|
|
@ -18,22 +18,22 @@ before = firewallcmd-common.conf
|
|
|
|
|
|
|
|
|
|
|
|
[Definition]
|
|
|
|
[Definition]
|
|
|
|
|
|
|
|
|
|
|
|
actionstart = <ipstype_<ipsettype>/actionstart>
|
|
|
|
actionstart = <ipsbackend_<ipsetbackend>/actionstart>
|
|
|
|
firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
|
|
|
|
firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
|
|
|
|
|
|
|
|
|
|
|
|
actionflush = <ipstype_<ipsettype>/actionflush>
|
|
|
|
actionflush = <ipsbackend_<ipsetbackend>/actionflush>
|
|
|
|
|
|
|
|
|
|
|
|
actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
|
|
|
|
actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
|
|
|
|
<actionflush>
|
|
|
|
<actionflush>
|
|
|
|
<ipstype_<ipsettype>/actionstop>
|
|
|
|
<ipsbackend_<ipsetbackend>/actionstop>
|
|
|
|
|
|
|
|
|
|
|
|
actionban = <ipstype_<ipsettype>/actionban>
|
|
|
|
actionban = <ipsbackend_<ipsetbackend>/actionban>
|
|
|
|
|
|
|
|
|
|
|
|
# actionprolong = %(actionban)s
|
|
|
|
# actionprolong = %(actionban)s
|
|
|
|
|
|
|
|
|
|
|
|
actionunban = <ipstype_<ipsettype>/actionunban>
|
|
|
|
actionunban = <ipsbackend_<ipsetbackend>/actionunban>
|
|
|
|
|
|
|
|
|
|
|
|
[ipstype_ipset]
|
|
|
|
[ipsbackend_ipset]
|
|
|
|
|
|
|
|
|
|
|
|
actionstart = ipset -exist create <ipmset> hash:ip timeout <default-ipsettime> maxelem <maxelem> <familyopt>
|
|
|
|
actionstart = ipset -exist create <ipmset> hash:ip timeout <default-ipsettime> maxelem <maxelem> <familyopt>
|
|
|
|
|
|
|
|
|
|
|
@ -45,7 +45,7 @@ actionban = ipset -exist add <ipmset> <ip> timeout <ipsettime>
|
|
|
|
|
|
|
|
|
|
|
|
actionunban = ipset -exist del <ipmset> <ip>
|
|
|
|
actionunban = ipset -exist del <ipmset> <ip>
|
|
|
|
|
|
|
|
|
|
|
|
[ipstype_firewalld]
|
|
|
|
[ipsbackend_firewalld]
|
|
|
|
|
|
|
|
|
|
|
|
actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> --option=maxelem=<maxelem> <firewalld_familyopt>
|
|
|
|
actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> --option=maxelem=<maxelem> <firewalld_familyopt>
|
|
|
|
|
|
|
|
|
|
|
@ -87,11 +87,11 @@ maxelem = 65536
|
|
|
|
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
|
|
|
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
|
|
|
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
|
|
|
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
|
|
|
|
|
|
|
|
|
|
|
# Option: ipsettype
|
|
|
|
# Option: ipsetbackend
|
|
|
|
# Notes.: defines type of ipset used for match-set (firewalld or ipset)
|
|
|
|
# Notes.: defines the backend of ipset used for match-set (firewalld or ipset)
|
|
|
|
# Values: firewalld or ipset
|
|
|
|
# Values: firewalld or ipset
|
|
|
|
# Default: ipset
|
|
|
|
# Default: ipset
|
|
|
|
ipsettype = ipset
|
|
|
|
ipsetbackend = ipset
|
|
|
|
|
|
|
|
|
|
|
|
# Option: actiontype
|
|
|
|
# Option: actiontype
|
|
|
|
# Notes.: defines additions to the blocking rule
|
|
|
|
# Notes.: defines additions to the blocking rule
|
|
|
|