firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
151 Commits 1 Branch 0 Tags
f0187f041d063f6921ee9f5920fd2901427e3f3e
Commit Graph
75 Commits
Author SHA1 Message Date
chrisandClaude Opus 5.5 f0187f041d logging_ipv{4,6}.conf: detect ulogd2 via systemd instead of ps. 
ps also lists the ulogd of LXC containers (which do not receive the NFLOG
packets of the host) and misses ulogd2 if the firewall starts first at boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-11 23:17:04 +01:00
chrisandClaude Opus 5.5 affa35def4 Limit of new TCP connections per source IP: configurable rate, drop only above the limit. 
- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
  (burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
  below the limit (which bypassed the service rules, destination IPs and the
  HTTP limits); like the HTTP limits it now only logs and drops SYNs above
  the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
  syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
  only the given ports instead of all new TCP connections, hashlimit names
  syn_multi_v6*, add the can_use_hashlimit check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-11 18:50:58 +01:00
chris 9de4e742cd ip6t-firewall-server,ipt-firewall-server,default_settings.conf: some changes in default values limiting http connections. 2026-11-02 18:10:26 +01:00
chris 57861cb8ec Enhance spoofed packet handling: exclude loopback traffic in IP filtering 2026-10-27 22:30:44 +01:00
chris f6660709ce Enhance IPv6 ban functionality: add dynamic mask handling and prevent banning own addresses 2026-10-27 22:26:12 +01:00
chris fbe10b43d0 main_ipv4.conf.sample,main_ipv6.conf.sample: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_valwq'. 2026-10-27 22:03:27 +01:00
chris 3ad1807cda default_settings.conf: fix variablen namimg - change 'default_min_tcp6_mss_for_https_val' to 'min_tcp6_mss_for_https_val'. 2026-10-27 21:54:38 +01:00
chris 792d0b1b86 Configure limits for HTTPS connections. 2026-10-27 21:18:02 +01:00
chris 3418073003 Adjust mattermost service - fallback connection to STUN service via tcp. 2026-09-10 19:38:23 +02:00
chris 85b1e4d2c6 deleted file 'post_decalrations.conf'. 2026-01-19 16:51:33 +01:00
chris a5b66b755b rename post_decalrations.conf -> post_declarations.conf; fix error in handling IPv4 'forward_private_ip_arr'. Fix error setting '/proc/sys/net/ipv4/conf/all/log_martians'. 2026-01-19 16:43:40 +01:00
chris 7dd1a17e10 Fix error handling bridge devices on host systems. 2026-01-15 17:02:40 +01:00
chris cea43cd7fa Make IPv4 firewall nftables ready. 2026-01-14 17:46:20 +01:00
chris ad136d2fdf main_ipv4.conf.sample,main_ipv6.conf.sample: Fix section Limit Connections - add limit_new_tcp_connections_per_seconds_ports. 2026-01-12 17:42:19 +01:00
chris a37b2c185b make firewall compartible with 'iptables-nf'. 2026-01-11 00:31:22 +01:00
chris 63889b0dc9 LDAP(S): forgot to configure ldap/ldaps standard ports. 2025-08-10 01:56:31 +02:00
chris 24d91d38c6 Add support for MNDP and mDNS traffic. 2025-02-16 18:40:50 +01:00
chris 71e01e8413 logging_ipv[46].conf: add missing parameter 'log_blocked_ip'. 2025-02-15 10:59:53 +01:00
chris e6984a622c post_decalrations.conf: fix error creating array 'smtpd_additional_outgoung_port_arr'. 2025-01-27 22:58:30 +01:00
Christoph 877814caf0 Add support for aditional smtp ports - OUT AND IN. 2025-01-27 22:15:40 +01:00
chris dce357a3df /main_ipv4.conf.sample,main_ipv6.conf.sample: Change munin IP address. 2024-12-27 10:53:53 +01:00
chris f0e15b992b Fix error for not firewalled interfaces. 2024-12-24 17:16:35 +01:00
chris e7311a3963 Add Prometheus Service 2024-11-05 17:21:05 +01:00
chris 0eca4f3eaf main_ipv[46].conf.sample: add 'per_IP_connection_limit' parameter. 2024-09-26 15:21:17 +02:00
chris 830f48ff61 Add support for logging CGI script user. 2024-09-14 01:15:52 +02:00
chris b183770b91 forgot 'updating conf/include_functions.conf' file. 2024-04-04 19:22:08 +02:00
chris e6566bafeb Some changes in per IP Connection Limit. 2024-04-04 18:57:36 +02:00
chris 738809ba95 Support user settings for sourvce IP connection limit. 2024-04-04 15:17:31 +02:00
chris 7c00c7783c Add China/Hon Long networks ti nan list. 2024-01-17 11:10:41 +01:00
chris ce0ee2d243 Add variables for lx guest system ip's. 2023-05-02 22:26:40 +02:00
chris 8e64cc36ac some minor changes.. 2023-05-02 21:45:43 +02:00
chris 536aea7d97 change defaut value for '+do_not_firewall_lx_guest_systems' to false. 2023-05-02 21:37:47 +02:00
chris ff098ac058 Add rule to prevent LX containers from firewalld on host system. 2023-05-02 20:45:27 +02:00
chris a2ba79185d main_ipv6.conf.sample: change default value of 'mm_service_ips' to an empty one. 2023-01-24 18:17:01 +01:00
chris 486789c6b5 Add support for MatterMost (MM) service. 2023-01-24 17:42:27 +01:00
chris 9f016b1776 Add support for routing networks through wireguard connections. 2022-08-12 01:16:53 +02:00
chris 0831f26891 Add support for WireGuard VPN Service. 2022-08-11 10:43:04 +02:00
chris c78edd01be Drop traffic on extern interfaces iinto private networks. 2021-09-02 12:07:25 +02:00
chris 5ec7c9bcea Add support for dhclient. 2021-01-11 19:59:08 +01:00
chris e68705c819 some minor changes on file 'main_ipv6.conf.sample'. 2020-11-04 16:25:14 +01:00
chris 35d3ffeded Some minor changes.. 2020-10-30 13:56:34 +01:00
chris bcdee40228 Changing rules for protection against several ddos attacks. 2020-10-28 20:57:08 +01:00
chris 498b34741c Add support for Portforwarding TCP/UDP using socat. 2020-06-03 14:10:27 +02:00
chris 53de5746cf Support Streaming via YouTube. 2020-05-17 17:56:23 +02:00
chris fbe1089099 add support for Jibri Streamin/Recording. 2020-05-16 13:42:22 +02:00
chris b24dcf0a3d load_modules_ipv6.conf: load module 'br_netfilter'. 2020-04-30 10:40:01 +02:00
chris ac6845a8fd Merge branch 'master' of https://git.oopen.de/firewall/ipt-server 2020-04-27 21:43:42 +02:00
chris 2ebeae6479 Change default munin remote ip. 2020-04-27 21:43:14 +02:00
chris cf999b48fc Merge branch 'master' of git.oopen.de:firewall/ipt-server 2020-04-27 16:23:18 +02:00
chris 3627c5169b main_ipv[46].con: minor changes at comments for DND/Resolver Service. 2020-04-27 16:23:02 +02:00