host_firewall: GreenSnow set greensnow_v4 drops inbound new connections of the listed hosts

host_firewall/defaults/main.yml

@@ -83,7 +83,8 @@ firewall:
     # Lets the kernel log the nft log statements of container network
     # namespaces (LXC guests) into the host kernel log.
     all_netns: false
-    # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ) and scanner (fw-scanners-in: ) chains, one limit each.
+    # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ), scanner (fw-scanners-in: ) and
+    # GreenSnow (fw-greensnow-in: ) chains, one limit each.
     spamhaus_rate: "6/minute burst 10 packets"
   # Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
   # (input, forward), traffic to them is rejected (output, forward). The sets
@@ -104,6 +105,13 @@ firewall:
   # of any host, and ones holding an address of the host are left out
   # (/etc/nft-host-scanners.allowlist). Refreshed daily by nft-host-scanners.
   scanners: true
+  # GreenSnow (IPv4 single addresses, compromised and dynamic hosts from the
+  # FireHOL blocklist-ipsets): inbound new connections from the listed hosts
+  # drop, outbound traffic is not filtered. Log prefix fw-greensnow-in: with its
+  # own limit, which CrowdSec whitelists. Entries in private or reserved space
+  # and ones holding an address of the host are left out. Refreshed daily by
+  # nft-host-greensnow.
+  greensnow: true
   # Reject outbound TCP 25; the mail group turns it off.
   block_smtp_out: true
   # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo