firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
150 Commits 1 Branch 0 Tags
affa35def4d6520f0e93378dae6b186a989cac3e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
chrisandClaude Opus 5.5 affa35def4 Limit of new TCP connections per source IP: configurable rate, drop only above the limit. 
- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
  (burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
  below the limit (which bypassed the service rules, destination IPs and the
  HTTP limits); like the HTTP limits it now only logs and drops SYNs above
  the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
  syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
  only the given ports instead of all new TCP connections, hashlimit names
  syn_multi_v6*, add the can_use_hashlimit check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-11 18:50:58 +01:00
chrisandClaude Opus 5.5 93d9af854b ip6t-firewall-server,ipt-firewall-server: HTTP limits only for local webserver; fix several bugs. 
- HTTP(S) connection limits are only created if 'http_server_ips' is set.
  The global SYN rate limit no longer ACCEPTs packets (which opened ports
  80/443 on every host) - it now only drops packets above the limit
  (hashlimit without '--hashlimit-mode'). Ports are opened exclusively by
  the rules for 'http_server_ips'.
- Use '$http_ports' instead of hard coded '80,443' for the limits.
- ipt-firewall-server: use '--connlimit-mask 32' instead of 128. With the
  nf_tables backend mask 128 ended up as mask 0, so the limit applied to
  all clients together instead of per IP. Rename hashlimit 'http_v6' -> 'http_v4'.
- Log rules use their own hashlimit tables ('*_log'), otherwise each packet
  is counted twice when logging is enabled.
- SYN-Overflow log rule now logs packets above (not below) the limit.
- ip6t-firewall-server: clamp TCP MSS for HTTPS on all external interfaces
  instead of hard coded 'eth0'.
- Quote test for 'mm_tcp_ports_in' ('[ -n ${mm_tcp_ports_in} ]' was always true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-02 21:51:16 +01:00
chris 9de4e742cd ip6t-firewall-server,ipt-firewall-server,default_settings.conf: some changes in default values limiting http connections. 2026-11-02 18:10:26 +01:00
chris 57861cb8ec Enhance spoofed packet handling: exclude loopback traffic in IP filtering 2026-10-27 22:30:44 +01:00
chris f6660709ce Enhance IPv6 ban functionality: add dynamic mask handling and prevent banning own addresses 2026-10-27 22:26:12 +01:00
chris fbe10b43d0 main_ipv4.conf.sample,main_ipv6.conf.sample: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_valwq'. 2026-10-27 22:03:27 +01:00
chris 3ad1807cda default_settings.conf: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_val'. 2026-10-27 21:54:38 +01:00
chris 792d0b1b86 Configure limits for HTTPS connections. 2026-10-27 21:18:02 +01:00
chris 560ee66b07 ip6t-firewall-server: Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. ip6t-firewall-server,ipt-firewall-server: add some restrictions on HTTP connections to counteract attacks. 2026-10-26 23:30:18 +01:00
chris 3418073003 Adjust mattermost service - fallback connection to STUN service via tcp. 2026-09-10 19:38:23 +02:00
chris 06b5d5840b Adjust '.claude/settings.json'. 2026-06-29 16:44:43 +02:00
chris 7f47bddc08 Add settings.json to define permissions for ansible operations 2026-06-28 11:34:36 +02:00
chris 85b1e4d2c6 deleted file 'post_decalrations.conf'. 2026-01-19 16:51:33 +01:00
chris a5b66b755b rename post_decalrations.conf -> post_declarations.conf; fix error in handling IPv4 'forward_private_ip_arr'. Fix error setting '/proc/sys/net/ipv4/conf/all/log_martians'. 2026-01-19 16:43:40 +01:00
chris 3d27513b81 ip6t-firewall-server: replace '-m statet --state ..' with '-m conntrack --ctstate ..'. 2026-01-19 16:10:52 +01:00
chris 73122fb0ce ip6t-firewall-server: get rif of debug output/comments. 2026-01-16 10:21:50 +01:00
chris b0804fdfaf Support LX Container on SINMA systems. 2026-01-16 01:40:23 +01:00
chris 7dd1a17e10 Fix error handling bridge devices on host systems. 2026-01-15 17:02:40 +01:00
