Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: block Spamhaus DROP, DROPv6 and ASN-DROP networks in, out and forward

Browse Source
This commit is contained in:
Ruakij
2026-10-24 14:31:00 +00:00
parent 5e544cdfb5
commit ebb1377470
6 changed files with 289 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/host.nft.j2
+40 -2
View File
@@ -31,6 +31,9 @@ delete table ip host_nat
{% if firewall.geo_countries %}
include "/etc/nftables.d/host-geo.nft"
{% endif %}
{% if firewall.spamhaus %}
include "/etc/nftables.d/host-spamhaus.nft"
{% endif %}
table inet host {
{{ addr_set('admin_v4', 'ipv4_addr', firewall.admin.v4) }}
@@ -48,7 +51,14 @@ table inet host {
chain input {
type filter hook input priority filter; policy drop;
{% if firewall.spamhaus %}
# Before the established rule: outbound is blocked too, so listed
# addresses have no legitimate replies.
ip saddr @spamhaus_v4 jump spamhaus_in
ip6 saddr @spamhaus_v6 jump spamhaus_in
{% endif %}
ct state established,related accept
ct state invalid jump drop_log
iif lo accept
@@ -98,15 +108,36 @@ table inet host {
limit rate {{ firewall.log.in_rate }} log prefix "fw-in-drop: "
drop
}
{% if firewall.block_smtp_out %}
{% if firewall.spamhaus %}
# Own limits, so a listed scanner cannot use up the budget of fw-in-drop.
# CrowdSec whitelists both prefixes: the lists already ban these networks.
chain spamhaus_in {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-spamhaus-in: "
drop
}
chain spamhaus_out {
limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-spamhaus-out: "
reject
}
{% endif %}
{% if firewall.block_smtp_out or firewall.spamhaus %}
# Outbound mail goes through the mail host only. Loopback stays open for a
# local MTA; the log lines carry OUT=, which CrowdSec does not count as a scan.
chain output {
type filter hook output priority filter; policy accept;
{% if firewall.spamhaus %}
ip daddr @spamhaus_v4 jump spamhaus_out
ip6 daddr @spamhaus_v6 jump spamhaus_out
{% endif %}
{% if firewall.block_smtp_out %}
oifname != "lo" tcp dport 25 limit rate {{ firewall.log.out_rate }} log prefix "fw-out-reject: "
oifname != "lo" tcp dport 25 reject with tcp reset
{% endif %}
}
{% endif %}
@@ -164,10 +195,17 @@ table inet host {
ip6 saddr @geo_v6 accept
{% endif %}
}
{% if forward_guard %}
{% if forward_guard or firewall.spamhaus %}
chain forward {
type filter hook forward priority filter; policy accept;
{% if firewall.spamhaus %}
ip saddr @spamhaus_v4 jump spamhaus_in
ip6 saddr @spamhaus_v6 jump spamhaus_in
ip daddr @spamhaus_v4 jump spamhaus_out
ip6 daddr @spamhaus_v6 jump spamhaus_out
{% endif %}
{% for guard in forward_guard %}
# {{ guard.key }}