#-----------------------------------------------------------------------------#
#    This file demonstrate observation and blacklisting.                      #
#                                                                             #
#    To activate the rules, simply move them to firerule.cnf and update the   #
#    attributes to match your setup.                                          #
#                                                                             #
#    DISCLAIMER: Not all samples have been tested by F/X Communications.      #
#                                                                             #
#    Examples located here demonstrate also technique of using Security-Level #
#    attribute.                                                               #
#                                                                             #
#    These examples will just perform logging action if current firewall's    #
#    security level isn't enough to execute plain Rule-Action.                #
#-----------------------------------------------------------------------------#


#-----------------------------------------------------------------------------#
#    This rule sets up a lure, blacklisting any user (IP address) sending     #
#    traffic to telnet port (23).                                             #
#-----------------------------------------------------------------------------#

Blacklist-Honey-Pot     Comment = "Blacklist anyone touching telnet port",
                        Direction = Incoming,
                        Destination-Port = "23",
                        Rule-Action = Blacklist,
                        Security-Level = 6,
                        Alternate-Action = Log,
                        Log-Control = Enabled,
                        Blacklist-Period = "28",


#-----------------------------------------------------------------------------#
#    This rule will place each user who caused the firewall to drop a packet  #
#    into observation list. If the firewall will drop another packet from     #
#    this user, it will blacklist him.                                        #
#                                                                             #
#    When blacklisting, the firewall will create a log record in              #
#    firewall/logs/black.log with the last param indicating a rule which      #
#    caused  dropping a packet.                                               #
#                                                                             #
#-----------------------------------------------------------------------------#

Observe-Dropped         Comment = "Blacklist on second dropped packet",
                        Direction = Incoming,
                        Packet-Feature = Denied,
                        Rule-Action = Observe,
                        Log-Control = Enabled,
                        Log-File = "firewall/logs/black.log",
                        Log-Mask = "rule date time prot source dest d_port dump action_rule",


#-----------------------------------------------------------------------------#
#    This rule is much like the previous one, but the count of dropped        #
#    packets needed for blacklisting increased to 10.                         #
#-----------------------------------------------------------------------------#

Observe-10-Drops        Comment = "Blacklist by 10 dropped packets",
                        Direction = Incoming,
                        Rule-Action = Observe,
                        Packet-Feature = Denied,
                        Observe-Match-Count = 9,
                        Log-Control = Enabled,
                        Log-File = "firewall/logs/black.log",
                        Log-Mask = "rule date time prot source dest d_port dump action_rule",


#-----------------------------------------------------------------------------#
#    This rule is used in combination with a Replacement-Rule.                #
#    Note the replacement-rule has Rule-Status (Passive) to allow itself      #
#    to stay idle in the rule lists (i.e. can't be matched as passive).       #
#                                                                             #
#    In this example, the user gets blacklisted after establishing a TCP      #
#    connection and sending 1000 packets to the firewall PC.                  #
#                                                                             #
#    The rule that would be created in blacklist will be much like the rule   #
#    used in observation list (REPLACEMENT-RULE), but the action will be Deny.#
#-----------------------------------------------------------------------------#

Observe-Advanced        Comment = "Blacklist after ftp access and 1000 packets to telnet server",
                        Direction = Incoming,
                        Destination-Port = "21",
                        Rule-Action = Observe,
                        Observation-Rule = "Replacement-Rule",

Replacement-Rule        Rule-Status = Passive,
                        Direction = Incoming,
                        Destination-Port = "23",
                        Rule-Action = Blacklist,
                        Observe-Match-Count = 16,



