This method consists of filling an IPSet ProxMox object with a time-limited duration.
Note that this is a "hard" method, meaning that an IP address detected by the sources will be automatically banned by your firewall without notice.
Artica PCAP filter is not able to create the IPSet object; you have to create the IPSet in the Proxmox firewall and an account allowed to manage the object.
¶ The method:
- Artica PCAP Filter is installed inside ProxMox virtual machines.
- It scans the network interface in real time to detect external incoming IP addresses.
- When it finds an address that matches its database, it uses the ProxMox API to add the address to the IPSet object.
- Every X minutes, it uses the ProxMox API to list stored addresses and delete those that have expired.
¶ Enable/Disable the IPSet Proxmox remediation method
Tokens -proxmox-enable or -proxmox-disable enable or disable the IPSet ProxMox remediation.
¶ Set the ProxMox settings to the IPSet object
The token -proxmox-host [IP:port] defines your ProxMox address.
The token -proxmox-user [username] defines the ProxMox account allowed to populate the ProxMox IPSet object.
The token -proxmox-password defines the ProxMox account password.
The token -proxmox-ipset defines the IPset object to populate.
The token -proxmox-timeout defines the time to live (in minutes) of a banned IP address inside your ProxMox IPSet object.
The token -proxmox-schedule defines the schedule in minutes to scan the IPSet object in order to clean data (min 5 min, max 60 min).
You can use all commands in the same command line.
Example:
articapsniffer -proxmox-enable -proxmox-host 192.168.1.109:8006 -proxmox-user articap -proxmox-password 12345 -proxmox-ipset articadpf -proxmox-timeout 30 -proxmox-schedule 15
¶ Dump the content of the remote Proxmox IPSet
The token -proxmox-list displays items stored in the defined IPSet
¶ Add/Delete IP address inside your ProxMox IPset
The token -proxmox-add [ipaddr] or -proxmox-bulk [filename] add entries to the IPSet Object.
The bulk import method imports 4 records per second, and is not intended for importing large quantities of data.
You can use -proxmox-ipset to add temporary records to another IPSet. Example:
articapsniffer -proxmox-bulk /home/ipset/records.txt -proxmox-ipset MyOtherIPSet
The token -proxmox-del [ipaddr] delete a record from the IPSet object.
You can use -proxmox-ipset to delete a record from another IPSet. Example:
articapsniffer -proxmox-del 1.2.3.4 -proxmox-ipset MyOtherIPSet
¶ Clean the IPSet
The token -proxmox-clean allows Artica PCAP Filter to scan the defined IPSet in order to clean expired records.
¶ Reloading the Daemon
To reload the daemon, which means flushing memory caches and reloading the source databases in memory, use the token -reload