Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: log FireHOL level1 and level2 under separate prefixes fw-firehol1-* and fw-firehol2-*

Browse Source
This commit is contained in:
Ruakij
2026-11-05 16:57:33 +00:00
parent 1d10f2be39
commit 252c703afd
2 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/defaults/main.yml
+4 -4
View File
@@ -93,16 +93,16 @@ firewall:
# Lets the kernel log the nft log statements of container network
# namespaces (LXC guests) into the host kernel log.
all_netns: false
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ) and scanner (fw-scanners-in: ) chains,
# one limit each.
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL level1 (fw-firehol1-in: , fw-firehol1-out: ),
# FireHOL level2 (fw-firehol2-in: , fw-firehol2-out: ) and scanner (fw-scanners-in: ) chains, one limit each.
spamhaus_rate: "6/minute burst 10 packets"
# Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
# (input, forward), traffic to them is rejected (output, forward). The sets
# are refreshed daily by nft-host-spamhaus.
spamhaus: true
# FireHOL lists (IPv4 only, FireHOL has no IPv6 lists), from github.com/firehol/blocklist-ipsets:
# level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol-in:
# and fw-firehol-out: and the same log limit.
# level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol1-in: ,
# fw-firehol1-out: (level1) and fw-firehol2-in: , fw-firehol2-out: (level2) and the same log limit.
# Entries in private or reserved space and ones holding an address of the host are left out. Both sets are refreshed
# daily by nft-host-firehol.
firehol: true