;
;
; BitNinja [IpFilter] module configuration file
;
;
[module]
;
;closeDirectAccess = 1
[PCI]
; When value not 0, direct access to BitNinja services disallowed.
; PortHoneypot will not start, if PCI compliance enabled.
;
; !!!WARNING!!! CaptchaSmtp service will not work, because visitors not allowed to access CaptchaHttp port
;
;pci_compliance=1

;
; Ipset related settings
;
[ipsets]
;
; Explicitly set the ipset implementation on of the following by uncommenting one of the ipset_implementation line.
; Recommended to use 'NativeIpsetV6' for the better performance and more advanced features.
; When nothing specified then the Agent tries to guest the best implementation.
; The guessing could fail when other firewall manager software also using ipset and concurent access made to ipset.
;

;
; Ipset is not available. Use only iptable rules. Has very hign impact on tcp performance. Advice install ipset v6+
;
; ipset_implementation='SimulatedIpset'

;
; Use the very old ipset v4 implementation. Has moderate tcp performance impact. IPv6 not supported. Advice upgrade ipset to ipset v6+.
;
; ipset_implementation='NativeIpsetV4'

;
; Recommended option. Use this implentation when ipset v6+ available. It has the best performance. Support IPv6 and all BitNinja Agent features.
;
; ipset_implementation='NativeIpsetV6'

;
; Disable greylist filtering. (Not recommended!)
;
; Uncomment the next line to disable greylisting
;disable[] = 'greylist'

;
; Disable blacklist filtering. (Not recommended!)
;
; Uncomment the next line to disable greylisting
;disable[] = 'blacklist'

;
; Disable essentiallist filtering. (Highly Not recommended!)
;
; Uncomment the next line to disable greylisting
;disable[] = 'essentiallist'

;
; By default, UDP packets recieved from or sent to port 53 are not dropped,
; even if the source IP is on greylist. If you wish to drop such packets, set the
; value of this field to 'true'.
;
; gl_filter_dns = 'false'

[targets]
;
; Set the default target of whitelisted IPs.
; If you use drop policy, and Bitninja is not on a router you should change it to ACCEPT.
; Default value is RETURN.
;
;wl_target = 'RETURN'

;
; Set the default target of Heimdall redirections.
; If you use drop policy, and Bitninja is not on a router you should change it to ACCEPT.
; Default value is RETURN.
;
;hr_target = 'RETURN'

;
; Location where CSF-s csfpost.sh should be added if CSF is used.
; Default location is /usr/local/csf/bin/
;
[csf]
;csfdir[] = '/usr/local/csf/bin/'
;csfdir[] = '/etc/csf/'
;csf.pignore = '/etc/csf/csf.pignore'

[times]
;
; Temporary blacklist time in dos suspicious requests
;
;tmp_bl_sec = 60

[scripts]
postup_script_dir = '/etc/bitninja/IpFilter/postup-scripts.d'

[greylistreload]
;splitsize=10

[netfilter_conntract_limits]
;nf_conntrack_max = 131072
;hashsize = 16384

;
; Allow service ports for greylisted ips
;
[port_filter]
; allow all out going connection to greylisted ips
;allow_all_greylist_out = 0

; allow all out going connection to blacklisted ips
;allow_all_blacklist_out = 0

; in coming greylisted tcp connections
;allow_greylist_tcp_in[] = 53
; out going tcp connections to greylisted ips
;allow_greylist_tcp_out[] = 53
;allow_greylist_tcp_out[] = 25
;allow_greylist_tcp_out[] = 465
;allow_greylist_tcp_out[] = 587
; in coming greylisted udp connections
;allow_greylist_udp_in[] = 53
; out going udp connections to greylisted ips
;allow_greylist_udp_out[] = 53

; in coming blacklisted tcp connections
;allow_blacklist_tcp_in[] = 53
; out going tcp connections to blacklisted ips
;allow_blacklist_tcp_out[] = 53
;allow_blacklist_tcp_out[] = 25
;allow_blacklist_tcp_out[] = 465
;allow_blacklist_tcp_out[] = 587
; in coming blacklisted udp connections
;allow_blacklist_udp_in[] = 53
; out going udp connections to blacklisted ips
;allow_blacklist_udp_out[] = 53

[ipv6_support]
;enable_ipv6 = 0