github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #1908 from GetPageSpeed/firewallcmd-ipset-allports 

New ban mode `allports` for `firewallcmd-ipset`. Closes #1167
pull/2014/head
Serg G. Brester 2018-01-10 11:43:44 +01:00 committed by GitHub
parent 3d9a112c8f 131b94e11e
commit 597a27576e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -47,6 +47,7 @@ releases.
* filter.d/kerio.conf - filter extended with new rules (see gh-1455) * filter.d/kerio.conf - filter extended with new rules (see gh-1455)
* filter.d/phpmyadmin-syslog.conf - new filter for phpMyAdmin using syslog for auth logging * filter.d/phpmyadmin-syslog.conf - new filter for phpMyAdmin using syslog for auth logging
* filter.d/zoneminder.conf - new filter for ZoneMinder (gh-1376) * filter.d/zoneminder.conf - new filter for ZoneMinder (gh-1376)
* action.d/firewallcmd-ipset-allports.conf - new firewallcmd-ipset-allports action (gh-1167)
ver. 0.9.7 (2017/05/11) - awaiting-victory ver. 0.9.7 (2017/05/11) - awaiting-victory

21
config/action.d/firewallcmd-ipset.conf
View File

@ -19,9 +19,9 @@ before = iptables-common.conf
[Definition] [Definition]
actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime> actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype> firewall-cmd --direct --add-rule ipv4 filter <chain> 0 <actiontype> -m set --match-set fail2ban-<name> src -j <blocktype>
actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype> actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 <actiontype> -m set --match-set fail2ban-<name> src -j <blocktype>
ipset flush fail2ban-<name> ipset flush fail2ban-<name>
ipset destroy fail2ban-<name> ipset destroy fail2ban-<name>
@ -44,6 +44,23 @@ chain = INPUT_direct
bantime = 600 bantime = 600
# Option: actiontype
# Notes.: defines additions to the blocking rule
# Values: leave empty to block all attempts from the host
# Default: Value of the multiport
actiontype = <multiport>
# Option: allports
# Notes.: default addition to block all ports
# Usage.: use in jail config: banaction = firewallcmd-ipset[actiontype=<allports>]
# for all protocols: banaction = firewallcmd-ipset[actiontype=""]
allports = -p <protocol>
# Option: multiport
# Notes.: addition to block access only to specific ports
# Usage.: use in jail config: banaction = firewallcmd-ipset[actiontype=<multiport>]
multiport = -p <protocol> -m multiport --dports <port>
# DEV NOTES: # DEV NOTES:
# #