chris 16eb4d7e0f ip6t-firewall-server: remove rule ' -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP'. 2026-01-15 01:37:46 +01:00
chris 5943f4d1a1 ip6t-firewall-server: a minor change in comments. 2026-01-14 20:10:29 +01:00
chris b35a3f3261 Prepare ip6t-firewall-server for making nftables ready later on. 2026-01-14 17:47:53 +01:00
chris cea43cd7fa Make IPv4 firewall nftables ready. 2026-01-14 17:46:20 +01:00
chris fd2d792d88 ip6t-firewall-server: Fis error. 2026-01-12 20:11:32 +01:00
chris ad136d2fdf main_ipv4.conf.sample,main_ipv6.conf.sample: Fix section Limit Connections - add limit_new_tcp_connections_per_seconds_ports. 2026-01-12 17:42:19 +01:00
chris a37b2c185b make firewall compartible with 'iptables-nf'. 2026-01-11 00:31:22 +01:00
chris 63889b0dc9 LDAP(S): forgot to configure ldap/ldaps standard ports. 2025-08-10 01:56:31 +02:00
chris abef59c769 Allow LDAP/LDAPS out only. 2025-08-10 01:50:23 +02:00
chris 9fd36a8236 Add support for MNDP and mDNS traffic. 2025-02-16 18:48:22 +01:00
chris 24d91d38c6 Add support for MNDP and mDNS traffic. 2025-02-16 18:40:50 +01:00
chris 71e01e8413 logging_ipv[46].conf: add missing parameter 'log_blocked_ip'. 2025-02-15 10:59:53 +01:00
chris aab8585d90 Fix error creating 'smtpd_additional_listen_port_arr'. 2025-01-27 23:10:29 +01:00
chris e6984a622c post_decalrations.conf: fix error creating array 'smtpd_additional_outgoung_port_arr'. 2025-01-27 22:58:30 +01:00
chris 54ce58a52e replace 'default_ports.conf' with 'default_settings.conf'. 2025-01-27 14:49:47 +01:00
chris 40591462ce Merge branch 'master' of https://git.oopen.de/firewall/ipt-server 2024-12-27 17:27:57 +01:00
chris 3d65233059 ipt-firewall-server: fix error at munin role. 2024-12-27 17:27:28 +01:00
chris dce357a3df /main_ipv4.conf.sample,main_ipv6.conf.sample: Change munin IP address. 2024-12-27 10:53:53 +01:00
chris f0e15b992b Fix error for not firewalled interfaces. 2024-12-24 17:16:35 +01:00
chris e7311a3963 Add Prometheus Service 2024-11-05 17:21:05 +01:00
chris 0eca4f3eaf main_ipv[46].conf.sample: add 'per_IP_connection_limit' parameter. 2024-09-26 15:21:17 +02:00
chris 830f48ff61 Add support for logging CGI script user. 2024-09-14 01:15:52 +02:00
chris bbabeeab27 Add support for PGP/GPG Key server.. 2024-07-24 17:14:04 +02:00
chris 1062208237 ip6t-firewall-server,ipt-firewall-server: move 'Loopback device generally allowed' to an earlier point in the script. 2024-04-08 21:07:51 +02:00
chris d857756be7 ip6t-firewall-server: add '(end of firewall)' to the last reject rule. 2024-04-06 03:20:27 +02:00
chris b183770b91 forgot 'updating conf/include_functions.conf' file. 2024-04-04 19:22:08 +02:00
chris e6566bafeb Some changes in per IP Connection Limit. 2024-04-04 18:57:36 +02:00
chris 2532b116b8 Support user settings for sourvce IP connection limit - ff. 2024-04-04 18:34:28 +02:00
chris 738809ba95 Support user settings for sourvce IP connection limit. 2024-04-04 15:17:31 +02:00
chris 7c00c7783c Add China/Hon Long networks ti nan list. 2024-01-17 11:10:41 +01:00
chris ce0ee2d243 Add variables for lx guest system ip's. 2023-05-02 22:26:40 +02:00
chris 8e64cc36ac some minor changes.. 2023-05-02 21:45:43 +02:00
chris 536aea7d97 change defaut value for '+do_not_firewall_lx_guest_systems' to false. 2023-05-02 21:37:47 +02:00
chris ff098ac058 Add rule to prevent LX containers from firewalld on host system. 2023-05-02 20:45:27 +02:00
chris a2ba79185d main_ipv6.conf.sample: change default value of 'mm_service_ips' to an empty one. 2023-01-24 18:17:01 +01:00
chris 486789c6b5 Add support for MatterMost (MM) service. 2023-01-24 17:42:27 +01:00
chris 9f016b1776 Add support for routing networks through wireguard connections. 2022-08-12 01:16:53 +02:00
chris 0831f26891 Add support for WireGuard VPN Service. 2022-08-11 10:43:04 +02:00
chris 2d07d39a55 allow those ssh ports out, which are also allowed for incoming traffic. 2021-10-26 11:02:59 +02:00
chris c78edd01be Drop traffic on extern interfaces iinto private networks. 2021-09-02 12:07:25 +02:00
chris c65e0102ae ipt-firewall-server/ip6t-firewall-server: change order for 'Restrict Service/Net to..'. 2021-08-20 01:33:47 +02:00
