# enable this option if you want to send logs to local syslog facility
logging:logging_level = debug
logging:local_syslog_logging = on

# list of all your networks in CIDR format
networks_list_path = /run/fastnetmon/networks_list

# Enable/Disable any actions in case of attack
enable_ban = on
enable_ban_ipv6 = on

## How many packets will be collected from attack traffic
ban_details_records_count = 500

## How long (in seconds) we should keep an IP in blocked state
## If you set 0 here it completely disables unban capability
{% if ban_time is vyos_defined %}
ban_time = {{ ban_time }}
{% endif %}

# Check if the attack is still active, before triggering an unban callback with this option
# If the attack is still active, check each run of the unban watchdog
unban_only_if_attack_finished = on

# enable per subnet speed meters
# For each subnet, list track speed in bps and pps for both directions
enable_subnet_counters = off

{% if mode.mirror is vyos_defined %}
mirror_afpacket = on
{% endif %}

process_incoming_traffic = {{ 'on' if direction is vyos_defined and 'in' in direction else 'off' }}
process_outgoing_traffic = {{ 'on' if direction is vyos_defined and 'out' in direction else 'off' }}

{% if threshold is vyos_defined %}
{%     for thr, thr_value in threshold.items() %}
{%         if thr is vyos_defined('fps') %}
ban_for_flows = on
threshold_flows = {{ thr_value }}
{%         elif thr is vyos_defined('mbps') %}
ban_for_bandwidth = on
threshold_mbps = {{ thr_value }}
{%         elif thr is vyos_defined('pps') %}
ban_for_pps = on
threshold_pps = {{ thr_value }}
{%         endif %}
{%     endfor %}
{% endif %}

{% if listen_interface is vyos_defined %}
interfaces = {{ listen_interface | join(',') }}
{% endif %}

{% if alert_script is vyos_defined %}
notify_script_path = {{ alert_script }}
{% endif %}