;COMMENT: Blacklist on incoming traffic to Lure Ports
;DESCRIPTION: This technique is used to trap attackers as soon as they begin to scan the host system. Blacklisting occurs on IP addresses responsible for traffic to ports: FTP, SSH or Telnet. The blacklist period is 12 hours (per default).

Lure-Blacklisting	
		Comment = "Blacklist/Log traffic to lure ports",
		Destination-Port = "telnet ssh",
		Rule-Action = Blacklist,
		Log-Control = Enabled,
		Log-Message = "Blacklisted (Reason: traffic to lure port)",
		Log-Details = "The lure ports, are ports on which the Firewall 'listens', and blacklists on the first incoming packet. This technique is used to catch attackers as soon as they begin to scan the host system for weaknesses.",
		Log-Severity = High,
		Direction = Incoming,
