goguard/config.example.yaml at main · Charlie-Root/goguard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# GoGuard Configuration Example

# Log files to monitor
log_files:
  - path: "/var/log/auth.log"
    patterns:
      # SSH brute force attempts
      - regex: "Failed password for .* from (\\d+\\.\\d+\\.\\d+\\.\\d+)"
        ip_group: 1
        threshold: 3
        ban_time: "1h"

      # Invalid SSH users
      - regex: "Invalid user .* from (\\d+\\.\\d+\\.\\d+\\.\\d+)"
        ip_group: 1
        threshold: 5
        ban_time: "2h"

  - path: "/var/log/nginx/access.log"
    patterns:
      # HTTP brute force
      - regex: "\\\"POST /wp-login.php.*\\\" 40[0-9] .* \\\"(\\d+\\.\\d+\\.\\d+\\.\\d+)\\\""
        ip_group: 1
        threshold: 10
        ban_time: "6h"

# Web interface
web:
  enabled: true
  port: 8080

# IP whitelist (never ban these)
whitelist:
  - "127.0.0.1"
  - "::1"
  - "192.168.1.0/24"
  - "10.0.0.0/8"

# Actions - Multiple firewall backends (NEW!)
actions:
  # Primary action: iptables
  - type: "iptables"
    chain: "INPUT"
    target: "DROP"

  # Secondary action: UFW (Ubuntu/Debian)
  - type: "ufw"

  # Alternative: firewalld (RHEL/CentOS/Fedora)
  # - type: "firewalld"
  #   options:
  #     zone: "drop"

  # Alternative: nftables (modern Linux)
  # - type: "nftables"
  #   chain: "input"
  #   options:
  #     table: "filter"

  # Alternative: null routing (works on most systems)
  # - type: "route"

  # For testing: dummy action (logs only)
  # - type: "dummy"

# Legacy firewall config (deprecated - use actions instead)
# firewall:
#   chain: "INPUT"
#   target: "DROP"

# Optional: Report banned IPs to abuse databases
abuse_reporting:
  enabled: true
  timeout: 30s
  retry_attempts: 3
  retry_delay: 5s

  abuseipdb:
    enabled: true
    api_key: "your-abuseipdb-api-key"
    categories: [14, 18, 20]  # Hacking, SSH, Brute Force

# Advanced options
production_mode: false