CyberMind-FR
d2953c5807
Phase 1 implementation of Vortex DNS Firewall - SecuBox's first line of defense blocking threats at DNS level BEFORE any connection is established. Features: - Threat intel aggregator (URLhaus, OpenPhish, Malware Domains) - SQLite-based blocklist database with domain deduplication - dnsmasq integration via sinkhole hosts file - x47 vitality multiplier concept (each DNS block prevents ~47 connections) - RPCD handler for LuCI integration with 8 methods - CLI tool: vortex-firewall intel/stats/start/stop Tested with 765 blocked domains across 3 threat feeds. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
24 lines
529 B
Plaintext
24 lines
529 B
Plaintext
config vortex-firewall 'main'
|
|
option enabled '1'
|
|
option sinkhole_ip '192.168.255.253'
|
|
option update_interval '300'
|
|
option auto_block_threshold '80'
|
|
option mesh_sharing '1'
|
|
|
|
config intel 'feeds'
|
|
option urlhaus '1'
|
|
option openphish '1'
|
|
option malwaredomains '1'
|
|
option dnsguard '1'
|
|
option mesh_peers '1'
|
|
|
|
config sinkhole 'server'
|
|
option enabled '0'
|
|
option http_port '80'
|
|
option https_port '443'
|
|
option capture_payloads '1'
|
|
|
|
config alerts 'notifications'
|
|
option infected_client_alert '1'
|
|
option new_threat_alert '1'
|