Shorewall supports two different forms of blacklisting; static and dynamic.
Shorewall static blacklisting support has the following configuration parameters:
| You specify whether you want packets from blacklisted hosts dropped or rejected using the BLACKLIST_DISPOSITION setting in /etc/shorewall/shorewall.conf |
| You specify whether you want packets from blacklisted hosts logged and at what syslog level using the BLACKLIST_LOGLEVEL setting in /etc/shorewall/shorewall.conf |
| You list the IP addresses/subnets that you wish to blacklist in /etc/shorewall/blacklist |
| You specify the interfaces whose incoming packets you want checked against the blacklist using the "blacklist" option in /etc/shorewall/interfaces. |
| The black list is refreshed from /etc/shorewall/blacklist by the "shorewall refresh" command. |
Dynamic blacklisting support was added in version 1.3.2. Dynamic blacklisting doesn't use any configuration parameters but is rather controlled using /sbin/shorewall commands:
| deny <ip address list> - causes packets from the listed IP addresses to be silently dropped by the firewall. |
| reject <ip address list> - causes packets from the listed IP addresses to be rejected by the firewall. |
| allow <ip address list> - re-enables receipt of packets from hosts previously blacklisted by a deny or reject command. |
| save - save the dynamic blacklisting configuration so that it will be automatically restored the next time that the firewall is restarted. |
| show dynamic - displays the dynamic blacklisting configuration. |
Example 1:
shorewall deny 192.0.2.124 192.0.2.125
Drops packets from hosts 192.0.2.124 and 192.0.2.125
Example 2:
shorewall allow 192.0.2.125
Reenables access from 192.0.2.125.
Last updated 6/16/2002 - Tom Eastep