Location Block vs. Drop packets from and to hostile networks (listed at Spamhaus DROP, etc.)

[jon]

@pmueller

Regarding the logging: Yes, indeed, the log analysing capabilities of IPFire 2.x are not really state-of-the-art. However, I believe you could still gain insights from those logs, for example, by setting up a Cron job searching for outgoing DROP_HOSTILE events, and alerting you if there were any. These are certainly ones you want to know about.

If you’ve installed the IPFire addon named monit, then you can add this to the config file to monitor outgoing DROP_HOSTILE events:

#	review messages log
check file messageLog path /var/log/messages
	ignore content = ".*monit.*"
#	review messages log for DROP_HOSTILE
#		but do not look at red0
	if content = "DROP_HOSTILE IN=(blue0|green0|orange0)"
		then alert

---

EDIT: temporarily add a space to test so test can pickup non-red0 content.

	if content = "DROP_HOSTILE IN=( |blue0|green0|orange0)"

This should disappear in future.