firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
151 Commits 1 Branch 0 Tags
master
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
chrisandClaude Opus 5.5 f0187f041d logging_ipv{4,6}.conf: detect ulogd2 via systemd instead of ps. 
ps also lists the ulogd of LXC containers (which do not receive the NFLOG
packets of the host) and misses ulogd2 if the firewall starts first at boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-11 23:17:04 +01:00
chrisandClaude Opus 5.5 affa35def4 Limit of new TCP connections per source IP: configurable rate, drop only above the limit. 
- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
  (burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
  below the limit (which bypassed the service rules, destination IPs and the
  HTTP limits); like the HTTP limits it now only logs and drops SYNs above
  the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
  syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
  only the given ports instead of all new TCP connections, hashlimit names
  syn_multi_v6*, add the can_use_hashlimit check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-11 18:50:58 +01:00
chrisandClaude Opus 5.5 93d9af854b ip6t-firewall-server,ipt-firewall-server: HTTP limits only for local webserver; fix several bugs. 
- HTTP(S) connection limits are only created if 'http_server_ips' is set.
  The global SYN rate limit no longer ACCEPTs packets (which opened ports
  80/443 on every host) - it now only drops packets above the limit
  (hashlimit without '--hashlimit-mode'). Ports are opened exclusively by
  the rules for 'http_server_ips'.
- Use '$http_ports' instead of hard coded '80,443' for the limits.
- ipt-firewall-server: use '--connlimit-mask 32' instead of 128. With the
  nf_tables backend mask 128 ended up as mask 0, so the limit applied to
  all clients together instead of per IP. Rename hashlimit 'http_v6' -> 'http_v4'.
- Log rules use their own hashlimit tables ('*_log'), otherwise each packet
  is counted twice when logging is enabled.
- SYN-Overflow log rule now logs packets above (not below) the limit.
- ip6t-firewall-server: clamp TCP MSS for HTTPS on all external interfaces
  instead of hard coded 'eth0'.
- Quote test for 'mm_tcp_ports_in' ('[ -n ${mm_tcp_ports_in} ]' was always true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-02 21:51:16 +01:00
chris 9de4e742cd ip6t-firewall-server,ipt-firewall-server,default_settings.conf: some changes in default values limiting http connections. 2026-11-02 18:10:26 +01:00
chris 57861cb8ec Enhance spoofed packet handling: exclude loopback traffic in IP filtering 2026-10-27 22:30:44 +01:00
chris f6660709ce Enhance IPv6 ban functionality: add dynamic mask handling and prevent banning own addresses 2026-10-27 22:26:12 +01:00
chris fbe10b43d0 main_ipv4.conf.sample,main_ipv6.conf.sample: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_valwq'. 2026-10-27 22:03:27 +01:00
chris 3ad1807cda default_settings.conf: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_val'. 2026-10-27 21:54:38 +01:00
chris 792d0b1b86 Configure limits for HTTPS connections. 2026-10-27 21:18:02 +01:00
chris 560ee66b07 ip6t-firewall-server: Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. ip6t-firewall-server,ipt-firewall-server: add some restrictions on HTTP connections to counteract attacks. 2026-10-26 23:30:18 +01:00
chris 3418073003 Adjust mattermost service - fallback connection to STUN service via tcp. 2026-09-10 19:38:23 +02:00
chris 06b5d5840b Adjust '.claude/settings.json'. 2026-06-29 16:44:43 +02:00
chris 7f47bddc08 Add settings.json to define permissions for ansible operations 2026-06-28 11:34:36 +02:00
chris 85b1e4d2c6 deleted file 'post_decalrations.conf'. 2026-01-19 16:51:33 +01:00
chris a5b66b755b rename post_decalrations.conf -> post_declarations.conf; fix error in handling IPv4 'forward_private_ip_arr'. Fix error setting '/proc/sys/net/ipv4/conf/all/log_martians'. 2026-01-19 16:43:40 +01:00
chris 3d27513b81 ip6t-firewall-server: replace '-m statet --state ..' with '-m conntrack --ctstate ..'. 2026-01-19 16:10:52 +01:00
chris 73122fb0ce ip6t-firewall-server: get rif of debug output/comments. 2026-01-16 10:21:50 +01:00
