diff --git a/config/action.d/iptables-ipset-proto6-allports.conf b/config/action.d/iptables-ipset-proto6-allports.conf new file mode 100644 index 00000000..ac3c8b56 --- /dev/null +++ b/config/action.d/iptables-ipset-proto6-allports.conf @@ -0,0 +1,64 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# +# This is for ipset protocol 6 (and hopefully later) (ipset v6.14). +# Use ipset -V to see the protocol and version. Version 4 should use +# iptables-ipset-proto4.conf. +# +# This requires the program ipset which is normally in package called ipset. +# +# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels. +# +# If you are running on an older kernel you make need to patch in external +# modules which probably won't be protocol version 6. + +[INCLUDES] + +before = iptables-blocktype.conf + + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = ipset create fail2ban- hash:ip timeout + iptables -I INPUT -m set --match-set fail2ban- src -j DROP + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = iptables -D INPUT -m set --match-set fail2ban- src -j DROP + ipset flush fail2ban- + ipset destroy fail2ban- + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = ipset add fail2ban- timeout -exist + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = ipset del fail2ban- -exist + +[Init] + +# Default name of the ipset +# +name = default + +# Option: bantime +# Notes: specifies the bantime in seconds (handled internally rather than by fail2ban) +# Values: [ NUM ] Default: 600 + +bantime = 600