69 lines
1.5 KiB
Bash
69 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
|
|
# -------------
|
|
# --- Logging
|
|
# -------------
|
|
|
|
# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself.
|
|
# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not
|
|
# receive the NFLOG packets of the host (other network namespace); at boot
|
|
# the firewall may also start before ulogd2.
|
|
if systemctl is-enabled --quiet ulogd2 2>/dev/null \
|
|
|| systemctl is-active --quiet ulogd2 2>/dev/null ; then
|
|
tag_log_prefix="--nflog-prefix"
|
|
LOG_TARGET="NFLOG --nflog-group 12"
|
|
else
|
|
# - Log using the specified syslog level. 7 (debug) is a good choice
|
|
# - unless you specifically need something else.
|
|
# -
|
|
log_level=debug
|
|
LOG_TARGET="LOG --log-level $log_level"
|
|
tag_log_prefix="--log-prefix"
|
|
fi
|
|
|
|
log_all=false
|
|
|
|
log_syn_flood=false
|
|
log_port_scanning=false
|
|
log_ssh_brute_force=false
|
|
log_fragments=false
|
|
log_mdns=false
|
|
log_mndp=false
|
|
log_new_not_sync=false
|
|
log_syn_with_suspicious_mss=false
|
|
log_invalid_packets=false
|
|
log_invalid_state=false
|
|
log_invalid_flags=false
|
|
log_spoofed=false
|
|
log_spoofed_out=false
|
|
log_private_network_out=false
|
|
log_to_lo=false
|
|
log_not_wanted=false
|
|
log_blocked=false
|
|
log_unprotected=false
|
|
log_forwarding_priv_ip=false
|
|
log_prohibited=false
|
|
log_voip=false
|
|
log_rejected=true
|
|
|
|
log_blocked_ip=false
|
|
|
|
log_ssh=false
|
|
|
|
# - logging messages
|
|
# -
|
|
log_prefix="[ IPv6 ]"
|
|
|
|
|
|
# ---
|
|
# - Log all traffic for givven ip address
|
|
# ---
|
|
|
|
# - You can also give hostname(s)
|
|
# -
|
|
# - Blank seoarated list of ips/hostnames
|
|
# -
|
|
log_ips=""
|
|
|