From f9c25cb358b13f87296da1b225a1301869a2a4a6 Mon Sep 17 00:00:00 2001 From: Stephen Gran Date: Sun, 21 Feb 2010 00:39:33 +0000 Subject: [PATCH] make v6 logging work; add weasel ip; fix brain damage Signed-off-by: Stephen Gran --- modules/ferm/files/defs.conf | 2 +- modules/ferm/files/ferm.conf | 44 ++++++++++++++++++++++++++---------- 2 files changed, 33 insertions(+), 13 deletions(-) diff --git a/modules/ferm/files/defs.conf b/modules/ferm/files/defs.conf index b78b9abf9..61284b65c 100644 --- a/modules/ferm/files/defs.conf +++ b/modules/ferm/files/defs.conf @@ -26,7 +26,7 @@ @def $DSA_IPS = ($sgran $weasel $zobel $luca); @def $sgran6 = (2001:4b10:100b::/48); -@def $weasel6 = (); +@def $weasel6 = (2001:41b8:202:deb:216:36ff:fe40:3904); @def $zobel6 = (); @def $luca6 = (); @def $DSA_V6_IPS = ($sgran6 $weasel6 $zobel6 $luca6); diff --git a/modules/ferm/files/ferm.conf b/modules/ferm/files/ferm.conf index ff458597e..8229ff80d 100644 --- a/modules/ferm/files/ferm.conf +++ b/modules/ferm/files/ferm.conf @@ -7,19 +7,39 @@ @include 'conf.d/'; +domain ip { + table filter { + chain log_and_reject { + ULOG ulog-prefix "REJECT: "; + proto tcp REJECT reject-with tcp-reset; + REJECT; + } + + chain log_or_drop { + mod hashlimit hashlimit-name ulogreject hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject; + mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second ULOG ulog-prefix "DROP: "; + DROP; + } + + } +} +domain ip6 { + table filter { + chain log_and_reject { + LOG log-prefix "REJECT: "; + proto tcp REJECT reject-with tcp-reset; + REJECT; + } + + chain log_or_drop { + mod hashlimit hashlimit-name logreject hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject; + mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second LOG log-prefix "DROP: "; + DROP; + } + } +} domain (ip ip6) { - table filter { - chain log_and_reject { - ULOG ulog-prefix "REJECT: "; - proto tcp REJECT reject-with tcp-reset; - REJECT; - } - - chain log_or_drop { - mod hashlimit hashlimit-name ulogreject hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject; - mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second ULOG ulog-prefix "DROP: "; - DROP; - } + table filter { chain INPUT { policy DROP; mod state state (ESTABLISHED RELATED) ACCEPT; -- 2.20.1