Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: ban firehol level2, bruteforceblocker, vxvault and cybercrime; greensnow is part of level2

Browse Source
This commit is contained in:
Ruakij
2026-11-05 13:25:48 +00:00
parent ce851f59c6
commit 6a1e7b77e7
9 changed files with 127 additions and 269 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/host.nft.j2
+18 -13
View File
@@ -86,9 +86,6 @@ include "/etc/nftables.d/host-firehol.nft"
{% if firewall.scanners %}
include "/etc/nftables.d/host-scanners.nft"
{% endif %}
{% if firewall.greensnow %}
include "/etc/nftables.d/host-greensnow.nft"
{% endif %}
table inet host {
{{ addr_set('admin_v4', 'ipv4_addr', firewall.admin.v4) }}
@@ -173,6 +170,8 @@ table inet host {
{% endif %}
{% if firewall.firehol %}
ip saddr @firehol_v4 jump firehol_in
ip saddr @firehol_level2_v4 jump firehol_in
ip saddr @malware_v4 jump firehol_in
{% endif %}
{% endif %}
@@ -193,10 +192,10 @@ table inet host {
ip6 saddr @scanners_v6 jump scanners_in
{% endif %}
{% if firewall.greensnow %}
{% if firewall.firehol %}
# After the established rule: only inbound connections of GreenSnow hosts drop.
ip saddr @greensnow_v4 jump greensnow_in
# After the established rule: only inbound connections of bruteforceblocker hosts drop.
ip saddr @bruteforceblocker_v4 jump bruteforceblocker_in
{% endif %}
ct state invalid jump drop_log
@@ -361,13 +360,13 @@ table inet host {
drop
}
{% endif %}
{% if firewall.greensnow %}
{% if firewall.firehol %}
# Own limit and prefix, so GreenSnow hits use up neither the fw-in-drop budget
# Own limit and prefix, so bruteforceblocker hits use up neither the fw-in-drop budget
# nor the one of the blocklists. CrowdSec whitelists the prefix: the listed
# hosts are known and need no decision.
chain greensnow_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-greensnow-in: "
chain bruteforceblocker_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-bruteforceblocker-in: "
drop
}
{% endif %}
@@ -385,6 +384,8 @@ table inet host {
{% if firewall.firehol %}
ip daddr @firehol_v4 jump firehol_out
ip daddr @firehol_level2_v4 jump firehol_out
ip daddr @malware_v4 jump firehol_out
{% endif %}
{% if firewall.block_smtp_out %}
@@ -448,7 +449,7 @@ table inet host {
ip6 saddr @geo_v6 accept
{% endif %}
}
{% if forward_guard or blocklists or firewall.scanners or firewall.greensnow or rl_forward or firewall.block_smtp_out %}
{% if forward_guard or blocklists or firewall.scanners or rl_forward or firewall.block_smtp_out %}
chain forward {
type filter hook forward priority filter; policy accept;
@@ -471,15 +472,19 @@ table inet host {
ip saddr @firehol_v4 jump firehol_in
ip daddr @firehol_v4 jump firehol_out
ip saddr @firehol_level2_v4 jump firehol_in
ip daddr @firehol_level2_v4 jump firehol_out
ip saddr @malware_v4 jump firehol_in
ip daddr @malware_v4 jump firehol_out
{% endif %}
{% if firewall.scanners %}
ct state new ip saddr @scanners_v4 jump scanners_in
ct state new ip6 saddr @scanners_v6 jump scanners_in
{% endif %}
{% if firewall.greensnow %}
{% if firewall.firehol %}
ct state new ip saddr @greensnow_v4 jump greensnow_in
ct state new ip saddr @bruteforceblocker_v4 jump bruteforceblocker_in
{% endif %}
{% for guard in forward_guard %}