|
|
|
|
|
|
|
|
## Example IPv4 |
|
|
## Example IPv4 |
|
|
`iptables -A INPUT -p udp -m udp --dport 67 -j NFQUEUE --queue-num 67 --queue-bypass` |
|
|
`iptables -A INPUT -p udp -m udp --dport 67 -j NFQUEUE --queue-num 67 --queue-bypass` |
|
|
|
|
|
|
|
|
|
|
|
`iptables -A OUTPUT -p udp -m udp --sport 67 -j NFQUEUE --queue-num 67 --queue-bypass` (optional for accounting) |
|
|
|
|
|
|
|
|
## Example IPv6 |
|
|
## Example IPv6 |
|
|
`ip6tables -A INPUT -p udp -m udp --dport 547 -j NFQUEUE --queue-num 67 --queue-bypass` |
|
|
`ip6tables -A INPUT -p udp -m udp --dport 547 -j NFQUEUE --queue-num 67 --queue-bypass` |
|
|
|
|
|
|
|
|
|
|
|
`ip6tables -A OUTPUT -p udp -m udp --sport 547 -j NFQUEUE --queue-num 67 --queue-bypass` (optional for accounting) |
|
|
|
|
|
|
|
|
# Configuration |
|
|
# Configuration |
|
|
The configuration file may be tuned, but the defaults should be fine. |
|
|
The configuration file may be tuned, but the defaults should be fine. |
|
|
``` |
|
|
``` |
|
|
|
|
|
|
|
|
# actions. |
|
|
# actions. |
|
|
# Set to 0 for production. |
|
|
# Set to 0 for production. |
|
|
dryrun=0 |
|
|
dryrun=0 |
|
|
|
|
|
|
|
|
|
|
|
# stats file and interval (seconds) |
|
|
|
|
|
# the stats file will be overwritten every n seconds |
|
|
|
|
|
# as defined below. The counters are absolute AND |
|
|
|
|
|
# relative (both included). |
|
|
|
|
|
stats_file=/var/run/dhcp_protect_status.json |
|
|
|
|
|
stats_interval=10 |
|
|
``` |
|
|
``` |
|
|
|
|
|
|
|
|
# Starting / Stopping |
|
|
# Starting / Stopping |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Logging / Accounting |
|
|
# Logging / Accounting |
|
|
|
|
|
|
|
|
|
|
|
## Syslog |
|
|
The program will log every blacklisting action to syslog (also in dryrun mode). |
|
|
The program will log every blacklisting action to syslog (also in dryrun mode). |
|
|
|
|
|
|
|
|
``` |
|
|
``` |
|
|
Oct 23 16:50:18 router dhcp_protect[9706]: 00000000021b: blacklisting started |
|
|
Oct 23 16:50:18 router dhcp_protect[9706]: 00000000021b: blacklisting started |
|
|
Oct 23 16:52:18 router dhcp_protect[9706]: 00000000021b: blacklisting ended |
|
|
Oct 23 16:52:18 router dhcp_protect[9706]: 00000000021b: blacklisting ended |
|
|
``` |
|
|
``` |
|
|
|
|
|
|
|
|
|
|
|
## Status |
|
|
|
|
|
DHCP Protect will update its status in `stats_file` every `stats_interval` seconds. This is a JSON file containing the UNIX timestamp when the file was created/updated, absolute and relative (relative to late update) counters of all different DHCPv4/DHCPv6 messages types and the current blacklist entries. |
|
|
|
|
|
|
|
|
|
|
|
For example: |
|
|
|
|
|
|
|
|
|
|
|
``` |
|
|
|
|
|
root@dhcp:~# cat /var/run/dhcp_protect_status.json | json_pp |
|
|
|
|
|
{ |
|
|
|
|
|
"dhcpv4" : { |
|
|
|
|
|
"DISCOVER" : { |
|
|
|
|
|
"abs" : 2, |
|
|
|
|
|
"rel" : 0 |
|
|
|
|
|
}, |
|
|
|
|
|
"ACK" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 52 |
|
|
|
|
|
}, |
|
|
|
|
|
"REQUEST" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 52 |
|
|
|
|
|
}, |
|
|
|
|
|
"OFFER" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 1 |
|
|
|
|
|
} |
|
|
|
|
|
}, |
|
|
|
|
|
"timestamp" : 1572204894, |
|
|
|
|
|
"blacklist" : [], |
|
|
|
|
|
"dhcpv6" : { |
|
|
|
|
|
"RECONFIGURE-REQUEST" : { |
|
|
|
|
|
"abs" : 61, |
|
|
|
|
|
"rel" : 0 |
|
|
|
|
|
}, |
|
|
|
|
|
"SOLICIT" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 83 |
|
|
|
|
|
}, |
|
|
|
|
|
"RELEASE" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 6 |
|
|
|
|
|
}, |
|
|
|
|
|
"DECLINE" : { |
|
|
|
|
|
"abs" : 61, |
|
|
|
|
|
"rel" : 0 |
|
|
|
|
|
}, |
|
|
|
|
|
"RENEW" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 22 |
|
|
|
|
|
}, |
|
|
|
|
|
"REBIND" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 2 |
|
|
|
|
|
}, |
|
|
|
|
|
"RELAY-FORW" : { |
|
|
|
|
|
"rel" : 0, |
|
|
|
|
|
"abs" : 61 |
|
|
|
|
|
} |
|
|
|
|
|
} |
|
|
|
|
|
} |
|
|
|
|
|
``` |
|
|
# Copyright / License |
|
|
# Copyright / License |
|
|
``` |
|
|
``` |
|
|
Copyright 2019 Pascal Gloor |
|
|
Copyright 2019 Pascal Gloor |