##### # # Copyright (C) 2002 Laurent Oudot <oudot.laurent@wanadoo.fr> # This ruleset is currently unmaintained. Contact the Prelude # development team if you would like to maintain it. # All Rights Reserved # # This file is part of the Prelude-LML program. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; see the file COPYING. If not, write to # the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. # ##### # ZyWall Firewall Support # Thanks to Ernst Lopes Cardozo <e.lopes.cardozo@aranea.nl> # for providing me an access to many lines of syslog from a ZyWall # Enable logging to the syslog server with the menu 24.3.2. # Specify a syslog server IP and log facility level # Put "Set firewall log" field to "YES" # No log sample; please submit regex=FW (\d+\.\d+\.\d+\.\d+)\s*[:]?(\d+)?\s*\-\>(\d+\.\d+\.\d+\.\d+)\s*[:]?(\d+)?\s*\|(UDP|TCP|ICMP|IGMP|GRE|ESP)(.*)\|(.*)\|B; \ classification.text=$5 packet blocked; \ id=2400; \ revision=1; \ assessment.impact.completion=failed; \ assessment.impact.type=other; \ assessment.impact.severity=medium; \ source(0).node.address(0).category=ipv4-addr; \ source(0).node.address(0).address = $1; \ source(0).service.port = $2; \ source(0).service.protocol = $5; \ target(0).node.address(0).category=ipv4-addr; \ target(0).node.address(0).address = $3; \ target(0).service.port = $4; \ target(0).service.protocol = $5; \ assessment.impact.description=$5$6 packet blocked from $1 port $2 to $3 port $4 [$7]; \ last # No log sample; please submit regex=FW (\d+\.\d+\.\d+\.\d+)\s*[:]?(\d+)?\s*\-\>(\d+\.\d+\.\d+\.\d+)\s*[:]?(\d+)?\s*\|(UDP|TCP|ICMP|IGMP|GRE|ESP)(.*)\|(.*)\|F; \ classification.text=$5 packet forwarded; \ id=2401; \ revision=1; \ assessment.impact.completion=failed; \ assessment.impact.type=other; \ assessment.impact.severity=medium; \ source(0).node.address(0).category=ipv4-addr; \ source(0).node.address(0).address = $1; \ source(0).service.port = $2; \ source(0).service.protocol = $5; \ target(0).node.address(0).category=ipv4-addr; \ target(0).node.address(0).address = $3; \ target(0).service.port = $4; \ target(0).service.protocol = $5; \ assessment.impact.description=$5$6 packet forwarded from $1 port $2 to $3 port $4 [$7]; \ last # No log sample; please submit regex=FW (\d+\.\d+\.\d+\.\d+)\s*[:]?(\d+)?\s*\-\>(\d+\.\d+\.\d+\.\d+)\s*[:]?(\d+)?\s*\|(UDP|TCP|ICMP|IGMP|GRE|ESP)(.*)\|(.*)\|N; \ classification.text=$5 packet matched; \ id=2402; \ revision=1; \ assessment.impact.completion=failed; \ assessment.impact.type=other; \ assessment.impact.severity=medium; \ source(0).node.address(0).category=ipv4-addr; \ source(0).node.address(0).address = $1; \ source(0).service.port = $2; \ source(0).service.protocol = $5; \ target(0).node.address(0).category=ipv4-addr; \ target(0).node.address(0).address = $3; \ target(0).service.port = $4; \ target(0).service.protocol = $5; \ assessment.impact.description=$5$6 packet matched from $1 port $2 to $3 port $4 [$7]; \ last