chris b0804fdfaf Support LX Container on SINMA systems. 2026-01-16 01:40:23 +01:00
chris 7dd1a17e10 Fix error handling bridge devices on host systems. 2026-01-15 17:02:40 +01:00
chris 16eb4d7e0f ip6t-firewall-server: remove rule ' -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP'. 2026-01-15 01:37:46 +01:00
chris 5943f4d1a1 ip6t-firewall-server: a minor change in comments. 2026-01-14 20:10:29 +01:00
chris b35a3f3261 Prepare ip6t-firewall-server for making nftables ready later on. 2026-01-14 17:47:53 +01:00
chris cea43cd7fa Make IPv4 firewall nftables ready. 2026-01-14 17:46:20 +01:00
chris fd2d792d88 ip6t-firewall-server: Fis error. 2026-01-12 20:11:32 +01:00
chris ad136d2fdf main_ipv4.conf.sample,main_ipv6.conf.sample: Fix section Limit Connections - add limit_new_tcp_connections_per_seconds_ports. 2026-01-12 17:42:19 +01:00
chris a37b2c185b make firewall compartible with 'iptables-nf'. 2026-01-11 00:31:22 +01:00
chris 63889b0dc9 LDAP(S): forgot to configure ldap/ldaps standard ports. 2025-08-10 01:56:31 +02:00
chris abef59c769 Allow LDAP/LDAPS out only. 2025-08-10 01:50:23 +02:00
chris 9fd36a8236 Add support for MNDP and mDNS traffic. 2025-02-16 18:48:22 +01:00
chris 24d91d38c6 Add support for MNDP and mDNS traffic. 2025-02-16 18:40:50 +01:00
chris 71e01e8413 logging_ipv[46].conf: add missing parameter 'log_blocked_ip'. 2025-02-15 10:59:53 +01:00
chris aab8585d90 Fix error creating 'smtpd_additional_listen_port_arr'. 2025-01-27 23:10:29 +01:00
chris e6984a622c post_decalrations.conf: fix error creating array 'smtpd_additional_outgoung_port_arr'. 2025-01-27 22:58:30 +01:00
chris 54ce58a52e replace 'default_ports.conf' with 'default_settings.conf'. 2025-01-27 14:49:47 +01:00
chris 40591462ce Merge branch 'master' of https://git.oopen.de/firewall/ipt-server 2024-12-27 17:27:57 +01:00
chris 3d65233059 ipt-firewall-server: fix error at munin role. 2024-12-27 17:27:28 +01:00
chris dce357a3df /main_ipv4.conf.sample,main_ipv6.conf.sample: Change munin IP address. 2024-12-27 10:53:53 +01:00
chris f0e15b992b Fix error for not firewalled interfaces. 2024-12-24 17:16:35 +01:00
chris e7311a3963 Add Prometheus Service 2024-11-05 17:21:05 +01:00
chris 0eca4f3eaf main_ipv[46].conf.sample: add 'per_IP_connection_limit' parameter. 2024-09-26 15:21:17 +02:00
chris 830f48ff61 Add support for logging CGI script user. 2024-09-14 01:15:52 +02:00
chris bbabeeab27 Add support for PGP/GPG Key server.. 2024-07-24 17:14:04 +02:00
chris 1062208237 ip6t-firewall-server,ipt-firewall-server: move 'Loopback device generally allowed' to an earlier point in the script. 2024-04-08 21:07:51 +02:00
chris d857756be7 ip6t-firewall-server: add '(end of firewall)' to the last reject rule. 2024-04-06 03:20:27 +02:00
chris b183770b91 forgot 'updating conf/include_functions.conf' file. 2024-04-04 19:22:08 +02:00
chris e6566bafeb Some changes in per IP Connection Limit. 2024-04-04 18:57:36 +02:00
chris 2532b116b8 Support user settings for sourvce IP connection limit - ff. 2024-04-04 18:34:28 +02:00
chris 738809ba95 Support user settings for sourvce IP connection limit. 2024-04-04 15:17:31 +02:00
chris 7c00c7783c Add China/Hon Long networks ti nan list. 2024-01-17 11:10:41 +01:00
chris ce0ee2d243 Add variables for lx guest system ip's. 2023-05-02 22:26:40 +02:00
chris 8e64cc36ac some minor changes.. 2023-05-02 21:45:43 +02:00
chris 536aea7d97 change defaut value for '+do_not_firewall_lx_guest_systems' to false. 2023-05-02 21:37:47 +02:00
chris ff098ac058 Add rule to prevent LX containers from firewalld on host system. 2023-05-02 20:45:27 +02:00
chris a2ba79185d main_ipv6.conf.sample: change default value of 'mm_service_ips' to an empty one. 2023-01-24 18:17:01 +01:00
chris 486789c6b5 Add support for MatterMost (MM) service. 2023-01-24 17:42:27 +01:00
chris 9f016b1776 Add support for routing networks through wireguard connections. 2022-08-12 01:16:53 +02:00
chris 0831f26891 Add support for WireGuard VPN Service. 2022-08-11 10:43:04 +02:00
chris 2d07d39a55 allow those ssh ports out, which are also allowed for incoming traffic. 2021-10-26 11:02:59 +02:00
