adam/housecarl
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

Ban lists: where Guard and fail2ban ban addresses

Browse Source 
A program bans an address (every port, or a protocol's ports) for a
time; the ban list says what it is kept from: the firewall, some hosts
behind it, or everything. Bans drop ahead of every rule, close the
address's connections, group IPv6 by /64, are kept in the database
across restarts and audited. Never banned: the inside, the firewall's
own addresses, the caller, the list's never. bans grant (bans:write:LIST),
hc banlist/bans/ban/unban, Traffic -> Bans, a fail2ban action in contrib/,
and failed logins and refused tokens logged for Guard and fail2ban.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed 2026-10-22 16:29:37 +01:00
1 parent 6f56eefae2
commit 500bfc7bdd
44 files changed
+2541 -39
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/validate/validate_test.go
+13 -1
View File
@@ -24,7 +24,8 @@ func base() *model.State {
},
Forwards: []*model.PortForward{{ID: 7, Position: 1, Name: "jellyfin", Protocols: []string{"tcp"}, Ports: "8096", To: "10.0.10.57",
PublicAddresses: []string{"203.0.113.7"}, Hairpin: true}},
SNATs: []*model.SourceNAT{{ID: 8, Position: 1, Match: model.Match{OutZones: []string{"wan"}, Sources: []string{"trusted"}}}},
SNATs: []*model.SourceNAT{{ID: 8, Position: 1, Match: model.Match{OutZones: []string{"wan"}, Sources: []string{"trusted"}}}},
BanLists: []*model.BanList{{ID: 9, Name: "web", Scope: model.BanScopeHosts, Hosts: []string{"10.0.10.57"}, Never: []string{"trusted"}}},
}
}
@@ -136,6 +137,17 @@ func TestCodes(t *testing.T) {
{"redirect_service", func(st *model.State) {
st.Redirects = []*model.Redirect{{ID: 11, Position: 1, Match: model.Match{InZones: []string{"lan"}}}}
}},
{"banlist_name", func(st *model.State) { st.BanLists[0].Name = "web list" }},
{"banlist_scope", func(st *model.State) { st.BanLists[0].Scope = "world" }},
{"banlist_hosts", func(st *model.State) { st.BanLists[0].Hosts = nil }},
{"banlist_hosts", func(st *model.State) { st.BanLists[0].Scope = model.BanScopeFirewall }},
{"banlist_address", func(st *model.State) { st.BanLists[0].Never = []string{"10.0.0.300"} }},
{"unknown_set", func(st *model.State) { st.BanLists[0].Hosts = []string{"webservers"} }},
{"banlist_time", func(st *model.State) { st.BanLists[0].MaxTime = -2 }},
{"banlist_time", func(st *model.State) { st.BanLists[0].DefaultTime, st.BanLists[0].MaxTime = 7200, 3600 }},
{"banlist_entries", func(st *model.State) { st.BanLists[0].MaxEntries = -1 }},
{"banlist_group", func(st *model.State) { st.BanLists[0].GroupV6 = 8 }},
{"set_name_reserved", func(st *model.State) { st.Sets[0].Name = "ban_3" }},
{"redirect_to_port", func(st *model.State) {
st.Redirects = []*model.Redirect{{ID: 11, Position: 1, Match: model.Match{InZones: []string{"lan"}, Services: []string{"dns"}}, ToPort: "53-54"}}
}},