blob: ff541968e3643bf6c0dcec284afaf2e6d3ec46e5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
# @sysconfdir@/firewall.d/global.d/ipsets
#
# Global Organization IP Sets for Linux Servers
#
# THIS FILE IS INTENDED TO CONTAIN FIREWALL RULES PUSHED OUT FROM A
# CENTRALIZED LOCATION IN ORDER TO ALLOW AN ORGANIZATION TO CREATE GLOBAL
# FIREWALL RULES ACROSS ALL SYSTEMS.
#
# PLACE HOST SPECIFIC RULES IN ONE OF THE FOLLOWING FILES:
# @sysconfdir@/firewall.d/ipsets
# @sysconfdir@/firewall.d/rules
# @sysconfdir@/firewall.d/rules4
# @sysconfdir@/firewall.d/rules6
#
######################
# #
# Private Networks #
# #
######################
create PRIVATE4 hash:ip family inet hashsize 1024 comment
create PRIVATE6 hash:ip family inet6 hashsize 1024 comment
create PRIVATE list:set
add PRIVATE PRIVATE4
add PRIVATE PRIVATE6
add PRIVATE4 10.0.0.0/8 "rfc1918"
add PRIVATE4 172.16.0.0/12 "rfc1918"
add PRIVATE4 192.168.0.0/1 "rfc1918"
add PRIVATE6 fc00::/7 "rfc4193"
add PRIVATE6 fe80::/10 "rfc4291"
#################
# #
# Black Holes #
# #
#################
# dynamic blackhole lists
create DYNAMIC_BLACKHOLE4 hash:ip family inet hashsize 1024 timeout 600
create DYNAMIC_BLACKHOLE6 hash:ip family inet6 hashsize 1024 timeout 600
create DYNAMIC_BLACKHOLE list:set
add DYNAMIC_BLACKHOLE DYNAMIC_BLACKHOLE4
add DYNAMIC_BLACKHOLE DYNAMIC_BLACKHOLE6
# dynamic blackhole exemptions
create DYNAMIC_EXEMPTION4 hash:net family inet hashsize 1024 comment
create DYNAMIC_EXEMPTION6 hash:net family inet6 hashsize 1024 comment
create DYNAMIC_EXEMPTION list:set
add DYNAMIC_EXEMPTION DYNAMIC_EXEMPTION4
add DYNAMIC_EXEMPTION DYNAMIC_EXEMPTION6
add DYNAMIC_EXEMPTION PRIVATE4
add DYNAMIC_EXEMPTION PRIVATE6
# static blackhole lists
create BLACKHOLE4 hash:ip family inet hashsize 1024
create BLACKHOLE6 hash:ip family inet6 hashsize 1024
create BLACKHOLE list:set
add BLACKHOLE BLACKHOLE4
add BLACKHOLE BLACKHOLE6
add BLACKHOLE DYNAMIC_BLACKHOLE4
add BLACKHOLE DYNAMIC_BLACKHOLE6
# end of rules
|
