chrisandClaude Opus 5.5
affa35def4
- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
(burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
below the limit (which bypassed the service rules, destination IPs and the
HTTP limits); like the HTTP limits it now only logs and drops SYNs above
the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
only the given ports instead of all new TCP connections, hashlimit names
syn_multi_v6*, add the can_use_hashlimit check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# --- # - Install netfilter userspace logging daemon. # --- apt-get install ulogd2 # --- # - Adjust configuration file '/etc/ulogd.conf' # --- # - (1) # - # - Define two new plugin stacks inside '[global]'. # - # - directly after the last "plugin="/usr/lib.." statement add: # - # - # ==================================================================== # - # Define two new plugin stacks inside for iptables logging # - # ==================================================================== # - # - # - # - firewall11 - for IPv4 Firewall # - # - firewall12 - for IPv6 Firewall # - # - # - stack=firewall11:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu11:LOGEMU # - stack=firewall12:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu12:LOGEMU # - vim /etc/ulogd.conf # - (2) # - # - - Define input plugins using above specified netlink group # - - Define output plugins # - cat <<EOF >> /etc/ulogd.conf # ========================================================= # Define input plugins using specified netlink group inside # ========================================================= [firewall11] group=11 [firewall12] group=12 # ===================== # Define output plugins # ===================== [emu11] file="/var/log/ulog/iptables.log" sync=1 [emu12] file="/var/log/ulog/ip6tables.log" sync=1 EOF # - Restart ulog daemon # systemctl restart ulogd