From 252c703afd273c625c0d8151cc2f3c3ec6c006fe Mon Sep 17 00:00:00 2001 From: Ruakij Date: Thu, 5 Nov 2026 16:57:33 +0000 Subject: [PATCH] host_firewall: log FireHOL level1 and level2 under separate prefixes fw-firehol1-* and fw-firehol2-* --- host_firewall/defaults/main.yml | 8 +++---- host_firewall/templates/host.nft.j2 | 34 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 16 deletions(-) diff --git a/host_firewall/defaults/main.yml b/host_firewall/defaults/main.yml index a287ba6..ab2bd2d 100644 --- a/host_firewall/defaults/main.yml +++ b/host_firewall/defaults/main.yml @@ -93,16 +93,16 @@ firewall: # Lets the kernel log the nft log statements of container network # namespaces (LXC guests) into the host kernel log. all_netns: false - # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ) and scanner (fw-scanners-in: ) chains, - # one limit each. + # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL level1 (fw-firehol1-in: , fw-firehol1-out: ), + # FireHOL level2 (fw-firehol2-in: , fw-firehol2-out: ) and scanner (fw-scanners-in: ) chains, one limit each. spamhaus_rate: "6/minute burst 10 packets" # Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops # (input, forward), traffic to them is rejected (output, forward). The sets # are refreshed daily by nft-host-spamhaus. spamhaus: true # FireHOL lists (IPv4 only, FireHOL has no IPv6 lists), from github.com/firehol/blocklist-ipsets: - # level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol-in: - # and fw-firehol-out: and the same log limit. + # level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol1-in: , + # fw-firehol1-out: (level1) and fw-firehol2-in: , fw-firehol2-out: (level2) and the same log limit. # Entries in private or reserved space and ones holding an address of the host are left out. Both sets are refreshed # daily by nft-host-firehol. firehol: true diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2 index 6e3cf98..4614936 100644 --- a/host_firewall/templates/host.nft.j2 +++ b/host_firewall/templates/host.nft.j2 @@ -169,8 +169,8 @@ table inet host { ip6 saddr @spamhaus_v6 jump spamhaus_in {% endif %} {% if firewall.firehol %} - ip saddr @firehol_v4 jump firehol_in - ip saddr @firehol_level2_v4 jump firehol_in + ip saddr @firehol_v4 jump firehol1_in + ip saddr @firehol_level2_v4 jump firehol2_in {% endif %} {% endif %} @@ -333,13 +333,23 @@ table inet host { {% endif %} {% if firewall.firehol %} - chain firehol_in { - limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol-in: " + chain firehol1_in { + limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol1-in: " drop } - chain firehol_out { - limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol-out: " + chain firehol1_out { + limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol1-out: " + reject + } + + chain firehol2_in { + limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol2-in: " + drop + } + + chain firehol2_out { + limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol2-out: " reject } {% endif %} @@ -366,8 +376,8 @@ table inet host { {% endif %} {% if firewall.firehol %} - ip daddr @firehol_v4 jump firehol_out - ip daddr @firehol_level2_v4 jump firehol_out + ip daddr @firehol_v4 jump firehol1_out + ip daddr @firehol_level2_v4 jump firehol2_out {% endif %} {% if firewall.block_smtp_out %} @@ -452,10 +462,10 @@ table inet host { {% endif %} {% if firewall.firehol %} - ip saddr @firehol_v4 jump firehol_in - ip daddr @firehol_v4 jump firehol_out - ip saddr @firehol_level2_v4 jump firehol_in - ip daddr @firehol_level2_v4 jump firehol_out + ip saddr @firehol_v4 jump firehol1_in + ip daddr @firehol_v4 jump firehol1_out + ip saddr @firehol_level2_v4 jump firehol2_in + ip daddr @firehol_level2_v4 jump firehol2_out {% endif %} {% if firewall.scanners %}