Merge ddf70ac1cc into 6c88de71d2

ChangeLog

@@ -22,7 +22,7 @@ ver. 1.1.2-dev-1 (20??/??/??) - development nightly edition
 * `filter.d/cowrie.conf` - new filter and jail for Cowrie SSH/Telnet honeypot JSON log output (gh-4216)
 * `filter.d/gitlab.conf` - `logtype` option `json` adding support for the `application_json.log` format that
   superseded the deprecated `application.log`; default type `file` keeps the previous behaviour (gh-3566, gh-4230)
-
+* added Policy Based Routing (pbr) action: more granular blocking compared with 'route' action (gh-3466)
 
 ver. 1.1.1 (2026/08/15) - triple-one-win
 -----------

MANIFEST

@@ -52,6 +52,7 @@ config/action.d/npf.conf
 config/action.d/nsupdate.conf
 config/action.d/osx-afctl.conf
 config/action.d/osx-ipfw.conf
+config/action.d/pbr.conf
 config/action.d/pf.conf
 config/action.d/route.conf
 config/action.d/sendmail-buffered.conf

config/action.d/pbr.conf

@@ -0,0 +1,66 @@
+# Fail2Ban configuration file
+#
+# Author: Konstantin Shalygin <k0ste@k0ste.ru>
+#
+# Policy Based Routing rules
+#
+# Provides the same features, like 'route' action, and fixes the main issue of
+# this hardening blocking: block per ip + service port + service protocol.
+# Actually you can add more options and do more granular blocking, see `ip rule
+# add help`
+
+[Definition]
+actionstart = <pbr_<type>/actionstart>
+actionstop = <pbr_<type>/actionstop>
+actionban = <pbr_<type>/actionban>
+actionunban = <pbr_<type>/actionunban>
+_matchers = <pbr_<type>/match>
+
+[pbr_simple]
+actionstart =
+actionstop =
+actionban = ip route add <blocktype> <_matchers>
+actionunban = ip route del <blocktype> <_matchers>
+match = <ip>
+
+[pbr_allports]
+actionstart = ip route add <blocktype> 0.0.0.0/0 table <tableid>
+actionstop = ip route delete <blocktype> 0.0.0.0/0 table <tableid>
+actionban = ip rule add to <ip> <_matchers> lookup <tableid>
+actionunban = ip rule delete to <ip> <_matchers> lookup <tableid>
+match = ipproto <protocol>
+
+[pbr_multiport]
+actionstart = <pbr_allports/actionstart>
+actionstop = <pbr_allports/actionstop>
+actionban = <pbr_allports/actionban>
+actionunban = <pbr_allports/actionunban>
+match = <pbr_allports/match> sport <port>
+
+[Init]
+# Option:  type
+# Notes.:  type of the action.
+# Values:  [ simple | multiport | allports ]  Default: simple
+#
+type = simple
+
+# Option:  blocktype
+# Note:    Type can be: blackhole, unreachable and prohibit.
+#          Unreachable and prohibit correspond to the ICMP reject messages.
+# Values:  STRING
+blocktype = unreachable
+
+# Option:  tableid
+# Note:    ip route table ID
+# Values:  [ NUM | STRING ]
+tableid = 666
+
+# Option:  port
+# Note:    service port number
+# Values:  [ NUM ]
+port = 22
+
+# Option:  protocol
+# Note:    service protocol
+# Values:  [ STRING ]
+protocol = tcp