Artica PCAP filter ProxMox remediation mode

• Return back to the Artica PCAP filter command-line main section

This method consists of filling an IPSet ProxMox object with a time-limited duration. 
Note that this is a "hard" method, meaning that an IP address detected by the sources will be automatically banned by your firewall without notice.
Artica PCAP filter is not able to create the IPSet object; you have to create the IPSet in the Proxmox firewall and an account allowed to manage the object.

The method:

1. Artica PCAP Filter is installed inside ProxMox virtual machines.
2. It scans the network interface in real time to detect external incoming IP addresses.
3. When it finds an address that matches its database, it uses the ProxMox API to add the address to the IPSet object.
4. Every X minutes, it uses the ProxMox API to list stored addresses and delete those that have expired.

Enable/Disable the IPSet Proxmox remediation method

Tokens -proxmox-enable or -proxmox-disable enable or disable the IPSet ProxMox remediation.

Set the ProxMox settings to the IPSet object

The token  -proxmox-host [IP:port] defines your ProxMox address.

The token  -proxmox-user [username] defines the ProxMox account allowed to populate the ProxMox IPSet object.

The token  -proxmox-password defines the ProxMox account password.

The token  -proxmox-ipset defines the IPset object to populate.

The token  -proxmox-timeout defines the time to live (in minutes)  of a banned IP address inside your ProxMox IPSet object.

The token  -proxmox-schedule defines the schedule in minutes to scan the IPSet object in order to clean data (min 5 min, max 60 min).

You can use all commands in the same command line.

Example:

articapsniffer -proxmox-enable -proxmox-host 192.168.1.109:8006 -proxmox-user articap -proxmox-password 12345 -proxmox-ipset articadpf -proxmox-timeout 30 -proxmox-schedule 15

Dump the content of the remote Proxmox IPSet

The token -proxmox-list displays items stored in the defined IPSet

Add/Delete IP address inside your ProxMox IPset

The token -proxmox-add [ipaddr] or -proxmox-bulk [filename] add entries to the IPSet Object.

The bulk import method imports 4 records per second, and is not intended for importing large quantities of data.

You can use -proxmox-ipset to add temporary records to another IPSet. Example***

articapsniffer -proxmox-bulk /home/ipset/records.txt -proxmox-ipset MyOtherIPSet

The token -proxmox-del [ipaddr] delete a record from the IPSet  object.
You can use -proxmox-ipset to delete a record from another IPSet. Example:

articapsniffer -proxmox-del 1.2.3.4 -proxmox-ipset MyOtherIPSet

Clean the IPSet

The token -proxmox-clean allows Artica PCAP Filter to scan the defined IPSet in order to clean expired records.

Reloading the Daemon

To reload the daemon, which means flushing memory caches and reloading the source databases in memory, use the token -reload