mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-22 22:30:58 +01:00
Parameterize the standard default actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
parent
3dd363677c
commit
68bf99ec69
@ -18,6 +18,26 @@
|
||||
# IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
|
||||
#
|
||||
###############################################################################
|
||||
FORMAT 2
|
||||
|
||||
BEGIN PERL
|
||||
use Shorewall::Config;
|
||||
|
||||
my $p1 = read_action_param(1);
|
||||
|
||||
if ( defined $p1 && $p1 eq 'audit' ) {
|
||||
my ( $p2, $p3 ) = ( read_action_param(2) , read_action_param(3) );
|
||||
|
||||
set_action_param( 2, 'A_DROP') unless defined $p2;
|
||||
set_action_param( 3, 'A_REJECT') unless defined $p3;
|
||||
};
|
||||
|
||||
1;
|
||||
|
||||
END PERL
|
||||
|
||||
DEFAULTS -,DROP,REJECT
|
||||
|
||||
#TARGET SOURCE DEST PROTO DPORT SPORT
|
||||
#
|
||||
# Count packets that come through here
|
||||
@ -26,31 +46,31 @@ COUNT
|
||||
#
|
||||
# Reject 'auth'
|
||||
#
|
||||
Auth(REJECT)
|
||||
Auth($3)
|
||||
#
|
||||
# Don't log broadcasts
|
||||
#
|
||||
dropBcast
|
||||
dropBcast($1)
|
||||
#
|
||||
# ACCEPT critical ICMP types
|
||||
#
|
||||
AllowICMPs - - icmp
|
||||
AllowICMPs($1) - - icmp
|
||||
#
|
||||
# Drop packets that are in the INVALID state -- these are usually ICMP packets
|
||||
# and just confuse people when they appear in the log.
|
||||
#
|
||||
dropInvalid
|
||||
dropInvalid($1)
|
||||
#
|
||||
# Drop Microsoft noise so that it doesn't clutter up the log.
|
||||
#
|
||||
SMB(DROP)
|
||||
DropUPnP
|
||||
SMB($2)
|
||||
DropUPnP($1)
|
||||
#
|
||||
# Drop 'newnotsyn' traffic so that it doesn't get logged.
|
||||
#
|
||||
dropNotSyn - - tcp
|
||||
dropNotSyn($1) - - tcp
|
||||
#
|
||||
# Drop late-arriving DNS replies. These are just a nuisance and clutter up
|
||||
# the log.
|
||||
#
|
||||
DropDNSrep
|
||||
DropDNSrep($1)
|
||||
|
@ -14,6 +14,26 @@
|
||||
#
|
||||
# IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
|
||||
###############################################################################
|
||||
FORMAT 2
|
||||
|
||||
BEGIN PERL
|
||||
use Shorewall::Config;
|
||||
|
||||
my $p1 = read_action_param(1);
|
||||
|
||||
if ( defined $p1 && $p1 eq 'audit' ) {
|
||||
my ( $p2, $p3 ) = ( read_action_param(2) , read_action_param(3) );
|
||||
|
||||
set_action_param( 2, 'A_DROP') unless defined $p2;
|
||||
set_action_param( 3, 'A_REJECT') unless defined $p3;
|
||||
};
|
||||
|
||||
1;
|
||||
|
||||
END PERL
|
||||
|
||||
DEFAULTS -,REJECT,REJECT
|
||||
|
||||
#TARGET SOURCE DEST PROTO
|
||||
#
|
||||
# Count packets that come through here
|
||||
@ -22,33 +42,33 @@ COUNT
|
||||
#
|
||||
# Don't log 'auth' -- REJECT
|
||||
#
|
||||
Auth(REJECT)
|
||||
Auth($3)
|
||||
#
|
||||
# Drop Broadcasts so they don't clutter up the log
|
||||
# (broadcasts must *not* be rejected).
|
||||
#
|
||||
dropBcast
|
||||
dropBcast($1)
|
||||
#
|
||||
# ACCEPT critical ICMP types
|
||||
#
|
||||
AllowICMPs - - icmp
|
||||
AllowICMPs($1) - - icmp
|
||||
#
|
||||
# Drop packets that are in the INVALID state -- these are usually ICMP packets
|
||||
# and just confuse people when they appear in the log (these ICMPs cannot be
|
||||
# rejected).
|
||||
#
|
||||
dropInvalid
|
||||
dropInvalid($1)
|
||||
#
|
||||
# Reject Microsoft noise so that it doesn't clutter up the log.
|
||||
#
|
||||
SMB(REJECT)
|
||||
DropUPnP
|
||||
SMB($2)
|
||||
DropUPnP($1)
|
||||
#
|
||||
# Drop 'newnotsyn' traffic so that it doesn't get logged.
|
||||
#
|
||||
dropNotSyn - - tcp
|
||||
dropNotSyn($1) - - tcp
|
||||
#
|
||||
# Drop late-arriving DNS replies. These are just a nuisance and clutter up
|
||||
# the log.
|
||||
#
|
||||
DropDNSrep
|
||||
DropDNSrep($1)
|
||||
|
Loading…
Reference in New Issue
Block a user