P a g e 38 | 64
TM1-5GM2020SG
7.1.1 banIP Configuration Options
Caution: Edit this section at your own risk.
•
usually, the pre-configured banIP setup works quite well and no manual overrides are needed
•
the following options apply to the 'global' config section:
o
ban_enabled => main switch to enable/disable banIP service (bool/default: '0', disabled)
o
ban_automatic => determine the L2/L3 WAN network device automatically
(bool/default: '1', enabled)
o
ban_iface => space separated list of WAN network interface(s)/device(s) used by
banIP (default: not set, automatically detected)
o
ban_realtime => a small log/banIP background monitor to block SSH/LuCI brute force
attacks in realtime (bool/default: 'false', disabled)
o
ban_target_src => action to perform when banning inbound IPv4 packets
('DROP'/'REJECT', default: 'DROP')
o
ban_target_src_6 => action to perform when banning inbound IPv6 packets
('DROP'/'REJECT', default: 'DROP')
o
ban_target_dst => action to perform when banning outbound IPv4 packets
('DROP'/'REJECT', default: 'REJECT')
o
ban_target_dst_6 => action to perform when banning outbound IPv6 packets
('DROP'/'REJECT', default: 'REJECT')
o
ban_log_src => switch to enable/disable logging of banned inbound IPv4 packets
(bool/default: '0', disabled)
o
ban_log_dst => switch to enable/disable logging of banned outbound IPv4 packets
(bool/default: '0', disabled)
•
the following options apply to the 'extra' config section:
o
ban_debug => enable/disable banIP debug output (bool/default: '0', disabled)
o
ban_nice => set the nice level of the banIP process and all sub- processes (int/default:
'0', standard priority)
o
ban_triggerdelay => additional trigger delay in seconds before banIP processing
begins (int/default: '2')
o
ban_backupdir => target directory for banIP backups (default: '/tmp')
o
ban_sshdaemon => select the SSH daemon for logfile parsing, 'dropbear' or 'sshd'
(default: 'dropbear')
o
ban_starttype => select the used start type during boot, 'start', 'refresh' or 'reload'
(default: 'start')
o
ban_maxqueue => size of the download queue to handle downloads & IPSet
