The syslog2iptables.conf configuration file is specified by this partial bnf description. The entire config file is case sensitive. All the keywords are lower case.
CONFIG := {THRESHOLD | ADD-CMD | REM-CMD | IGNORE | FILE}+ THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";" ADD-CMD := "add_command" IPT-CMD ";" REM-CMD := "remove_command" IPT-CMD ";" IGNORE := "ignore" "{" IG-SINGLE+ "};" IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";" FILE := "file" FILENAME "{" PATTERN+ "};" PATTERN := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET}+ "};" INDEX := "index" REGEX-INTEGER-VALUE ";" BUCKET := "bucket" BUCKET-ADD-INTEGER-VALUE ";" IPT-CMD := string containing exactly one %s replacement token for the ip address
threshold 550; add_command "/sbin/iptables -I INPUT --src %s --jump DROP"; remove_command "/sbin/iptables -D INPUT --src %s --jump DROP"; ignore { 127.0.0.0/8; // localhost }; file "/var/log/cisco.log" { pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" { index 2; // zero based bucket 200; }; }; file "/var/log/secure" { pattern "sshd.*Failed password .* from ::ffff:(.*) port" { index 1; // zero based bucket 400; }; pattern "sshd.*Failed password .* from (.*) port" { index 1; // zero based bucket 400; }; };