firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support list of IPv4 addresses to ban ('ban_ipv4.list'). Change handling of bridged interfaces.

Browse Source
This commit is contained in:
Christoph
2018-10-01 04:06:17 +02:00
parent 9e7a82e408
commit 1a57a304e6
2 changed files with 225 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
ip6t-firewall-server
View File

@ -12,6 +12,10 @@
CONFIG_FILE=/etc/ipt-firewall/ip6t-firewall-server.conf
if [[ -z "$fail2ban_client" ]]; then
fail2ban_client="$(which fail2ban-client)"
fi
# ------------- Load Kernel Modules -------------
#
@ -98,9 +102,9 @@ fi # if ! $host_is_vm
# ------------- Stop Fail2Ban if installed -------------
#
if [ -x "$fail2ban_init_script" ]; then
if [ -x "$fail2ban_client" ]; then
echononl "\tStopping fail2ban.."
$fail2ban_init_script stop > /dev/null 2>&1
$fail2ban_client stop > /dev/null 2>&1
if [ "$?" = "0" ];then
echo_done
else
@ -148,7 +152,19 @@ echo
echononl "\tDo not firewall bridged traffic"
if $do_not_firewall_bridged_traffic ; then
# - Matches if the packet is being bridged and therefore is not being routed.
# - This is only useful in the FORWARD and POSTROUTING chains.
# -
$ip6t -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
# - Matches if the packet has entered through a bridge interface.
# -
$ip6t -I FORWARD -m physdev --physdev-is-in -j ACCEPT
# - Matches if the packet will leave through a bridge interface.
# -
$ip6t -I FORWARD -m physdev --physdev-is-out -j ACCEPT
echo_done
else
echo_skipped
@ -1381,10 +1397,10 @@ echo_done
# ------------- Start Fail2Ban if installed
# -------------
if [ -x "$fail2ban_init_script" ]; then
if [ -x "$fail2ban_client" ]; then
echo
echononl "\tStarting fail2ban.."
$fail2ban_init_script start > /dev/null 2>&1
$fail2ban_client start > /dev/null 2>&1
if [ "$?" = "0" ];then
echo_done
else