From ddf70ac1ccb72d7cd1140d4c0626fba24f6683e5 Mon Sep 17 00:00:00 2001 From: Konstantin Shalygin Date: Wed, 22 Feb 2023 17:31:12 +0700 Subject: [PATCH] feat: added Policy Based Routing (pbr) action More granular blocking compared with 'route' action The main diffence is that possible to block single service port, instead of blocking whole IP address. How this works When `banaction` is success, the `` will be added to ip rules: ```bash [root@host /]# ip rule list | grep 211.245.106.55 185: from all to 211.245.106.55 ipproto tcp sport 22 lookup 666 ``` As we can see, only `sshd` service will be blocked for this `` We can check this ```bash [root@host /]# ip route get 211.245.106.55 211.245.106.55 via 192.168.102.1 dev po1 src 192.168.102.254 uid 0 ``` The output for this `` is not blocked But `sshd` service for this `` will be banned ```bash [root@host /]# ip ro get 211.245.106.55 sport 22 ipproto tcp RTNETLINK answers: No route to host ``` --- ChangeLog | 2 +- MANIFEST | 1 + config/action.d/pbr.conf | 66 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 68 insertions(+), 1 deletion(-) create mode 100644 config/action.d/pbr.conf diff --git a/ChangeLog b/ChangeLog index 32f2dec0..abc1e4c9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -22,7 +22,7 @@ ver. 1.1.2-dev-1 (20??/??/??) - development nightly edition * `filter.d/cowrie.conf` - new filter and jail for Cowrie SSH/Telnet honeypot JSON log output (gh-4216) * `filter.d/gitlab.conf` - `logtype` option `json` adding support for the `application_json.log` format that superseded the deprecated `application.log`; default type `file` keeps the previous behaviour (gh-3566, gh-4230) - +* added Policy Based Routing (pbr) action: more granular blocking compared with 'route' action (gh-3466) ver. 1.1.1 (2026/08/15) - triple-one-win ----------- diff --git a/MANIFEST b/MANIFEST index 5fbd4e10..d3eebcac 100644 --- a/MANIFEST +++ b/MANIFEST @@ -52,6 +52,7 @@ config/action.d/npf.conf config/action.d/nsupdate.conf config/action.d/osx-afctl.conf config/action.d/osx-ipfw.conf +config/action.d/pbr.conf config/action.d/pf.conf config/action.d/route.conf config/action.d/sendmail-buffered.conf diff --git a/config/action.d/pbr.conf b/config/action.d/pbr.conf new file mode 100644 index 00000000..ac9a0b1d --- /dev/null +++ b/config/action.d/pbr.conf @@ -0,0 +1,66 @@ +# Fail2Ban configuration file +# +# Author: Konstantin Shalygin +# +# Policy Based Routing rules +# +# Provides the same features, like 'route' action, and fixes the main issue of +# this hardening blocking: block per ip + service port + service protocol. +# Actually you can add more options and do more granular blocking, see `ip rule +# add help` + +[Definition] +actionstart = /actionstart> +actionstop = /actionstop> +actionban = /actionban> +actionunban = /actionunban> +_matchers = /match> + +[pbr_simple] +actionstart = +actionstop = +actionban = ip route add <_matchers> +actionunban = ip route del <_matchers> +match = + +[pbr_allports] +actionstart = ip route add 0.0.0.0/0 table +actionstop = ip route delete 0.0.0.0/0 table +actionban = ip rule add to <_matchers> lookup +actionunban = ip rule delete to <_matchers> lookup +match = ipproto + +[pbr_multiport] +actionstart = +actionstop = +actionban = +actionunban = +match = sport + +[Init] +# Option: type +# Notes.: type of the action. +# Values: [ simple | multiport | allports ] Default: simple +# +type = simple + +# Option: blocktype +# Note: Type can be: blackhole, unreachable and prohibit. +# Unreachable and prohibit correspond to the ICMP reject messages. +# Values: STRING +blocktype = unreachable + +# Option: tableid +# Note: ip route table ID +# Values: [ NUM | STRING ] +tableid = 666 + +# Option: port +# Note: service port number +# Values: [ NUM ] +port = 22 + +# Option: protocol +# Note: service protocol +# Values: [ STRING ] +protocol = tcp