Alan Orth
00558c7dea
Re-work the fail2ban and nftables interaction. Use systemd's PartOf to indicate that fail2ban is part of the nftables service, which tells systemd to propogate stop/start signals to it. Then we tell the firehol update script to restart nftables instead of reload. The different between restart and reload is meaningless for nftables but we want systemd to propagate the stop/start signals to fail2ban.
66 lines
1.8 KiB
Django/Jinja
Executable File
66 lines
1.8 KiB
Django/Jinja
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# update-firehol-nftables.sh v0.0.1
|
|
#
|
|
# Download FireHOL lists and load them into nftables sets.
|
|
#
|
|
# See: https://iplists.firehol.org/
|
|
#
|
|
# Copyright (C) 2025 Alan Orth
|
|
#
|
|
# SPDX-License-Identifier: GPL-3.0-only
|
|
|
|
# Exit on first error
|
|
set -o errexit
|
|
|
|
firehol_level1_ipv4_set_path=/etc/nftables/firehol_level1-ipv4.nft
|
|
|
|
function download() {
|
|
echo "Downloading $1"
|
|
wget -q -O - "https://iplists.firehol.org/files/$1" > "$1"
|
|
}
|
|
|
|
download firehol_level1.netset
|
|
|
|
if [[ -f "firehol_level1.netset" ]]; then
|
|
echo "Processing FireHOL Level 1 list"
|
|
|
|
firehol_level1_ipv4_list_temp=$(mktemp)
|
|
firehol_level1_ipv4_set_temp=$(mktemp)
|
|
|
|
# Filter blank lines, comments, and bogons we use inside the LAN, DMZ, and
|
|
# for local services like systemd-resolved and others on localhost. Ideally
|
|
# these are blocked already at the WAN side by network administrators.
|
|
cat firehol_level1.netset \
|
|
| sed \
|
|
-e '/^$/d' \
|
|
-e '/^#.*/d' \
|
|
-e '/^127\.0\.0\.0\/8/d' \
|
|
> "$firehol_level1_ipv4_list_temp"
|
|
|
|
echo "Building firehol_level1-ipv4 set"
|
|
cat << NFT_HEAD > "$firehol_level1_ipv4_set_temp"
|
|
#!/usr/sbin/nft -f
|
|
|
|
define FIREHOL_LEVEL1_IPV4 = {
|
|
NFT_HEAD
|
|
|
|
while read -r network; do
|
|
# nftables doesn't mind if the last element in the set has a trailing
|
|
# comma so we don't need to do anything special here.
|
|
echo "$network," >> "$firehol_level1_ipv4_set_temp"
|
|
done < $firehol_level1_ipv4_list_temp
|
|
|
|
echo "}" >> "$firehol_level1_ipv4_set_temp"
|
|
|
|
install -m 0600 "$firehol_level1_ipv4_set_temp" "$firehol_level1_ipv4_set_path"
|
|
|
|
rm -f "$firehol_level1_ipv4_list_temp" "$firehol_level1_ipv4_set_temp"
|
|
fi
|
|
|
|
echo "Restarting nftables"
|
|
|
|
/usr/bin/systemctl restart nftables.service
|
|
|
|
rm -v firehol_level1.netset
|