github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

`action.d/firewallcmd-ipset.conf`: rename `ipsettype` to `ipsetbackend` (`ipsettype` will be used now to the real set type); 

amend to #2620
pull/3776/head
sebres 2024-06-09 23:32:03 +02:00
parent 304c3cd566
commit 17daf0ec78
2 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -18,6 +18,8 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
* `paths-debian.conf`: * `paths-debian.conf`:
- default banactions are `nftables` - default banactions are `nftables`
- sshd backend switched to `systemd` (gh-3292) - sshd backend switched to `systemd` (gh-3292)
* `action.d/firewallcmd-ipset.conf`:
- rename `ipsettype` to `ipsetbackend` (gh-2620), parameter `ipsettype` will be used now to the real set type (gh-3760)
### New Features and Enhancements ### New Features and Enhancements

20
config/action.d/firewallcmd-ipset.conf
View File

@ -18,22 +18,22 @@ before = firewallcmd-common.conf
[Definition] [Definition]
actionstart = <ipstype_<ipsettype>/actionstart> actionstart = <ipsbackend_<ipsetbackend>/actionstart>
firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype> firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
actionflush = <ipstype_<ipsettype>/actionflush> actionflush = <ipsbackend_<ipsetbackend>/actionflush>
actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype> actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
<actionflush> <actionflush>
<ipstype_<ipsettype>/actionstop> <ipsbackend_<ipsetbackend>/actionstop>
actionban = <ipstype_<ipsettype>/actionban> actionban = <ipsbackend_<ipsetbackend>/actionban>
# actionprolong = %(actionban)s # actionprolong = %(actionban)s
actionunban = <ipstype_<ipsettype>/actionunban> actionunban = <ipsbackend_<ipsetbackend>/actionunban>
[ipstype_ipset] [ipsbackend_ipset]
actionstart = ipset -exist create <ipmset> hash:ip timeout <default-ipsettime> maxelem <maxelem> <familyopt> actionstart = ipset -exist create <ipmset> hash:ip timeout <default-ipsettime> maxelem <maxelem> <familyopt>
@ -45,7 +45,7 @@ actionban = ipset -exist add <ipmset> <ip> timeout <ipsettime>
actionunban = ipset -exist del <ipmset> <ip> actionunban = ipset -exist del <ipmset> <ip>
[ipstype_firewalld] [ipsbackend_firewalld]
actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> --option=maxelem=<maxelem> <firewalld_familyopt> actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> --option=maxelem=<maxelem> <firewalld_familyopt>
@ -87,11 +87,11 @@ maxelem = 65536
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>'] # banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0) timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
# Option: ipsettype # Option: ipsetbackend
# Notes.: defines type of ipset used for match-set (firewalld or ipset) # Notes.: defines the backend of ipset used for match-set (firewalld or ipset)
# Values: firewalld or ipset # Values: firewalld or ipset
# Default: ipset # Default: ipset
ipsettype = ipset ipsetbackend = ipset
# Option: actiontype # Option: actiontype
# Notes.: defines additions to the blocking rule # Notes.: defines additions to the blocking rule