chris c78edd01be Drop traffic on extern interfaces iinto private networks. 2021-09-02 12:07:25 +02:00
chris c65e0102ae ipt-firewall-server/ip6t-firewall-server: change order for 'Restrict Service/Net to..'. 2021-08-20 01:33:47 +02:00
chris 5ec7c9bcea Add support for dhclient. 2021-01-11 19:59:08 +01:00
chris e68705c819 some minor changes on file 'main_ipv6.conf.sample'. 2020-11-04 16:25:14 +01:00
chris e1047e9c47 Some more or less minor changes.. 2020-10-30 15:00:46 +01:00
chris 35d3ffeded Some minor changes.. 2020-10-30 13:56:34 +01:00
chris c8b7e9b0f5 change rules and location of rules for 'Allow forwarding (private) IPs'. 2020-10-30 11:59:38 +01:00
chris 96b3e162fe Fix error droping ICMP packets. fix error dropping private networks. 2020-10-29 12:55:59 +01:00
chris bcdee40228 Changing rules for protection against several ddos attacks. 2020-10-28 20:57:08 +01:00
chris 498b34741c Add support for Portforwarding TCP/UDP using socat. 2020-06-03 14:10:27 +02:00
chris 53de5746cf Support Streaming via YouTube. 2020-05-17 17:56:23 +02:00
chris c695a63372 ip6t-firewall-server,ipt-firewall-server: add rtp port for jibri (jitsi client) service. 2020-05-17 04:20:13 +02:00
chris fbe1089099 add support for Jibri Streamin/Recording. 2020-05-16 13:42:22 +02:00
chris b24dcf0a3d load_modules_ipv6.conf: load module 'br_netfilter'. 2020-04-30 10:40:01 +02:00
chris ac6845a8fd Merge branch 'master' of https://git.oopen.de/firewall/ipt-server 2020-04-27 21:43:42 +02:00
chris 2ebeae6479 Change default munin remote ip. 2020-04-27 21:43:14 +02:00
chris cf999b48fc Merge branch 'master' of git.oopen.de:firewall/ipt-server 2020-04-27 16:23:18 +02:00
chris 3627c5169b main_ipv[46].con: minor changes at comments for DND/Resolver Service. 2020-04-27 16:23:02 +02:00
chris 966a9dac6b Adjust some ports at files 'main_ipv4.conf.sample' and 'main_ipv6.conf.sample'. 2020-04-26 16:04:19 +02:00
chris 3f3b4c3c76 Settings for default ports 'dovecot_service_external_auth_port' and 'default_jitsi_dovecout_auth_port'. 2020-04-26 15:53:41 +02:00
chris df10be0d45 Add support fpr Jitsi Meet Authentication agains dovecot. 2020-04-26 10:16:32 +02:00
chris dcbe4605bc Add outgoing ports needed by jitsi service (discover public address fronm stun services). 2020-04-23 15:12:29 +02:00
chris 400adea8e3 Ajust jitsi_tcp_ports. 2020-03-21 19:30:34 +01:00
chris 450a9d5dcf Adjust support for TURN Server (NC App Talk). 2020-03-21 18:43:45 +01:00
chris 9f2764c0ae Add support for NCs Talk app with own stun/turn server. 2020-03-21 12:57:11 +01:00
chris 6ea1f594b8 Jitsi Video Conference Service: fix UDP Ports. 2020-03-17 23:17:20 +01:00
chris 9d8983713c Adjust firewall scripts to support Jitsi Video Conferencing Service. 2020-03-17 22:59:01 +01:00
chris 93856c8fb3 Add Jitsi Video Conferencing Service. 2020-03-17 22:43:03 +01:00
chris 5ea1b0acbd DNS 'ANY' request uses TCP port. So allow DNS TCP requests for 'resolver_allowed_network_arr'. 2020-02-19 14:03:16 +01:00
chris e292be4141 Support local service from given extern network 2019-09-04 01:11:31 +02:00
chris 051e7da995 Add support for (local) dovecot auth service. 2019-09-03 17:54:46 +02:00
chris f87f7bbda0 Support multiple networks for access to local resolver - forgot iptables scripts. 2019-09-03 03:52:54 +02:00
chris 328219c4b6 Support multiple networks for access to local resolver. 2019-09-03 03:49:24 +02:00
chris eaf4fb9a40 Some minor chanes on comments. 2019-09-01 21:24:07 +02:00
chris 2665010eb3 support Resolver for specified (local) network. Part 2 2019-09-01 20:59:38 +02:00
chris 8e85e893ad support Resolver for specified (local) network. 2019-09-01 20:57:16 +02:00
chris 142778c718 Support local NTP Server. 2019-09-01 17:29:54 +02:00
chris 70f62dc7fa main_ipv[4|6].conf.sample: minor changes on file comments. 2019-07-01 00:40:54 +02:00
chris b02ba8b8f2 main_ipv[4|6].conf.sample: minor changes on file comments. 2019-07-01 00:29:59 +02:00
chris 0daa7a9d40 main_ipv[4|6].conf.sample: monor changes on file comments. 2019-07-01 00:26:01 +02:00
chris 57d09ba98d Add file 'conf/default_ports.conf'. Remove file 'conf/ports.conf'. 2019-06-30 15:29:07 +02:00
chris b3347d273d Merge branch 'master' of git.oopen.de:firewall/ipt-server 2019-05-20 15:54:14 +02:00