Custom rules

[mwriter]

@ul0gic

Can you help with creating custom rules and filters?
For example, to combine with https://github.com/portsentry/portsentry

[ul0gic]

@mwriter We have accepted first-party PortSentry integration and opened #81 to track it. It is now In Progress on our active-work project. Initial work targets PortSentry v2.0.7 history files, with PortSentry in log-only mode and fail2zig handling bans and expiry. Planning is complete; implementation and isolated lab qualification are next. Legacy 1.2 is outside this first slice, and no release date is assigned yet. We will keep progress in the integration issue. Thanks for raising this use case.

[ul0gic]

@mwriter fail2zig v0.4.3 is now released with built-in PortSentry support!

The qualified setup uses PortSentry v2.0.7 history files in TCP-connect mode, with PortSentry in log-only mode and fail2zig handling bans and expiry. We tested IPv4 and IPv6 on Debian 13. Configuration instructions are in the PortSentry section of the release README. Legacy PortSentry 1.2 is outside this integration's supported scope.

The integration is complete in #81. Thanks for bringing this use case forward!

[mwriter]

@ul0gic

UDP and stealth-mode deployments are outside that qualification

Can you explain this phrase in more detail?
The stealth mode is very important.

[ul0gic]

@mwriter Our filter is written to accept PortSentry v2.0.7 stealth-scan and UDP history records. We’ve tested detection, ban and expiry end to end only in TCP connect mode, so “outside that qualification” means the other modes haven’t been verified end to end. If PortSentry records a stealth-mode scan and fail2zig doesn’t ban the source, please let us know right away.

[ul0gic]

Update: PortSentry stealth mode (--stealth -m pcap -i <interface>) is qualified as of v0.4.7, alongside connect mode and UDP detection, with PortSentry 2.0.7 on Debian 13. Stealth runs PortSentry as root with pcap on the protected interface; the setup guide covers it. Legacy 1.2 and other 2.x versions remain outside the qualification.