Giters

crowdsecurity / cs-firewall-bouncer

Crowdsec bouncer written in golang for firewalls

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

State-tracking

hoerup opened this issue · comments

commented

I would like for firewall bouncer to have the option for allowing inbound packages relating to allready established (outbound) connections

eg a enable_state_tracking option that when enabled starts with injecting a
iptables --append INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

commented

Then best way would be switch the mode to ipset and then create the firewall rules yourself. As the firewall bouncer will always prepend the chains with the drop rule.

EDIT: Or alter the service file to prepend the chain after the service starts

ExecStartPost=/bin/sleep 0.1 && /usr/sbin/iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ExecStopPost=/bin/sleep 0.1 && /usr/sbin/iptables -D INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT