Alan Orth
9bba0d96bb
I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
28 lines
901 B
Desktop File
28 lines
901 B
Desktop File
[Unit]
|
|
Description=Update Spamhaus lists
|
|
# This service will fail if nftables is not running so we use Requires to make
|
|
# sure that nftables is started.
|
|
Requires=nftables.service
|
|
# Make sure the network is up and nftables is started
|
|
After=network-online.target nftables.service
|
|
Wants=network-online.target update-spamhaus-nftables.timer
|
|
|
|
[Service]
|
|
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
|
# Doesn't need access to /home or /root
|
|
ProtectHome=true
|
|
# Possibly only works on Ubuntu 18.04+
|
|
ProtectKernelTunables=true
|
|
ProtectSystem=full
|
|
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
|
ReadWriteDirectories=/etc/nftables
|
|
PrivateTmp=true
|
|
WorkingDirectory=/var/tmp
|
|
|
|
SyslogIdentifier=update-spamhaus-nftables
|
|
ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
|
|
/usr/local/bin/update-spamhaus-nftables.sh
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|