host_firewall: block Spamhaus DROP, DROPv6 and ASN-DROP networks in, out and forward

2026-10-24 14:31:00 +00:00
parent 5e544cdfb5
commit ebb1377470
6 changed files with 289 additions and 3 deletions
@@ -54,6 +54,12 @@ firewall:
    # Lets the kernel log the nft log statements of container network
    # namespaces (LXC guests) into the host kernel log.
    all_netns: false
+    # Shared by the Spamhaus drop (fw-spamhaus-in: ) and reject (fw-spamhaus-out: ) chains, one limit each.
+    spamhaus_rate: "6/minute burst 10 packets"
+  # Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
+  # (input, forward), traffic to them is rejected (output, forward). The sets
+  # are refreshed daily by nft-host-spamhaus.
+  spamhaus: true
  # Reject outbound TCP 25; the mail group turns it off.
  block_smtp_out: true
  # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo