Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: log FireHOL level1 and level2 under separate prefixes fw-firehol1-* and fw-firehol2-*

Browse Source
This commit is contained in:
Ruakij
2026-11-05 16:57:33 +00:00
parent 1d10f2be39
commit 252c703afd
2 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/defaults/main.yml
+4 -4
View File
@@ -93,16 +93,16 @@ firewall:
# Lets the kernel log the nft log statements of container network # Lets the kernel log the nft log statements of container network
# namespaces (LXC guests) into the host kernel log. # namespaces (LXC guests) into the host kernel log.
all_netns: false all_netns: false
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ) and scanner (fw-scanners-in: ) chains, # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL level1 (fw-firehol1-in: , fw-firehol1-out: ),
# one limit each. # FireHOL level2 (fw-firehol2-in: , fw-firehol2-out: ) and scanner (fw-scanners-in: ) chains, one limit each.
spamhaus_rate: "6/minute burst 10 packets" spamhaus_rate: "6/minute burst 10 packets"
# Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops # Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
# (input, forward), traffic to them is rejected (output, forward). The sets # (input, forward), traffic to them is rejected (output, forward). The sets
# are refreshed daily by nft-host-spamhaus. # are refreshed daily by nft-host-spamhaus.
spamhaus: true spamhaus: true
# FireHOL lists (IPv4 only, FireHOL has no IPv6 lists), from github.com/firehol/blocklist-ipsets: # FireHOL lists (IPv4 only, FireHOL has no IPv6 lists), from github.com/firehol/blocklist-ipsets:
# level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol-in: # level1 and level2 (level2 includes GreenSnow): treated like the Spamhaus lists, with the prefixes fw-firehol1-in: ,
# and fw-firehol-out: and the same log limit. # fw-firehol1-out: (level1) and fw-firehol2-in: , fw-firehol2-out: (level2) and the same log limit.
# Entries in private or reserved space and ones holding an address of the host are left out. Both sets are refreshed # Entries in private or reserved space and ones holding an address of the host are left out. Both sets are refreshed
# daily by nft-host-firehol. # daily by nft-host-firehol.
firehol: true firehol: true
host_firewall/templates/host.nft.j2
+22 -12
View File
@@ -169,8 +169,8 @@ table inet host {
ip6 saddr @spamhaus_v6 jump spamhaus_in ip6 saddr @spamhaus_v6 jump spamhaus_in
{% endif %} {% endif %}
{% if firewall.firehol %} {% if firewall.firehol %}
ip saddr @firehol_v4 jump firehol_in ip saddr @firehol_v4 jump firehol1_in
ip saddr @firehol_level2_v4 jump firehol_in ip saddr @firehol_level2_v4 jump firehol2_in
{% endif %} {% endif %}
{% endif %} {% endif %}
@@ -333,13 +333,23 @@ table inet host {
{% endif %} {% endif %}
{% if firewall.firehol %} {% if firewall.firehol %}
chain firehol_in { chain firehol1_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol-in: " limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol1-in: "
drop drop
} }
chain firehol_out { chain firehol1_out {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol-out: " limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol1-out: "
reject
}
chain firehol2_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol2-in: "
drop
}
chain firehol2_out {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-firehol2-out: "
reject reject
} }
{% endif %} {% endif %}
@@ -366,8 +376,8 @@ table inet host {
{% endif %} {% endif %}
{% if firewall.firehol %} {% if firewall.firehol %}
ip daddr @firehol_v4 jump firehol_out ip daddr @firehol_v4 jump firehol1_out
ip daddr @firehol_level2_v4 jump firehol_out ip daddr @firehol_level2_v4 jump firehol2_out
{% endif %} {% endif %}
{% if firewall.block_smtp_out %} {% if firewall.block_smtp_out %}
@@ -452,10 +462,10 @@ table inet host {
{% endif %} {% endif %}
{% if firewall.firehol %} {% if firewall.firehol %}
ip saddr @firehol_v4 jump firehol_in ip saddr @firehol_v4 jump firehol1_in
ip daddr @firehol_v4 jump firehol_out ip daddr @firehol_v4 jump firehol1_out
ip saddr @firehol_level2_v4 jump firehol_in ip saddr @firehol_level2_v4 jump firehol2_in
ip daddr @firehol_level2_v4 jump firehol_out ip daddr @firehol_level2_v4 jump firehol2_out
{% endif %} {% endif %}
{% if firewall.scanners %} {% if firewall.scanners %}