diff options
Diffstat (limited to 'src/firewall.d/global.d/ipsets-example')
| -rw-r--r-- | src/firewall.d/global.d/ipsets-example | 68 |
1 files changed, 48 insertions, 20 deletions
diff --git a/src/firewall.d/global.d/ipsets-example b/src/firewall.d/global.d/ipsets-example index 8a6d35f..ff54196 100644 --- a/src/firewall.d/global.d/ipsets-example +++ b/src/firewall.d/global.d/ipsets-example | |||
| @@ -13,26 +13,54 @@ | |||
| 13 | # @sysconfdir@/firewall.d/rules6 | 13 | # @sysconfdir@/firewall.d/rules6 |
| 14 | # | 14 | # |
| 15 | 15 | ||
| 16 | ####################### | 16 | ###################### |
| 17 | # # | 17 | # # |
| 18 | # Standard Services # | 18 | # Private Networks # |
| 19 | # # | 19 | # # |
| 20 | ####################### | 20 | ###################### |
| 21 | 21 | ||
| 22 | create SERVICES bitmap:port range 1-1024 comment | 22 | create PRIVATE4 hash:ip family inet hashsize 1024 comment |
| 23 | add SERVICES 20 comment "FTP data" | 23 | create PRIVATE6 hash:ip family inet6 hashsize 1024 comment |
| 24 | add SERVICES 21 comment "FTP" | 24 | create PRIVATE list:set |
| 25 | add SERVICES 22 comment "SSH" | 25 | add PRIVATE PRIVATE4 |
| 26 | add SERVICES 23 comment "Telnet" | 26 | add PRIVATE PRIVATE6 |
| 27 | add SERVICES 25 comment "SMTP" | 27 | add PRIVATE4 10.0.0.0/8 "rfc1918" |
| 28 | add SERVICES 53 comment "DNS" | 28 | add PRIVATE4 172.16.0.0/12 "rfc1918" |
| 29 | add SERVICES 69 comment "TFTP" | 29 | add PRIVATE4 192.168.0.0/1 "rfc1918" |
| 30 | add SERVICES 80 comment "HTTP" | 30 | add PRIVATE6 fc00::/7 "rfc4193" |
| 31 | add SERVICES 110 comment "POP3" | 31 | add PRIVATE6 fe80::/10 "rfc4291" |
| 32 | add SERVICES 123 comment "NTP" | 32 | |
| 33 | add SERVICES 143 comment "IMAP" | 33 | |
| 34 | add SERVICES 389 comment "LDAP" | 34 | ################# |
| 35 | add SERVICES 443 comment "HTTPS" | 35 | # # |
| 36 | # Black Holes # | ||
| 37 | # # | ||
| 38 | ################# | ||
| 39 | |||
| 40 | # dynamic blackhole lists | ||
| 41 | create DYNAMIC_BLACKHOLE4 hash:ip family inet hashsize 1024 timeout 600 | ||
| 42 | create DYNAMIC_BLACKHOLE6 hash:ip family inet6 hashsize 1024 timeout 600 | ||
| 43 | create DYNAMIC_BLACKHOLE list:set | ||
| 44 | add DYNAMIC_BLACKHOLE DYNAMIC_BLACKHOLE4 | ||
| 45 | add DYNAMIC_BLACKHOLE DYNAMIC_BLACKHOLE6 | ||
| 46 | |||
| 47 | # dynamic blackhole exemptions | ||
| 48 | create DYNAMIC_EXEMPTION4 hash:net family inet hashsize 1024 comment | ||
| 49 | create DYNAMIC_EXEMPTION6 hash:net family inet6 hashsize 1024 comment | ||
| 50 | create DYNAMIC_EXEMPTION list:set | ||
| 51 | add DYNAMIC_EXEMPTION DYNAMIC_EXEMPTION4 | ||
| 52 | add DYNAMIC_EXEMPTION DYNAMIC_EXEMPTION6 | ||
| 53 | add DYNAMIC_EXEMPTION PRIVATE4 | ||
| 54 | add DYNAMIC_EXEMPTION PRIVATE6 | ||
| 55 | |||
| 56 | # static blackhole lists | ||
| 57 | create BLACKHOLE4 hash:ip family inet hashsize 1024 | ||
| 58 | create BLACKHOLE6 hash:ip family inet6 hashsize 1024 | ||
| 59 | create BLACKHOLE list:set | ||
| 60 | add BLACKHOLE BLACKHOLE4 | ||
| 61 | add BLACKHOLE BLACKHOLE6 | ||
| 62 | add BLACKHOLE DYNAMIC_BLACKHOLE4 | ||
| 63 | add BLACKHOLE DYNAMIC_BLACKHOLE6 | ||
| 36 | 64 | ||
| 37 | 65 | ||
| 38 | # end of rules | 66 | # end of rules |