mirror of https://github.com/fail2ban/fail2ban
Merge branch 'ipsettype-in-ipset-actions'
sebres
commit
cd95c3a1fc
|
|
@ -18,8 +18,12 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
|
|||
* `paths-debian.conf`:
|
||||
- default banactions are `nftables`
|
||||
- sshd backend switched to `systemd` (gh-3292)
|
||||
* `action.d/firewallcmd-ipset.conf`:
|
||||
- rename `ipsettype` to `ipsetbackend` (gh-2620), parameter `ipsettype` will be used now to the real set type (gh-3760)
|
||||
|
||||
### New Features and Enhancements
|
||||
* `action.d/*-ipset.conf`:
|
||||
- parameter `ipsettype` to set type of ipset, e. g. hash:ip, hash:net, etc (gh-3760)
|
||||
|
||||
|
||||
ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km
|
||||
|
|
|
|||
|
|
@ -18,24 +18,24 @@ before = firewallcmd-common.conf
|
|||
|
||||
[Definition]
|
||||
|
||||
actionstart = <ipstype_<ipsettype>/actionstart>
|
||||
actionstart = <ipsbackend_<ipsetbackend>/actionstart>
|
||||
firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
|
||||
|
||||
actionflush = <ipstype_<ipsettype>/actionflush>
|
||||
actionflush = <ipsbackend_<ipsetbackend>/actionflush>
|
||||
|
||||
actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
|
||||
<actionflush>
|
||||
<ipstype_<ipsettype>/actionstop>
|
||||
<ipsbackend_<ipsetbackend>/actionstop>
|
||||
|
||||
actionban = <ipstype_<ipsettype>/actionban>
|
||||
actionban = <ipsbackend_<ipsetbackend>/actionban>
|
||||
|
||||
# actionprolong = %(actionban)s
|
||||
|
||||
actionunban = <ipstype_<ipsettype>/actionunban>
|
||||
actionunban = <ipsbackend_<ipsetbackend>/actionunban>
|
||||
|
||||
[ipstype_ipset]
|
||||
[ipsbackend_ipset]
|
||||
|
||||
actionstart = ipset -exist create <ipmset> hash:ip timeout <default-ipsettime> maxelem <maxelem> <familyopt>
|
||||
actionstart = ipset -exist create <ipmset> <ipsettype> timeout <default-ipsettime> maxelem <maxelem> <familyopt>
|
||||
|
||||
actionflush = ipset flush <ipmset>
|
||||
|
||||
|
|
@ -45,9 +45,9 @@ actionban = ipset -exist add <ipmset> <ip> timeout <ipsettime>
|
|||
|
||||
actionunban = ipset -exist del <ipmset> <ip>
|
||||
|
||||
[ipstype_firewalld]
|
||||
[ipsbackend_firewalld]
|
||||
|
||||
actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> --option=maxelem=<maxelem> <firewalld_familyopt>
|
||||
actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=<ipsettype> --option=timeout=<default-ipsettime> --option=maxelem=<maxelem> <firewalld_familyopt>
|
||||
|
||||
# TODO: there doesn't seem to be an explicit way to invoke the ipset flush function using firewall-cmd
|
||||
actionflush =
|
||||
|
|
@ -60,6 +60,11 @@ actionunban = firewall-cmd --ipset=<ipmset> --remove-entry=<ip>
|
|||
|
||||
[Init]
|
||||
|
||||
# Option: ipsettype
|
||||
# Notes: specifies type of set, see `man --pager='less -p "^SET TYPES"' ipset` for details
|
||||
# Values: hash:ip, hash:net, etc... Default: hash:ip
|
||||
ipsettype = hash:ip
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the fail2ban rules should be
|
||||
# added
|
||||
|
|
@ -87,11 +92,11 @@ maxelem = 65536
|
|||
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
||||
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
||||
|
||||
# Option: ipsettype
|
||||
# Notes.: defines type of ipset used for match-set (firewalld or ipset)
|
||||
# Option: ipsetbackend
|
||||
# Notes.: defines the backend of ipset used for match-set (firewalld or ipset)
|
||||
# Values: firewalld or ipset
|
||||
# Default: ipset
|
||||
ipsettype = ipset
|
||||
ipsetbackend = ipset
|
||||
|
||||
# Option: actiontype
|
||||
# Notes.: defines additions to the blocking rule
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ before = iptables.conf
|
|||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = ipset -exist create <ipmset> hash:ip timeout <default-ipsettime> maxelem <maxelem> <familyopt>
|
||||
actionstart = ipset -exist create <ipmset> <ipsettype> timeout <default-ipsettime> maxelem <maxelem> <familyopt>
|
||||
<_ipt_add_rules>
|
||||
|
||||
# Option: actionflush
|
||||
|
|
@ -66,6 +66,11 @@ rule-jump = -m set --match-set <ipmset> src -j <blocktype>
|
|||
|
||||
[Init]
|
||||
|
||||
# Option: ipsettype
|
||||
# Notes: specifies type of set, see `man --pager='less -p "^SET TYPES"' ipset` for details
|
||||
# Values: hash:ip, hash:net, etc... Default: hash:ip
|
||||
ipsettype = hash:ip
|
||||
|
||||
# Option: default-ipsettime
|
||||
# Notes: specifies default timeout in seconds (handled default ipset timeout only)
|
||||
# Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban)
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@
|
|||
# Values: CMD
|
||||
#
|
||||
actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
|
||||
then ipset -quiet -exist create f2b-<name> hash:ip timeout <default-ipsettime> maxelem <maxelem>;
|
||||
then ipset -quiet -exist create f2b-<name> <ipsettype> timeout <default-ipsettime> maxelem <maxelem>;
|
||||
fi
|
||||
|
||||
# Option: actionstop
|
||||
|
|
@ -94,6 +94,11 @@ timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
|||
|
||||
[Init]
|
||||
|
||||
# Option: ipsettype
|
||||
# Notes: specifies type of set, see `man --pager='less -p "^SET TYPES"' ipset` for details
|
||||
# Values: hash:ip, hash:net, etc... Default: hash:ip
|
||||
ipsettype = hash:ip
|
||||
|
||||
# Option: maxelem
|
||||
# Notes: maximal number of elements which can be stored in the ipset
|
||||
# You may want to increase this for long-duration/high-volume jails
|
||||
|
|
|
|||
Loading…
Reference in New Issue