diff --git a/firewall2.sh b/firewall2.sh index d3d38c4..ff436ef 100755 --- a/firewall2.sh +++ b/firewall2.sh @@ -81,7 +81,6 @@ attacker-protection() { watch pedo-search bot-search - attacker-search } bot-search() { @@ -122,25 +121,6 @@ pedo-search() { fi } -attacker-search() { - echo - echo "Processing Attacker Searches into NFT....." - echo - DATE="$(date +%d/%b/%Y:%H:%M -d '1 min ago' )" - ATTACKER_SEARCH=( $( grep $DATE $NGINX_ACCESS | grep -Ei '127.0.0.1|"$DATE"' | grep -vi $MY_IP | grep -Ei -f $ATTACKER_DB | cut -d "-" -f1 | sort -u)) - for i in "${ATTACKER_SEARCH[@]}"; do - $NFT add rule ip filter input ip saddr $i $NFT_DROP - QUERY=$(cat $NGINX_ACCESS | grep -i "$DATE" | grep -vi $MY_IP | grep $i | grep -Ei -f $ATTACKER_DB | head -1) - if [ -z "$QUERY" ]; then - echo "No Attackers Found" - else - echo "Found Attacker!" - noscl publish --profile=33c74427f3b2b73d5e38f3e6c991c122a55d204072356f71da49a0e209fb6940 "$QUERY" - echo $i >>$ATTACKER_LOG - fi - done - -} basic-security() { $NFT add rule filter input icmp type echo-request $NFT_DROP @@ -357,6 +337,8 @@ status() { echo "Blocked IP's:" cat $TMP_BLOCK echo "==================================================================" + sleep 30 + status } stop() {