From 610aa092e6585cd1628e61319bb527e6ee6b504c Mon Sep 17 00:00:00 2001 From: Asif Bacchus Date: Fri, 17 Jan 2020 14:01:48 +0000 Subject: [PATCH] combine ignoreregex into single expression --- etc/fail2ban/filter.d/ufw-probe.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/etc/fail2ban/filter.d/ufw-probe.conf b/etc/fail2ban/filter.d/ufw-probe.conf index f914dd7..2133096 100644 --- a/etc/fail2ban/filter.d/ufw-probe.conf +++ b/etc/fail2ban/filter.d/ufw-probe.conf @@ -3,8 +3,7 @@ failregex = .*\[UFW BLOCK\] IN=.* SRC= # ignore common multicast device discovery calls on LOCAL IPv4/IPv6 networks # still ban non-local (WAN) calls to any associated ports -ignoreregex = SRC=(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.).* DST=224\.0\.0.* DF PROTO=2\s+$ - SRC=(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|fe\w*\:).* DST=.* PROTO=UDP.* DPT=(1900|3702|5353|5355) LEN=\d*\s+$ +ignoreregex = SRC=(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|fe\w*:).* DST=(static.ip.address.here|224\.0\.0\.*).* PROTO=(2|UDP)(\s+|.* DPT=(1900|3702|5353|5355) LEN=\d*\s+)$ # NOTES: