs": [], "outputs": [], "pwd": "." } ^^^ Do not change lines above ^^^
2023-11-18 15:04:04 +00:00
# Several capabilities used internally:
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
rule-jump = -m set --match-set <ipmset> src -j <blocktype>
[Init]
Merge remote-tracking branch 'remotes/sebres/1.0-breakdown-safe-actions' with master; conflicts resolved
2022-01-24 21:30:33 +00:00
# Option: default-ipsettime
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
# Notes: specifies default timeout in seconds (handled default ipset timeout only)
Merge remote-tracking branch 'remotes/sebres/1.0-breakdown-safe-actions' with master; conflicts resolved
2022-01-24 21:30:33 +00:00
# Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban)
default-ipsettime = 0
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
Merge remote-tracking branch 'remotes/sebres/1.0-breakdown-safe-actions' with master; conflicts resolved
2022-01-24 21:30:33 +00:00
# Option: ipsettime
# Notes: specifies ticket timeout (handled ipset timeout only)
# Values: [ NUM ] Default: 0 (managed by fail2ban by unban)
ipsettime = 0
action.d/*ipset*: make maxelem ipset option configurable through banaction arguments - previously there was no way to override this value and ipsets would stop being updated when full (Hash is full, cannot add more elements) - preserve ipset's default value of 65536 - update tests - Closes #3549
2023-08-23 10:08:03 +00:00
# Option: maxelem
# Notes: maximal number of elements which can be stored in the ipset
# You may want to increase this for long-duration/high-volume jails
# Values: [ NUM ] Default: 65536
maxelem = 65536
[DATALAD RUNCMD] run codespell throughout fixing typo automagically === Do not change lines below === { "chain": [], "cmd": "codespell -w", "exit": 0, "extra_inputs": [], "inputs": [], "outputs": [], "pwd": "." } ^^^ Do not change lines above ^^^
2023-11-18 15:04:04 +00:00
# expression to calculate timeout from bantime, example:
Merge remote-tracking branch 'remotes/sebres/1.0-breakdown-safe-actions' with master; conflicts resolved
2022-01-24 21:30:33 +00:00
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
replace internals of several iptables-ipset actions using internals of iptables include: - better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now); - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters); - tests adjusted.
2020-01-17 07:56:15 +00:00
ipmset = f2b-<name>
familyopt =
[Init?family=inet6]
ipmset = f2b-<name>6
Merge remote-tracking branch 'remotes/sebres/1.0-breakdown-safe-actions' with master; conflicts resolved
2022-01-24 21:30:33 +00:00
familyopt = family inet6