github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

DOC: remove excessive comments from firewall-cmd-direct-new

pull/396/head
Daniel Black 2013-10-14 22:39:38 +11:00
parent 0d8d1ae26c
commit 12f7ea7ec4
1 changed files with 8 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
config/action.d/firewall-cmd-direct-new.conf
View File

@ -1,79 +1,30 @@
# Fail2Ban configuration file # Fail2Ban configuration file
# #
# Author: Edgar Hoch, Cyril Jaquier # Author: Edgar Hoch
# Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch. # Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch.
# It uses "firewall-cmd" instead of "iptables". # It uses "firewall-cmd" instead of "iptables".
# firewall-cmd is based on the command of version firewalld-0.3.4-1.fc19 . # firewall-cmd is based on the command of version firewalld-0.3.4-1.fc19.
# iptables-new.conf copied from iptables.conf and modified by Yaroslav Halchenko
# to fullfill the needs of bugreporter dbts#350746.
#
# $Revision$
#
[Definition] [Definition]
# Option: actionstart
# Notes.: command executed once at the start of Fail2Ban.
# Values: CMD
#
## Old version of iptables-new.conf:
## actionstart = iptables -N fail2ban-<name>
## iptables -A fail2ban-<name> -j RETURN
## iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban-<name> actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban-<name>
firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 1000 -j RETURN firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 1000 -j RETURN
firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name> firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
# Option: actionstop # The following rule does not work, because firewalld keeps its own database of firewall rules.
# Notes.: command executed once at the end of Fail2Ban # firewall-cmd --direct --passthrough ipv4 -F fail2ban-<name>
# Values: CMD # The better rule would be the following, but firewall-cmd has not implemented this command with firewalld-0.3.3-2.fc19 .
# # firewall-cmd --direct --flush-chain ipv4 filter fail2ban-<name>
## Old version of iptables-new.conf: # The following is a workaround using a loop to implement the --flush-chain command.
## actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
## iptables -F fail2ban-<name>
## iptables -X fail2ban-<name>
# The following rule does not work, because firewalld keeps its own database of firewall rules.
# firewall-cmd --direct --passthrough ipv4 -F fail2ban-<name>
# The better rule would be the following,
# but firewall-cmd has not implemented this command with firewalld-0.3.3-2.fc19 .
# firewall-cmd --direct --flush-chain ipv4 filter fail2ban-<name>
# The following is a workaround using a loop to implement the --flush-chain command.
actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name> actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
( IFS='|' ; for r in $( firewall-cmd --direct --get-rules ipv4 filter fail2ban-<name> | tr '\n' '|' ) ; do eval firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> $r ; done ) ( IFS='|' ; for r in $( firewall-cmd --direct --get-rules ipv4 filter fail2ban-<name> | tr '\n' '|' ) ; do eval firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> $r ; done )
firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name> firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name>
# Option: actioncheck
# Notes.: command executed once before each actionban command
# Values: CMD
#
## Old version of iptables-new.conf:
## actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'fail2ban-<name>[ \t]' actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'fail2ban-<name>[ \t]'
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
## Old version of iptables-new.conf:
## actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
actionban = firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j DROP actionban = firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j DROP
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
## Old version of iptables-new.conf:
## actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
actionunban = firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j DROP actionunban = firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j DROP
[Init] [Init]