host_firewall: log dropped inbound packets with a global rate limit and reject outbound TCP 25 except on the mail host

2026-10-24 12:14:47 +00:00
parent 41dbce3641
commit 88c30eb252
2 changed files with 35 additions and 4 deletions
@@ -45,6 +45,14 @@ firewall:
  # traffic to other addresses is not filtered.
  forward_guard: {}
  ssh_rate_limit: "10/minute burst 5 packets"
+  # Kernel log of dropped inbound packets (fw-in-drop: ) and of rejected
+  # outbound mail (fw-out-reject: ), read from the journal by CrowdSec. Each
+  # rate is one limit shared by all matching packets.
+  log:
+    in_rate: "5/second burst 30 packets"
+    out_rate: "6/minute burst 5 packets"
+  # Reject outbound TCP 25; the mail group turns it off.
+  block_smtp_out: true
  # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo
  # ports to the admin set; a load peaks at about 60 MB of kernel memory, too much for a 1 GB host.
  geo_countries: [at, be, bg, hr, cy, cz, dk, ee, fi, fr, de, gr, hu, ie, it, lv, lt, lu, mt, nl, pl, pt, ro, sk, si, es, se, ch, "no", gb, is, li]