Howdy,
I'd like to automate the use of the dshield.org feeds
(http://feeds.dshield.org/top10-2.txt specifically) to block the traffic
at my IPF border firewalls. Howwever, I don't want to interfere with my
existing pre-existing /etc/ipf.rules. I'm also running ipnat.
My challenge is to insert the dshielf.org IP blocklist near the top of
the rule list, daily, without affecting the rest of my ruleset.
Obviously I'd like to avoid solutions that modify /etc/ipf.rules
in-place :-)
Is there a way to specific an "include" file in the IPF config file? Are
there any scripts to perform this sort of task that folks are willing to
share? Are there any pitfalls to avoid (such as accidently flushing the
NAT or state tables)?
TIA,
- Tillman
--
Page 356: Part of the charm of Unix is, all of a sudden, having a great
insight and saying to yourself, "So THAT's why they did it that way."
- Harley Hahn, _The Unix Companion_
