Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: ban firehol level2, bruteforceblocker, vxvault and cybercrime; greensnow is part of level2

Browse Source
This commit is contained in:
Ruakij
2026-11-05 13:25:48 +00:00
parent ce851f59c6
commit 6a1e7b77e7
9 changed files with 127 additions and 269 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/defaults/main.yml
+9 -13
View File
@@ -93,17 +93,20 @@ firewall:
# Lets the kernel log the nft log statements of container network
# namespaces (LXC guests) into the host kernel log.
all_netns: false
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ), scanner (fw-scanners-in: ) and
# GreenSnow (fw-greensnow-in: ) chains, one limit each.
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ), bruteforceblocker (fw-bruteforceblocker-in: ) and scanner (fw-scanners-in: ) chains,
# one limit each.
spamhaus_rate: "6/minute burst 10 packets"
# Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
# (input, forward), traffic to them is rejected (output, forward). The sets
# are refreshed daily by nft-host-spamhaus.
spamhaus: true
# FireHOL level1 (IPv4): treated like the Spamhaus lists, with the prefixes
# fw-firehol-in: and fw-firehol-out: and the same log limit. Entries in
# private or reserved space and ones holding an address of the host are left
# out. Refreshed daily by nft-host-firehol.
# FireHOL lists (IPv4 only, FireHOL has no IPv6 lists), from github.com/firehol/blocklist-ipsets:
# - level1 and level2 (level2 includes GreenSnow) and the malware set (vxvault and cybercrime): treated like the
# Spamhaus lists, with the prefixes fw-firehol-in: and fw-firehol-out: and the same log limit.
# - bruteforceblocker: inbound new connections from the listed hosts drop, outbound traffic is not filtered. Log
# prefix fw-bruteforceblocker-in: with its own limit, which CrowdSec whitelists.
# Entries in private or reserved space and ones holding an address of the host are left out. All sets are refreshed
# daily by nft-host-firehol.
firehol: true
# Internet-wide scanners (Censys, Shodan, ONYPHE, Shadowserver, ...), IPv4
# and IPv6: the cidr files of github.com/OpenFilters/internet-scanners
@@ -115,13 +118,6 @@ firewall:
# of any host, and ones holding an address of the host are left out
# (/etc/nft-host-scanners.allowlist). Refreshed daily by nft-host-scanners.
scanners: true
# GreenSnow (IPv4 single addresses, compromised and dynamic hosts from the
# FireHOL blocklist-ipsets): inbound new connections from the listed hosts
# drop, outbound traffic is not filtered. Log prefix fw-greensnow-in: with its
# own limit, which CrowdSec whitelists. Entries in private or reserved space
# and ones holding an address of the host are left out. Refreshed daily by
# nft-host-greensnow.
greensnow: true
# Reject outbound TCP 25; the mail group turns it off.
block_smtp_out: true
# EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo