Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: log FireHOL level1 and level2 under separate prefixes fw-firehol1-* and fw-firehol2-*

Browse Source
This commit is contained in:
Ruakij
2026-11-05 16:57:33 +00:00
parent 1d10f2be39
commit 252c703afd
2 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/defaults/main.yml
+4 -4
View File
@@ -93,16 +93,16 @@ firewall:
# Lets the kernel log the nft log statements of container network
# namespaces (LXC guests) into the host kernel log.
all_netns: false
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ) and scanner (fw-scanners-in: ) chains,
# one limit each.
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL level1 (fw-firehol1-in: , fw-firehol1-out: ),
# FireHOL level2 (fw-firehol2-in: , fw-firehol2-out: ) and scanner (fw-scanners-in: ) chains, one limit each.
spamhaus_rate: "6/minute burst 10 packets"
# Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
# (input, forward), traffic to them is rejected (output, forward). The sets
# are refreshed daily by nft-host-spamhaus.
spamhaus: true
# FireHOL lists (IPv4 only, FireHOL has no IPv6 lists), from github.com/firehol/blocklist-ipsets:
# level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol-in:
# and fw-firehol-out: and the same log limit.
# level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol1-in: ,
# fw-firehol1-out: (level1) and fw-firehol2-in: , fw-firehol2-out: (level2) and the same log limit.
# Entries in private or reserved space and ones holding an address of the host are left out. Both sets are refreshed
# daily by nft-host-firehol.
firehol: true
host_firewall/templates/host.nft.j2
+22 -12
View File
@@ -169,8 +169,8 @@ table inet host {
ip6 saddr @spamhaus_v6 jump spamhaus_in
{% endif %}
{% if firewall.firehol %}
ip saddr @firehol_v4 jump firehol_in
ip saddr @firehol_level2_v4 jump firehol_in
ip saddr @firehol_v4 jump firehol1_in
ip saddr @firehol_level2_v4 jump firehol2_in
{% endif %}
{% endif %}
@@ -333,13 +333,23 @@ table inet host {
{% endif %}
{% if firewall.firehol %}
chain firehol_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol-in: "
chain firehol1_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol1-in: "
drop
}
chain firehol_out {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol-out: "
chain firehol1_out {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol1-out: "
reject
}
chain firehol2_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol2-in: "
drop
}
chain firehol2_out {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol2-out: "
reject
}
{% endif %}
@@ -366,8 +376,8 @@ table inet host {
{% endif %}
{% if firewall.firehol %}
ip daddr @firehol_v4 jump firehol_out
ip daddr @firehol_level2_v4 jump firehol_out
ip daddr @firehol_v4 jump firehol1_out
ip daddr @firehol_level2_v4 jump firehol2_out
{% endif %}
{% if firewall.block_smtp_out %}
@@ -452,10 +462,10 @@ table inet host {
{% endif %}
{% if firewall.firehol %}
ip saddr @firehol_v4 jump firehol_in
ip daddr @firehol_v4 jump firehol_out
ip saddr @firehol_level2_v4 jump firehol_in
ip daddr @firehol_level2_v4 jump firehol_out
ip saddr @firehol_v4 jump firehol1_in
ip daddr @firehol_v4 jump firehol1_out
ip saddr @firehol_level2_v4 jump firehol2_in
ip daddr @firehol_level2_v4 jump firehol2_out
{% endif %}
{% if firewall.scanners %}