 Ruakij
|
483f3890e5
|
host_firewall: uplinks drop new forwarded connections that were not DNATed, replaces no_hairpin_ifaces
|
2026-11-06 08:48:29 +00:00 |
|
|
Ruakij
|
79943e0389
|
host_firewall: no_hairpin_ifaces drops forwarding back out of the interface it came in on
|
2026-11-06 08:33:42 +00:00 |
|
|
Ruakij
|
252c703afd
|
host_firewall: log FireHOL level1 and level2 under separate prefixes fw-firehol1-* and fw-firehol2-*
|
2026-11-05 16:57:33 +00:00 |
|
|
Ruakij
|
1d10f2be39
|
host_firewall: drop bruteforceblocker, vxvault and cybercrime, only firehol level1 and level2 ban
|
2026-11-05 16:51:45 +00:00 |
|
|
Ruakij
|
6a1e7b77e7
|
host_firewall: ban firehol level2, bruteforceblocker, vxvault and cybercrime; greensnow is part of level2
|
2026-11-05 13:25:48 +00:00 |
|
|
Ruakij
|
6334820750
|
host_firewall: pass journal uploader flows from wt0 to the Traefik pod port with their own address
|
2026-11-04 06:13:52 +00:00 |
|
|
Ruakij
|
f60a2c7e1f
|
host_firewall: pass LAPI client flows from wt0 to the pod port with their own address
|
2026-11-03 21:58:27 +00:00 |
|
|
Ruakij
|
b23466f588
|
host_firewall: pass cluster ring flows from wt0 into the pod CIDR unmasqueraded and past the NetBird forward filter
|
2026-11-03 18:36:47 +00:00 |
|
|
Ruakij
|
74a0af2d32
|
host_firewall: reject forwarded tcp/25 egress like the host output rule
|
2026-11-03 16:59:44 +00:00 |
|
|
Ruakij
|
c30b3d1f0a
|
host_firewall: clear NetBird marks on pod to pod flows so pod sources stay unmasqueraded
|
2026-11-03 16:35:02 +00:00 |
|
|
Ruakij
|
ca34bd8363
|
host_firewall: GreenSnow set greensnow_v4 drops inbound new connections of the listed hosts
|
2026-10-30 09:01:25 +00:00 |
|
|
Ruakij
|
32651402c6
|
Revert "host_firewall: sources zone accepts tcp ports from listed addresses alone"
This reverts commit 0abc9fb1c3.
|
2026-10-28 14:02:36 +00:00 |
|
|
Ruakij
|
0abc9fb1c3
|
host_firewall: sources zone accepts tcp ports from listed addresses alone
|
2026-10-28 13:59:37 +00:00 |
|
|
Ruakij
|
7604bc4dac
|
host_firewall: rejected handshake flows are remembered for 30s and reset per packet, the first data segment no longer slips through; handshake match needs a bare ACK
|
2026-10-26 14:56:59 +00:00 |
|
|
Ruakij
|
46fd6a4c40
|
host_firewall: handshake meter carries the service limit, SYN meters become a flood cap at 2x rate and 2x burst
|
2026-10-26 14:48:25 +00:00 |
|
|
Ruakij
|
5318997b73
|
host_firewall: handshake meters per source reject over-limit connections with fw-rl-hs:, SYN meters log fw-rl-addr: and fw-rl-range: as evidence, conntrack accounting on
|
2026-10-26 14:35:28 +00:00 |
|
|
Ruakij
|
589f899bae
|
host_firewall: public_ips of every inventory host are exempt from the rate-limit meters, ArgoCD fetches and mail submission from the cluster nodes hit the web and submission limits
|
2026-10-26 13:21:20 +00:00 |
|
|
Ruakij
|
c2c8934ec9
|
host_firewall: per-service new-connection meters per source (/32, /64) and per range (/24, /48) from measured peaks, excess dropped with prefix fw-ratelimit:, replaces the ssh meter
|
2026-10-26 12:24:31 +00:00 |
|
|
Ruakij
|
c50c32059e
|
host_firewall: drop inbound traffic from internet-wide scanners (OpenFilters internet-scanners), v4 and v6, daily refresh
|
2026-10-25 12:12:27 +00:00 |
|
|
Ruakij
|
c55a96c0ea
|
host_firewall: FireHOL level1 as its own set firehol_v4 next to Spamhaus, daily updater and firewall.firehol opt-out
|
2026-10-24 17:31:45 +00:00 |
|
|
Ruakij
|
312be161b9
|
host_firewall: check the Spamhaus and geo sets under another table name, a dry run against the live name made unlisted addresses match
|
2026-10-24 17:20:11 +00:00 |
|
|
Ruakij
|
d5610a5b34
|
host_firewall: refresh the Spamhaus sets by rule set reload, flush and refill let unlisted addresses match
|
2026-10-24 14:53:10 +00:00 |
|
|
Ruakij
|
ebb1377470
|
host_firewall: block Spamhaus DROP, DROPv6 and ASN-DROP networks in, out and forward
|
2026-10-24 14:31:00 +00:00 |
|
|
Ruakij
|
5e544cdfb5
|
host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log
|
2026-10-24 13:43:12 +00:00 |
|
|
Ruakij
|
88c30eb252
|
host_firewall: log dropped inbound packets with a global rate limit and reject outbound TCP 25 except on the mail host
|
2026-10-24 12:14:47 +00:00 |
|
|
Ruakij
|
41dbce3641
|
host_firewall: admin.tcp ports answer the admin set alone, never the geo sets
|
2026-10-24 08:40:31 +00:00 |
|
|
Ruakij
|
c5b51777c6
|
Ignore the missing geo timer unit of a host without geo sets in check mode
|
2026-10-23 20:54:31 +00:00 |
|
|
Ruakij
|
a64d082c0c
|
Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses
|
2026-10-23 20:44:59 +00:00 |
|
|
Ruakij
|
b45a07da56
|
Add forward_guard to host_firewall for a forward chain that drops traffic to guarded guests outside the allowed interfaces, ports and ICMP types
|
2026-10-08 08:48:40 +00:00 |
|
|
Ruakij
|
9e2e6cbb99
|
Add IPv4 port forwards and masquerade to host_firewall in an ip host_nat table
|
2026-10-07 21:10:35 +00:00 |
|
|
Ruakij
|
cfe87002c5
|
Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback
|
2026-10-07 11:02:59 +00:00 |
|