firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
150 Commits 1 Branch 0 Tags
affa35def4d6520f0e93378dae6b186a989cac3e
Commit Graph
150 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
chrisandClaude Opus 5.5 affa35def4 Limit of new TCP connections per source IP: configurable rate, drop only above the limit. 
- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
  (burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
  below the limit (which bypassed the service rules, destination IPs and the
  HTTP limits); like the HTTP limits it now only logs and drops SYNs above
  the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
  syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
  only the given ports instead of all new TCP connections, hashlimit names
  syn_multi_v6*, add the can_use_hashlimit check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-11 18:50:58 +01:00
chrisandClaude Opus 5.5 93d9af854b ip6t-firewall-server,ipt-firewall-server: HTTP limits only for local webserver; fix several bugs. 
- HTTP(S) connection limits are only created if 'http_server_ips' is set.
  The global SYN rate limit no longer ACCEPTs packets (which opened ports
  80/443 on every host) - it now only drops packets above the limit
  (hashlimit without '--hashlimit-mode'). Ports are opened exclusively by
  the rules for 'http_server_ips'.
- Use '$http_ports' instead of hard coded '80,443' for the limits.
- ipt-firewall-server: use '--connlimit-mask 32' instead of 128. With the
  nf_tables backend mask 128 ended up as mask 0, so the limit applied to
  all clients together instead of per IP. Rename hashlimit 'http_v6' -> 'http_v4'.
- Log rules use their own hashlimit tables ('*_log'), otherwise each packet
  is counted twice when logging is enabled.
- SYN-Overflow log rule now logs packets above (not below) the limit.
- ip6t-firewall-server: clamp TCP MSS for HTTPS on all external interfaces
  instead of hard coded 'eth0'.
- Quote test for 'mm_tcp_ports_in' ('[ -n ${mm_tcp_ports_in} ]' was always true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-02 21:51:16 +01:00
chris 9de4e742cd ip6t-firewall-server,ipt-firewall-server,default_settings.conf: some changes in default values limiting http connections. 2026-11-02 18:10:26 +01:00
chris 57861cb8ec Enhance spoofed packet handling: exclude loopback traffic in IP filtering 2026-10-27 22:30:44 +01:00
chris f6660709ce Enhance IPv6 ban functionality: add dynamic mask handling and prevent banning own addresses 2026-10-27 22:26:12 +01:00
chris fbe10b43d0 main_ipv4.conf.sample,main_ipv6.conf.sample: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_valwq'. 2026-10-27 22:03:27 +01:00
chris 3ad1807cda default_settings.conf: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_val'. 2026-10-27 21:54:38 +01:00
chris 792d0b1b86 Configure limits for HTTPS connections. 2026-10-27 21:18:02 +01:00
chris 560ee66b07 ip6t-firewall-server: Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. ip6t-firewall-server,ipt-firewall-server: add some restrictions on HTTP connections to counteract attacks. 2026-10-26 23:30:18 +01:00
chris 3418073003 Adjust mattermost service - fallback connection to STUN service via tcp. 2026-09-10 19:38:23 +02:00
chris 06b5d5840b Adjust '.claude/settings.json'. 2026-06-29 16:44:43 +02:00
chris 7f47bddc08 Add settings.json to define permissions for ansible operations 2026-06-28 11:34:36 +02:00
chris 85b1e4d2c6 deleted file 'post_decalrations.conf'. 2026-01-19 16:51:33 +01:00
chris a5b66b755b rename post_decalrations.conf -> post_declarations.conf; fix error in handling IPv4 'forward_private_ip_arr'. Fix error setting '/proc/sys/net/ipv4/conf/all/log_martians'. 2026-01-19 16:43:40 +01:00
