combine ignoreregex into single expression

ignore router multicast packets on LAN
2020-01-17 14:01:48 +00:00 · 2020-01-14 06:39:02 +00:00
1 changed files with 3 additions and 1 deletions
@@ -3,10 +3,12 @@ failregex = .*\[UFW BLOCK\] IN=.* SRC=<HOST>

 # ignore common multicast device discovery calls on LOCAL IPv4/IPv6 networks
 # still ban non-local (WAN) calls to any associated ports
-ignoreregex = SRC=(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|fe\w*\:).* PROTO=UDP.* DPT=(1900|3702|5353|5355) LEN=\d*\s\s$
+ignoreregex = SRC=(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|fe\w*:).* DST=(static.ip.address.here|224\.0\.0\.*).* PROTO=(2|UDP)(\s+|.* DPT=(1900|3702|5353|5355) LEN=\d*\s+)$


 # NOTES:
+# Routers will often send packets to the multicast broadcast address (224.0.0.1)
+# looking for multicast devices, this is safe to ignore on the LAN
 # IPv6 link local is fe80::/10 (fe80::-febf:ffff...ffff), so only 'fe' will
 # always match
 # IPv4 private ranges are:
Author	SHA1	Message	Date
Asif Bacchus	610aa092e6	combine ignoreregex into single expression	2020-01-17 14:01:48 +00:00
Asif Bacchus	aaab4e5eff	ignore router multicast packets on LAN	2020-01-14 06:39:02 +00:00