diff options
| author | Robert Göhler <github@ghlr.de> | 2022-07-07 17:08:11 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-07-07 17:08:11 +0200 |
| commit | 2d5878c4072efd0c9242f3d6549a4042ac97d8a8 (patch) | |
| tree | 84530ad4a17036f9e5fda83ec4f1c27e6906b25d | |
| parent | 14edf2698d3b063a06e3964dd1bd2961711d1d81 (diff) | |
| parent | 54196d2ca6179685b511b1c5de139bb7d778bf1d (diff) | |
| download | vyos-documentation-2d5878c4072efd0c9242f3d6549a4042ac97d8a8.tar.gz vyos-documentation-2d5878c4072efd0c9242f3d6549a4042ac97d8a8.zip | |
Merge pull request #802 from Diekos/geoip-inverse-match
Firewall: T4299: Add inverse-match to geoip
| -rw-r--r-- | docs/configuration/firewall/index.rst | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst index 5081ce2f..a83ea2ae 100644 --- a/docs/configuration/firewall/index.rst +++ b/docs/configuration/firewall/index.rst @@ -325,15 +325,25 @@ There are a lot of matching criteria against which the package can be tested. .. cfgcmd:: set firewall name <name> rule <1-999999> source geoip country-code <country> +.. cfgcmd:: set firewall name <name> rule <1-999999> source geoip inverse-match .. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> source geoip country-code <country> +.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> source geoip + inverse-match .. cfgcmd:: set firewall name <name> rule <1-999999> destination geoip country-code <country> +.. cfgcmd:: set firewall name <name> rule <1-999999> destination geoip + inverse-match .. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> destination geoip country-code <country> +.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> destination geoip + inverse-match + +Match IP addresses based on its geolocation. +More info: `geoip matching +<https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_. -Match IP addresses based on its geolocation. More info: `geoip matching -<https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_ +Use inverse-match to match anything except the given country-codes. Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, permits redistribution so we can include a database in images(~3MB @@ -531,10 +541,10 @@ Applying a Rule-Set to a Zone Before you are able to apply a rule-set to a zone you have to create the zones first. -It helps to think of the syntax as: (see below). The 'rule-set' should be +It helps to think of the syntax as: (see below). The 'rule-set' should be written from the perspective of: *Source Zone*-to->*Destination Zone* -.. cfgcmd:: set zone-policy zone <Destination Zone> from <Source Zone> +.. cfgcmd:: set zone-policy zone <Destination Zone> from <Source Zone> firewall name <rule-set> .. cfgcmd:: set zone-policy zone <name> from <name> firewall name @@ -829,4 +839,4 @@ Update geoip database .. opcmd:: update geoip - Command used to update GeoIP database and firewall sets.
\ No newline at end of file + Command used to update GeoIP database and firewall sets. |