chris 3d27513b81 ip6t-firewall-server: replace '-m statet --state ..' with '-m conntrack --ctstate ..'. 2026-01-19 16:10:52 +01:00
chris 73122fb0ce ip6t-firewall-server: get rif of debug output/comments. 2026-01-16 10:21:50 +01:00
chris b0804fdfaf Support LX Container on SINMA systems. 2026-01-16 01:40:23 +01:00
chris 7dd1a17e10 Fix error handling bridge devices on host systems. 2026-01-15 17:02:40 +01:00
chris 16eb4d7e0f ip6t-firewall-server: remove rule ' -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP'. 2026-01-15 01:37:46 +01:00
chris 5943f4d1a1 ip6t-firewall-server: a minor change in comments. 2026-01-14 20:10:29 +01:00
chris b35a3f3261 Prepare ip6t-firewall-server for making nftables ready later on. 2026-01-14 17:47:53 +01:00
chris cea43cd7fa Make IPv4 firewall nftables ready. 2026-01-14 17:46:20 +01:00
chris fd2d792d88 ip6t-firewall-server: Fis error. 2026-01-12 20:11:32 +01:00
chris ad136d2fdf main_ipv4.conf.sample,main_ipv6.conf.sample: Fix section Limit Connections - add limit_new_tcp_connections_per_seconds_ports. 2026-01-12 17:42:19 +01:00
chris a37b2c185b make firewall compartible with 'iptables-nf'. 2026-01-11 00:31:22 +01:00
chris 63889b0dc9 LDAP(S): forgot to configure ldap/ldaps standard ports. 2025-08-10 01:56:31 +02:00
chris abef59c769 Allow LDAP/LDAPS out only. 2025-08-10 01:50:23 +02:00
chris 9fd36a8236 Add support for MNDP and mDNS traffic. 2025-02-16 18:48:22 +01:00
chris 24d91d38c6 Add support for MNDP and mDNS traffic. 2025-02-16 18:40:50 +01:00
chris 71e01e8413 logging_ipv[46].conf: add missing parameter 'log_blocked_ip'. 2025-02-15 10:59:53 +01:00
chris aab8585d90 Fix error creating 'smtpd_additional_listen_port_arr'. 2025-01-27 23:10:29 +01:00
chris e6984a622c post_decalrations.conf: fix error creating array 'smtpd_additional_outgoung_port_arr'. 2025-01-27 22:58:30 +01:00
Christoph 409ace650e Merge branch 'master' of https://git.oopen.de/firewall/ipt-server 2025-01-27 22:18:55 +01:00
Christoph 877814caf0 Add support for aditional smtp ports - OUT AND IN. 2025-01-27 22:15:40 +01:00
chris 54ce58a52e replace 'default_ports.conf' with 'default_settings.conf'. 2025-01-27 14:49:47 +01:00
chris 40591462ce Merge branch 'master' of https://git.oopen.de/firewall/ipt-server 2024-12-27 17:27:57 +01:00
chris 3d65233059 ipt-firewall-server: fix error at munin role. 2024-12-27 17:27:28 +01:00
chris dce357a3df /main_ipv4.conf.sample,main_ipv6.conf.sample: Change munin IP address. 2024-12-27 10:53:53 +01:00
chris f0e15b992b Fix error for not firewalled interfaces. 2024-12-24 17:16:35 +01:00
chris e7311a3963 Add Prometheus Service 2024-11-05 17:21:05 +01:00
chris 0eca4f3eaf main_ipv[46].conf.sample: add 'per_IP_connection_limit' parameter. 2024-09-26 15:21:17 +02:00
chris 830f48ff61 Add support for logging CGI script user. 2024-09-14 01:15:52 +02:00
chris bbabeeab27 Add support for PGP/GPG Key server.. 2024-07-24 17:14:04 +02:00
chris 1062208237 ip6t-firewall-server,ipt-firewall-server: move 'Loopback device generally allowed' to an earlier point in the script. 2024-04-08 21:07:51 +02:00
chris d857756be7 ip6t-firewall-server: add '(end of firewall)' to the last reject rule. 2024-04-06 03:20:27 +02:00
chris b183770b91 forgot 'updating conf/include_functions.conf' file. 2024-04-04 19:22:08 +02:00
chris e6566bafeb Some changes in per IP Connection Limit. 2024-04-04 18:57:36 +02:00
chris 2532b116b8 Support user settings for sourvce IP connection limit - ff. 2024-04-04 18:34:28 +02:00
chris 738809ba95 Support user settings for sourvce IP connection limit. 2024-04-04 15:17:31 +02:00
chris 7c00c7783c Add China/Hon Long networks ti nan list. 2024-01-17 11:10:41 +01:00