I was trying to implement this "ipset" solution and I keep hitting a brick wall. I'm no expert on this, so I was hoping for some guidance. I have searched and searched trying to find the solution but to no avail.
In the Shorewall dump I have the following (which from some documentation seems to be correct, and what I need):- Ipset Match (IPSET_MATCH): Available Ipset Match Counters (IPSET_MATCH_COUNTERS): Available Ipset Match Nomatch (IPSET_MATCH_NOMATCH): Available ipset V5 (IPSET_V5): Available But following this post, when I try and change "DYNAMIC_BLACKLIST" it always errors out. (Tried both solutions in email) ERROR: Invalid value (ipset-only,timeout=3600::info) for DYNAMIC_BLACKLIST or ERROR: Invalid value (ipset-only,timeout=3600) for DYNAMIC_BLACKLIST I'd be very grateful if someone could point me in the right direction as to what I am doing wrong. Many Thanks - Nigel On 11/28/2016 6:06 AM, Vieri Di Paola wrote:
________________________________ From: Tom Eastep <teas...@shorewall.net>Configure ipset-based dynamic blacklisting:> > DYNAMIC_BLACKLIST=ipset-only,timeout=3600::info then put this at the bottom of your rules: ADD(SW_DBL4,src) net $FWI believe the seperator is : instead of ,. I have this now in rules: ADD(SW_DBL4:src) net1 $FW ADD(SW_DBL4:src) net2 $FW ADD(SW_DBL4:src) net3 $FW and this in shorewall.conf: DYNAMIC_BLACKLIST=ipset-only,timeout=3600 ipset list SW_DBL4 shows that the set is growing fast... I understand there's no special flag requirement for net "interfaces", not even "blacklist" as we're using ipsets here, not files. Thanks, Vieri ------------------------------------------------------------------------------ _______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
-- from the desk of Nigel http://soft-focus-imagining.com http://twin-peaks-video.com
<<attachment: nigel.vcf>>
------------------------------------------------------------------------------
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
