+##
+## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
+##
+
# -*- shell-script -*-
-#
-# Configuration file for ferm(1).
-#
@include 'conf.d/';
+domain ip {
+ table filter {
+ chain log_and_reject {
+ ULOG ulog-prefix "REJECT: ";
+ proto tcp REJECT reject-with tcp-reset;
+ REJECT;
+ }
+
+ chain log_or_drop {
+ mod hashlimit hashlimit-name ulogreject hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
+ mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second ULOG ulog-prefix "DROP: ";
+ DROP;
+ }
+
+ }
+}
+domain ip6 {
+ table filter {
+ chain log_and_reject {
+ LOG log-prefix "REJECT: ";
+ proto tcp REJECT reject-with tcp-reset;
+ REJECT;
+ }
+
+ chain log_or_drop {
+ mod hashlimit hashlimit-name logreject hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
+ mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second LOG log-prefix "DROP: ";
+ DROP;
+ }
+ }
+}
domain (ip ip6) {
- chain INPUT {
- policy DROP;
- mod state state (ESTABLISHED RELATED) ACCEPT;
- interface lo ACCEPT;
- proto icmp ACCEPT;
- proto (tcp udp) mod state state (INVALID) DROP;
- }
+ table filter {
+ chain INPUT {
+ policy DROP;
+ mod state state (ESTABLISHED RELATED) ACCEPT;
+ interface lo ACCEPT;
+ proto icmp ACCEPT;
+ mod state state (INVALID) DROP;
+ }
+ }
}
@include 'dsa.d/';
+
+domain (ip ip6) {
+ chain INPUT {
+ proto (tcp udp) mod multiport destination-ports (135 137 138 139 445 1026 1027 1433) DROP;
+ jump log_or_drop;
+ }
+}