host_firewall: drop inbound traffic from internet-wide scanners (OpenFilters internet-scanners), v4 and v6, daily refresh

host_firewall/defaults/main.yml

@@ -54,7 +54,7 @@ firewall:
     # Lets the kernel log the nft log statements of container network
     # namespaces (LXC guests) into the host kernel log.
     all_netns: false
-    # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ) and FireHOL (fw-firehol-in: , fw-firehol-out: ) chains, one limit each.
+    # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ) and scanner (fw-scanners-in: ) chains, one limit each.
     spamhaus_rate: "6/minute burst 10 packets"
   # Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
   # (input, forward), traffic to them is rejected (output, forward). The sets
@@ -65,6 +65,16 @@ firewall:
   # private or reserved space and ones holding an address of the host are left
   # out. Refreshed daily by nft-host-firehol.
   firehol: true
+  # Internet-wide scanners (Censys, Shodan, ONYPHE, Shadowserver, ...), IPv4
+  # and IPv6: the cidr files of github.com/OpenFilters/internet-scanners
+  # (Unlicense). Inbound traffic from the listed networks drops (input,
+  # forward) once the established rule has passed; outbound traffic is never
+  # filtered. Log prefix fw-scanners-in: with the Spamhaus log limit, which
+  # CrowdSec whitelists. Entries in private or reserved space, overlapping the
+  # admin, scraper and cluster sets, the CrowdSec whitelist or the public_ips
+  # of any host, and ones holding an address of the host are left out
+  # (/etc/nft-host-scanners.allowlist). Refreshed daily by nft-host-scanners.
+  scanners: true
   # Reject outbound TCP 25; the mail group turns it off.
   block_smtp_out: true
   # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo