head	1.1;
access;
symbols
	perseant-exfatfs-base-20261102:1.1
	netbsd-11-1-RELEASE:1.1
	netbsd-11-0-RELEASE:1.1
	netbsd-11-0-RC7:1.1
	netbsd-11-0-RC6:1.1
	netbsd-11-0-RC5:1.1
	netbsd-11-0-RC4:1.1
	netbsd-11-0-RC3:1.1
	netbsd-11-0-RC2:1.1
	netbsd-11-0-RC1:1.1
	perseant-exfatfs:1.1.0.4
	perseant-exfatfs-base-20250801:1.1
	netbsd-11:1.1.0.2
	netbsd-11-base:1.1;
locks; strict;
comment	@# @;


1.1
date	2025.02.05.20.24.26;	author christos;	state Exp;
branches
	1.1.4.1;
next	;
commitid	jR3ogBQFPcATUjIF;

1.1.4.1
date	2025.02.05.20.24.26;	author perseant;	state dead;
branches;
next	1.1.4.2;
commitid	23j6GFaDws3O875G;

1.1.4.2
date	2025.08.02.05.20.52;	author perseant;	state Exp;
branches;
next	;
commitid	23j6GFaDws3O875G;


desc
@@


1.1
log
@PR/22: robohack: add an ipf.conf example
@
text
@#========================================
#
#	subsection for abuse blocking
#
#========================================
#
# This section should be included early in the main /etc/ipf.conf file, right
# after any basic generic accounting ("count") rules, and any cleanup rules to
# block invalid fragments, invalid options (e.g. "ssrr"), etc.
#
# Note these will not actually block anything since they don't include the
# "quick" flag, and are thus part of a last-match group.  They simply set up a
# group such that any connection logging rule further below won't also match if
# one of the rules in the group matches, no matter when or where the subsequent
# matching rule is added.  I.e. all rules in the group are checked for a match
# (and a possible "first match" with "quick") before any subsequent rules
# further below are used.  Note group rules can be added at any time, including
# at runtime after all other rules have been added -- they will still belong to
# the group and once added will be checked as part of the group.
#
#	head of "blocklistd" group:
#
# The "blocklistd" group will be used by blocklistd(8).
#
block in proto tcp/udp from any to any head blocklistd
#
#	head of "attackers" group to block all attackers:
#
# The "attackers" group is intended to be used for manually maintained rules
# e.g. as could be added like this:
#
#	echo 'block return-rst in log quick proto tcp from 118.136.0.0/15 to any flags S/SAFR group attackers' >> /etc/ipf.conf
#	/etc/rc.d/ipfliter reload
#
# Note the choice in this example is to return RST packets for blocked SYN
# packets to help the other end close.  This is not necessary, but it better
# mimics what the kernel does by default, thus perhaps hiding the fact a
# firewall is present.
#
# XXX This example still allows UDP services, but we would need to duplicate
# each rule with "proto udp" (and without "flags blah") due to IPF parsing
# limitations....
#
block in proto tcp/udp from any to any head attackers
#
@


1.1.4.1
log
@file ipf.conf was added on branch perseant-exfatfs on 2025-08-02 05:20:52 +0000
@
text
@d1 45
@


1.1.4.2
log
@Sync with HEAD
@
text
@a0 45
#========================================
#
#	subsection for abuse blocking
#
#========================================
#
# This section should be included early in the main /etc/ipf.conf file, right
# after any basic generic accounting ("count") rules, and any cleanup rules to
# block invalid fragments, invalid options (e.g. "ssrr"), etc.
#
# Note these will not actually block anything since they don't include the
# "quick" flag, and are thus part of a last-match group.  They simply set up a
# group such that any connection logging rule further below won't also match if
# one of the rules in the group matches, no matter when or where the subsequent
# matching rule is added.  I.e. all rules in the group are checked for a match
# (and a possible "first match" with "quick") before any subsequent rules
# further below are used.  Note group rules can be added at any time, including
# at runtime after all other rules have been added -- they will still belong to
# the group and once added will be checked as part of the group.
#
#	head of "blocklistd" group:
#
# The "blocklistd" group will be used by blocklistd(8).
#
block in proto tcp/udp from any to any head blocklistd
#
#	head of "attackers" group to block all attackers:
#
# The "attackers" group is intended to be used for manually maintained rules
# e.g. as could be added like this:
#
#	echo 'block return-rst in log quick proto tcp from 118.136.0.0/15 to any flags S/SAFR group attackers' >> /etc/ipf.conf
#	/etc/rc.d/ipfliter reload
#
# Note the choice in this example is to return RST packets for blocked SYN
# packets to help the other end close.  This is not necessary, but it better
# mimics what the kernel does by default, thus perhaps hiding the fact a
# firewall is present.
#
# XXX This example still allows UDP services, but we would need to duplicate
# each rule with "proto udp" (and without "flags blah") due to IPF parsing
# limitations....
#
block in proto tcp/udp from any to any head attackers
#
@