chris 5ec7c9bcea Add support for dhclient. 2021-01-11 19:59:08 +01:00
chris e68705c819 some minor changes on file 'main_ipv6.conf.sample'. 2020-11-04 16:25:14 +01:00
chris e1047e9c47 Some more or less minor changes.. 2020-10-30 15:00:46 +01:00
chris 35d3ffeded Some minor changes.. 2020-10-30 13:56:34 +01:00
chris c8b7e9b0f5 change rules and location of rules for 'Allow forwarding (private) IPs'. 2020-10-30 11:59:38 +01:00
chris 96b3e162fe Fix error droping ICMP packets. fix error dropping private networks. 2020-10-29 12:55:59 +01:00
chris bcdee40228 Changing rules for protection against several ddos attacks. 2020-10-28 20:57:08 +01:00
chris 498b34741c Add support for Portforwarding TCP/UDP using socat. 2020-06-03 14:10:27 +02:00
chris 53de5746cf Support Streaming via YouTube. 2020-05-17 17:56:23 +02:00
chris c695a63372 ip6t-firewall-server,ipt-firewall-server: add rtp port for jibri (jitsi client) service. 2020-05-17 04:20:13 +02:00
chris fbe1089099 add support for Jibri Streamin/Recording. 2020-05-16 13:42:22 +02:00
chris b24dcf0a3d load_modules_ipv6.conf: load module 'br_netfilter'. 2020-04-30 10:40:01 +02:00
chris ac6845a8fd Merge branch 'master' of https://git.oopen.de/firewall/ipt-server 2020-04-27 21:43:42 +02:00
chris 2ebeae6479 Change default munin remote ip. 2020-04-27 21:43:14 +02:00
chris cf999b48fc Merge branch 'master' of git.oopen.de:firewall/ipt-server 2020-04-27 16:23:18 +02:00
chris 3627c5169b main_ipv[46].con: minor changes at comments for DND/Resolver Service. 2020-04-27 16:23:02 +02:00
chris 966a9dac6b Adjust some ports at files 'main_ipv4.conf.sample' and 'main_ipv6.conf.sample'. 2020-04-26 16:04:19 +02:00
chris 3f3b4c3c76 Settings for default ports 'dovecot_service_external_auth_port' and 'default_jitsi_dovecout_auth_port'. 2020-04-26 15:53:41 +02:00
chris df10be0d45 Add support fpr Jitsi Meet Authentication agains dovecot. 2020-04-26 10:16:32 +02:00
chris dcbe4605bc Add outgoing ports needed by jitsi service (discover public address fronm stun services). 2020-04-23 15:12:29 +02:00
chris 400adea8e3 Ajust jitsi_tcp_ports. 2020-03-21 19:30:34 +01:00
chris 450a9d5dcf Adjust support for TURN Server (NC App Talk). 2020-03-21 18:43:45 +01:00
chris 9f2764c0ae Add support for NCs Talk app with own stun/turn server. 2020-03-21 12:57:11 +01:00
chris 6ea1f594b8 Jitsi Video Conference Service: fix UDP Ports. 2020-03-17 23:17:20 +01:00
chris 9d8983713c Adjust firewall scripts to support Jitsi Video Conferencing Service. 2020-03-17 22:59:01 +01:00
chris 93856c8fb3 Add Jitsi Video Conferencing Service. 2020-03-17 22:43:03 +01:00
chris 5ea1b0acbd DNS 'ANY' request uses TCP port. So allow DNS TCP requests for 'resolver_allowed_network_arr'. 2020-02-19 14:03:16 +01:00
chris e292be4141 Support local service from given extern network 2019-09-04 01:11:31 +02:00
chris 051e7da995 Add support for (local) dovecot auth service. 2019-09-03 17:54:46 +02:00
chris f87f7bbda0 Support multiple networks for access to local resolver - forgot iptables scripts. 2019-09-03 03:52:54 +02:00
chris 328219c4b6 Support multiple networks for access to local resolver. 2019-09-03 03:49:24 +02:00
chris eaf4fb9a40 Some minor chanes on comments. 2019-09-01 21:24:07 +02:00
chris 2665010eb3 support Resolver for specified (local) network. Part 2 2019-09-01 20:59:38 +02:00
chris 8e85e893ad support Resolver for specified (local) network. 2019-09-01 20:57:16 +02:00
chris 142778c718 Support local NTP Server. 2019-09-01 17:29:54 +02:00
chris 70f62dc7fa main_ipv[4|6].conf.sample: minor changes on file comments. 2019-07-01 00:40:54 +02:00
chris b02ba8b8f2 main_ipv[4|6].conf.sample: minor changes on file comments. 2019-07-01 00:29:59 +02:00
chris 0daa7a9d40 main_ipv[4|6].conf.sample: monor changes on file comments. 2019-07-01 00:26:01 +02:00
chris 57d09ba98d Add file 'conf/default_ports.conf'. Remove file 'conf/ports.conf'. 2019-06-30 15:29:07 +02:00
chris b3347d273d Merge branch 'master' of git.oopen.de:firewall/ipt-server 2019-05-20 15:54:14 +02:00
chris f4b74813d2 Fix error at section 'Special TCP Ports OUT'. 2019-05-20 15:53:56 +02:00