Home | History | Annotate | Line # | Download | only in etc 
      1 #========================================
      2 #
      3 #	subsection for abuse blocking
      4 #
      5 #========================================
      6 #
      7 # This section should be included early in the main /etc/ipf.conf file, right
      8 # after any basic generic accounting ("count") rules, and any cleanup rules to
      9 # block invalid fragments, invalid options (e.g. "ssrr"), etc.
     10 #
     11 # Note these will not actually block anything since they don't include the
     12 # "quick" flag, and are thus part of a last-match group.  They simply set up a
     13 # group such that any connection logging rule further below won't also match if
     14 # one of the rules in the group matches, no matter when or where the subsequent
     15 # matching rule is added.  I.e. all rules in the group are checked for a match
     16 # (and a possible "first match" with "quick") before any subsequent rules
     17 # further below are used.  Note group rules can be added at any time, including
     18 # at runtime after all other rules have been added -- they will still belong to
     19 # the group and once added will be checked as part of the group.
     20 #
     21 #	head of "blocklistd" group:
     22 #
     23 # The "blocklistd" group will be used by blocklistd(8).
     24 #
     25 block in proto tcp/udp from any to any head blocklistd
     26 #
     27 #	head of "attackers" group to block all attackers:
     28 #
     29 # The "attackers" group is intended to be used for manually maintained rules
     30 # e.g. as could be added like this:
     31 #
     32 #	echo 'block return-rst in log quick proto tcp from 118.136.0.0/15 to any flags S/SAFR group attackers' >> /etc/ipf.conf
     33 #	/etc/rc.d/ipfliter reload
     34 #
     35 # Note the choice in this example is to return RST packets for blocked SYN
     36 # packets to help the other end close.  This is not necessary, but it better
     37 # mimics what the kernel does by default, thus perhaps hiding the fact a
     38 # firewall is present.
     39 #
     40 # XXX This example still allows UDP services, but we would need to duplicate
     41 # each rule with "proto udp" (and without "flags blah") due to IPF parsing
     42 # limitations....
     43 #
     44 block in proto tcp/udp from any to any head attackers
     45 #
     46