From d7b7f4bc91be34e80b48c05c86913fc0d4d168d4 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 8 Jan 2015 21:06:43 -0500 Subject: [PATCH 1/3] Update firewallcmd-allports.conf --- config/action.d/firewallcmd-allports.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf index c0c378a4..ce83164b 100644 --- a/config/action.d/firewallcmd-allports.conf +++ b/config/action.d/firewallcmd-allports.conf @@ -8,6 +8,8 @@ before = iptables-blocktype.conf +[Definition] + actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b- firewall-cmd --direct --add-rule ipv4 filter f2b- 1000 -j RETURN firewall-cmd --direct --add-rule ipv4 filter 0 -j f2b- From 0fac7e40b6caa6c4bad64bc3e2095c304b3c0faa Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Sat, 14 Feb 2015 12:31:33 -0500 Subject: [PATCH 2/3] Update firewallcmd-multiport.conf --- config/action.d/firewallcmd-multiport.conf | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf index da73f9f1..4d806e6b 100644 --- a/config/action.d/firewallcmd-multiport.conf +++ b/config/action.d/firewallcmd-multiport.conf @@ -17,10 +17,9 @@ actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state firewall-cmd --direct --remove-rules ipv4 filter f2b- firewall-cmd --direct --remove-chain ipv4 filter f2b- -# Note: uses regular expression whitespaces '\s' & end of line '$' -# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-apache-modsecurity$' +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$' -actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-$' +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-$' actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j @@ -59,6 +58,6 @@ protocol = tcp # $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity # success # actioncheck: -# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | grep -q '\sf2b-apache-modsecurity$' +# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$' # f2b-apache-modsecurity From b4f1f613bb40edfa01a81a6f47584ddb00c00689 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Sat, 14 Feb 2015 12:32:36 -0500 Subject: [PATCH 3/3] Update firewallcmd-allports.conf --- config/action.d/firewallcmd-allports.conf | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf index ce83164b..ec52babb 100644 --- a/config/action.d/firewallcmd-allports.conf +++ b/config/action.d/firewallcmd-allports.conf @@ -19,10 +19,9 @@ actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -j f2b- -# Note: uses regular expression whitespaces '\s' & end of line '$' -# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-recidive$' +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$' -actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-$' +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-$' actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j