mirror of https://github.com/fail2ban/fail2ban
Instead of allow-iptables-multiport actions swap blocktype and (new) returntype
Viktor Szépe
parent
5d60700c0c
commit
5b7e1de2f4
|
|
@ -1,59 +0,0 @@
|
|||
# Fail2Ban configuration file for allowing hosts
|
||||
#
|
||||
# WARNING
|
||||
# Please be aware that all users behind NAT will access the service on the specified port.
|
||||
# You should protect this service with another jail that has very long bantime.
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N f2b-<name>
|
||||
iptables -A f2b-<name> -j <blocktype>
|
||||
iptables -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
|
||||
iptables -F f2b-<name>
|
||||
iptables -X f2b-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = iptables -I f2b-<name> 1 -s <ip> -j <allowtype>
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = iptables -D f2b-<name> -s <ip> -j <allowtype>
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: allowtype
|
||||
# Notes: ACCEPT skips other chains
|
||||
# Value: [ RETURN | ACCEPT ]
|
||||
#
|
||||
allowtype = RETURN
|
||||
|
||||
# Author: Viktor Szépe
|
||||
|
|
@ -18,7 +18,7 @@ before = iptables-common.conf
|
|||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N f2b-<name>
|
||||
iptables -A f2b-<name> -j RETURN
|
||||
iptables -A f2b-<name> -j <returntype>
|
||||
iptables -I <chain> -p <protocol> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
|
|
|
|||
|
|
@ -43,3 +43,9 @@ protocol = tcp
|
|||
# REJECT, REJECT --reject-with icmp-port-unreachable
|
||||
# Values: STRING
|
||||
blocktype = REJECT --reject-with icmp-port-unreachable
|
||||
|
||||
# Option: returntype
|
||||
# Note: This is the default rule on "actionstart". This should be RETURN
|
||||
# in all (blocking) actions, except REJECT in allowing actions.
|
||||
# Values: STRING
|
||||
returntype = RETURN
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ before = iptables-common.conf
|
|||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N f2b-<name>
|
||||
iptables -A f2b-<name> -j RETURN
|
||||
iptables -A f2b-<name> -j <returntype>
|
||||
iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
|
||||
iptables -N f2b-<name>-log
|
||||
iptables -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ before = iptables-common.conf
|
|||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N f2b-<name>
|
||||
iptables -A f2b-<name> -j RETURN
|
||||
iptables -A f2b-<name> -j <returntype>
|
||||
iptables -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ before = iptables-common.conf
|
|||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N f2b-<name>
|
||||
iptables -A f2b-<name> -j RETURN
|
||||
iptables -A f2b-<name> -j <returntype>
|
||||
iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ before = iptables-common.conf
|
|||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N f2b-<name>
|
||||
iptables -A f2b-<name> -j RETURN
|
||||
iptables -A f2b-<name> -j <returntype>
|
||||
iptables -I <chain> -p <protocol> --dport <port> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
|
|
|
|||
|
|
@ -772,7 +772,9 @@ maxretry = 1
|
|||
# allow FTP traffic after successful HTTP auth
|
||||
enabled = false
|
||||
filter = apache-pass
|
||||
banaction = allow-iptables-multiport
|
||||
banaction = iptables-multiport
|
||||
blocktype = RETURN
|
||||
returntype = DROP
|
||||
# access log of the website with HTTP auth
|
||||
logpath = /var/log/apache2/access.log
|
||||
port = ftp,ftp-data,ftps,ftps-data
|
||||
|
|
|
|||
Loading…
Reference in New Issue