summaryrefslogtreecommitdiff
path: root/data/templates/ids/fastnetmon.tmpl
diff options
context:
space:
mode:
authorDaniil Baturin <daniil@vyos.io>2020-07-04 21:47:31 +0700
committerGitHub <noreply@github.com>2020-07-04 21:47:31 +0700
commit65cbd7481d886c450bcc6be763aff3d4b070d719 (patch)
treee44da73f12a79bb838c9f276d5901b955298ac3d /data/templates/ids/fastnetmon.tmpl
parent05aa25573027953c3578bdc2d0c6be0e46ac1a34 (diff)
parent669d24a5e0abfbecf1557fefe1ebcd69a8ff7f0e (diff)
downloadvyos-1x-65cbd7481d886c450bcc6be763aff3d4b070d719.tar.gz
vyos-1x-65cbd7481d886c450bcc6be763aff3d4b070d719.zip
Merge pull request #487 from DmitriyEshenko/1x-impl-fnm
ids: T2659: Implement fastnetmon support
Diffstat (limited to 'data/templates/ids/fastnetmon.tmpl')
-rw-r--r--data/templates/ids/fastnetmon.tmpl60
1 files changed, 60 insertions, 0 deletions
diff --git a/data/templates/ids/fastnetmon.tmpl b/data/templates/ids/fastnetmon.tmpl
new file mode 100644
index 000000000..71a1b2bd7
--- /dev/null
+++ b/data/templates/ids/fastnetmon.tmpl
@@ -0,0 +1,60 @@
+# enable this option if you want to send logs to local syslog facility
+logging:local_syslog_logging = on
+
+# list of all your networks in CIDR format
+networks_list_path = /etc/networks_list
+
+# list networks in CIDR format which will be not monitored for attacks
+white_list_path = /etc/networks_whitelist
+
+# Enable/Disable any actions in case of attack
+enable_ban = on
+
+## How many packets will be collected from attack traffic
+ban_details_records_count = 500
+
+## How long (in seconds) we should keep an IP in blocked state
+## If you set 0 here it completely disables unban capability
+ban_time = 1900
+
+# Check if the attack is still active, before triggering an unban callback with this option
+# If the attack is still active, check each run of the unban watchdog
+unban_only_if_attack_finished = on
+
+# enable per subnet speed meters
+# For each subnet, list track speed in bps and pps for both directions
+enable_subnet_counters = off
+
+{% if "mirror" in mode %}
+mirror_afpacket = on
+{% endif -%}
+
+{% if "in" in direction %}
+process_incoming_traffic = on
+{% endif -%}
+{% if "out" in direction %}
+process_outgoing_traffic = on
+{% endif -%}
+{% for th in threshold %}
+{% if th == "fps" %}
+ban_for_flows = on
+threshold_flows = {{ threshold[th] }}
+{% endif -%}
+{% if th == "mbps" %}
+ban_for_bandwidth = on
+threshold_mbps = {{ threshold[th] }}
+{% endif -%}
+{% if th == "pps" %}
+ban_for_pps = on
+threshold_pps = {{ threshold[th] }}
+{% endif -%}
+{% endfor -%}
+
+{% if listen_interface %}
+{% set value = listen_interface if listen_interface is string else listen_interface | join(',') %}
+interfaces = {{ value }}
+{% endif -%}
+
+{% if alert_script %}
+notify_script_path = {{ alert_script }}
+{% endif -%}