Puppet Class: iptables::rules::scanblock
- Defined in:
- manifests/rules/scanblock.pp
Overview
Provide a method for setting up an iptables electric fence
Any host that makes it past all of your allow rules will be added to the ban list.
WARNING
If you enable this, be sure to enable your IPTables rules prior to connecting with a client or you're likely to completely deny your internal hosts.
WARNING
NOTE: Changing any of the
ip_*
variables will cause the iptables service to be
triggered. This is because the variables cannot take effect until the
iptables rules are reset.
Management
Details on managing xt_recent can be found in iptables(8)
. The
following are just some useful commands.
-
Add address to list
echo +addr >/proc/net/xt_recent/LIST_NAME
-
Remove address from list
echo -addr >/proc/net/xt_recent/LIST_NAME
-
Remove all address from list
echo / >/proc/net/xt_recent/LIST_NAME
91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 |
# File 'manifests/rules/scanblock.pp', line 91
class iptables::rules::scanblock (
Boolean $enable = true,
Integer[0] $seconds = 60,
Integer[0] $hitcount = 2,
Boolean $set_rttl = false,
Integer[0] $update_interval = 3600,
Integer[0] $logs_per_minute = 5,
Integer[0] $ip_list_tot = 200,
Integer[0] $ip_pkt_list_tot = 20,
Integer[0] $ip_list_hash_size = 0,
String $ip_list_perms = '0640',
Integer[0] $ip_list_uid = 0,
Integer[0] $ip_list_gid = 0
) {
assert_private()
if $set_rttl {
$_rttl = '--rttl'
}
else {
$_rttl = ''
}
if $enable {
iptables_rule{'scanblock':
order => 28,
header => false,
apply_to => 'all',
# lint:ignore:only_variable_string
content => @("EOM")
-A LOCAL-INPUT -m recent --update --seconds ${update_interval} --name BANNED --rsource -j DROP
-A LOCAL-INPUT -m state --state NEW -j ATTK_CHECK
-A ATTACKED -m limit --limit ${logs_per_minute}/min -j LOG --log-prefix "IPT: (Rule ATTACKED): "
-A ATTACKED -m recent --set --name BANNED --rsource -j DROP
-A ATTK_CHECK -m recent --set --name ATTK --rsource
-A ATTK_CHECK -m recent --update --seconds ${seconds} --hitcount ${hitcount} ${_rttl} --name ATTK --rsource -j ATTACKED
|EOM
}
# lint:endignore
}
class { 'iptables::rules::mod_recent':
ip_list_tot => $ip_list_tot,
ip_pkt_list_tot => $ip_pkt_list_tot,
ip_list_hash_size => $ip_list_hash_size,
ip_list_perms => $ip_list_perms,
ip_list_uid => $ip_list_uid,
ip_list_gid => $ip_list_gid,
notify_iptables => true
}
}
|