mirror of
https://github.com/novatiq/packages.git
synced 2026-04-30 07:28:39 +01:00
banip: release 0.7.0
* major rewrite * add support for multiple chains * add mac whitelisting * add support for multiple ssh daemons in parallel * add an ipset report engine * add mail notifications * add suspend/resume functions * add a cron wrapper to set an ipset related auto-timer for automatic blocklist updates * add a list wrapper to add/remove blocklist sources * add 19.x and Turris OS 5.x compatibility code * sources stored in an external compressed json file (/etc/banip/banip.sources.gz) * change Country/ASN download sources (faster/more reliable) * fix DHCPv6/icmpv6 issues Signed-off-by: Dirk Brenken <dev@brenken.org>
This commit is contained in:
Dirk Brenken
+317
-68
@@ -1,10 +1,42 @@
|
||||
<!-- markdownlint-disable -->
|
||||
|
||||
# banIP - ban incoming and/or outgoing ip adresses via ipsets
|
||||
|
||||
## Description
|
||||
IP address blocking is commonly used to protect against brute force attacks, prevent disruptive or unauthorized address(es) from access or it can be used to restrict access to or from a particular geographic area — for example.
|
||||
|
||||
## Main Features
|
||||
* support many IP blocklist sources (free for private usage, for commercial use please check their individual licenses):
|
||||
* Support of the following fully pre-configured domain blocklist sources (free for private usage, for commercial use please check their individual licenses)
|
||||
|
||||
| Source | Focus | Information |
|
||||
| :------------------ | :--------------------------: | :-------------------------------------------------------------------------------- |
|
||||
| asn | ASN block | [Link](https://asn.ipinfo.app) |
|
||||
| bogon | Bogon prefixes | [Link](https://team-cymru.com) |
|
||||
| country | Country blocks | [Link](https://www.ipdeny.com/ipblocks) |
|
||||
| darklist | Attacker IP blacklist | [Link](https://darklist.de) |
|
||||
| debl | Fail2ban IP blacklist | [Link](https://www.blocklist.de) |
|
||||
| doh | Public DoH-Provider | [Link](https://github.com/dibdot/DoH-IP-blocklists) |
|
||||
| drop | Spamhaus drop compilation | [Link](https://www.spamhaus.org) |
|
||||
| dshield | Dshield IP blocklist | [Link](https://www.dshield.org) |
|
||||
| edrop | Spamhaus edrop compilation | [Link](https://www.spamhaus.org) |
|
||||
| feodo | Feodo Tracker | [Link](https://feodotracker.abuse.ch) |
|
||||
| firehol1 | Firehol Level 1 compilation | [Link](https://iplists.firehol.org/?ipset=firehol_level1) |
|
||||
| firehol2 | Firehol Level 2 compilation | [Link](https://iplists.firehol.org/?ipset=firehol_level2) |
|
||||
| firehol3 | Firehol Level 3 compilation | [Link](https://iplists.firehol.org/?ipset=firehol_level3) |
|
||||
| firehol4 | Firehol Level 4 compilation | [Link](https://iplists.firehol.org/?ipset=firehol_level4) |
|
||||
| iblockads | Advertising blocklist | [Link](https://www.iblocklist.com) |
|
||||
| iblockspy | Malicious spyware blocklist | [Link](https://www.iblocklist.com) |
|
||||
| myip | Myip Live IP blacklist | [Link](https://myip.ms) |
|
||||
| nixspam | iX spam protection | [Link](http://www.nixspam.org) |
|
||||
| proxy | Firehol list of open proxies | [Link](https://iplists.firehol.org/?ipset=proxylists) |
|
||||
| ssbl | SSL botnet IP blacklist | [Link](https://sslbl.abuse.ch) |
|
||||
| threat | Emerging Threats | [Link](https://rules.emergingthreats.net) |
|
||||
| tor | Tor exit nodes | [Link](https://fissionrelays.net/lists) |
|
||||
| uceprotect1 | Spam protection level 1 | [Link](http://www.uceprotect.net/en/index.php) |
|
||||
| uceprotect2 | Spam protection level 2 | [Link](http://www.uceprotect.net/en/index.php) |
|
||||
| voip | VoIP fraud blocklist | [Link](http://www.voipbl.org) |
|
||||
| yoyo | Ad protection blacklist | [Link](https://pgl.yoyo.org/adservers/) |
|
||||
|
||||
* zero-conf like automatic installation & setup, usually no manual changes needed
|
||||
* automatically selects one of the following download utilities: aria2c, curl, uclient-fetch, wget
|
||||
* Really fast downloads & list processing as they are handled in parallel as background jobs in a configurable 'Download Queue'
|
||||
@@ -24,88 +56,305 @@ IP address blocking is commonly used to protect against brute force attacks, pre
|
||||
* procd based init system support (start/stop/restart/reload/refresh/status)
|
||||
* procd network interface trigger support
|
||||
* automatic blocklist backup & restore, they will be used in case of download errors or during startup
|
||||
* output comprehensive runtime information via LuCI or via 'status' init command
|
||||
* Provides comprehensive runtime information
|
||||
* Provides a detailed IPSet Report
|
||||
* Provides a powerful query function to quickly find blocked IPs/CIDR in banIP related IPSets
|
||||
* Provides an easily configurable blocklist update scheduler called 'Refresh Timer'
|
||||
* strong LuCI support
|
||||
* optional: add new banIP sources on your own
|
||||
* optional: log banned inbound and/or outbound IP to syslog.
|
||||
|
||||
## Prerequisites
|
||||
* [OpenWrt](https://openwrt.org), tested with the stable release series (19.07) and with the latest snapshot
|
||||
* download utility: 'uclient-fetch' with one of the 'libustream-*' ssl libraries, 'wget', 'aria2c' or 'curl' is required
|
||||
* [OpenWrt](https://openwrt.org), tested with the stable release series (19.07.x) and with the latest rolling snapshot releases. On turris devices it has been successfully tested with TurrisOS 5.2.x
|
||||
<b>Please note:</b> Older OpenWrt releases like 18.06.x or 17.01.x are _not_ supported!
|
||||
<b>Please note:</b> Devices with less than 128 MByte RAM are _not_ supported!
|
||||
* A download utility with SSL support: 'wget', 'uclient-fetch' with one of the 'libustream-*' ssl libraries, 'aria2c' or 'curl' is required
|
||||
* A certificate store like 'ca-bundle', as banIP checks the validity of the SSL certificates of all download sites by default
|
||||
* Optional E-Mail notification support: for E-Mail notifications you need to install the additional 'msmtp' package
|
||||
|
||||
## Installation & Usage
|
||||
* install 'banip' (_opkg install banip_)
|
||||
* at minimum configure the needed IP blocklist sources, the download utility and enable the banIP service in _/etc/config/banip_
|
||||
* control the banip service manually with _/etc/init.d/banip_ start/stop/restart/reload/refresh/status or use the LuCI frontend
|
||||
* Update your local opkg repository (_opkg update_)
|
||||
* Install 'banip' (_opkg install banip_). The banIP service is disabled by default
|
||||
* Install the LuCI companion package 'luci-app-banip' (_opkg install luci-app-banip_)
|
||||
* It's strongly recommended to use the LuCI frontend to easily configure all aspects of banIP, the application is located in LuCI under the 'Services' menu
|
||||
|
||||
## LuCI banIP companion package
|
||||
* it's recommended to use the provided LuCI frontend to control all aspects of banIP
|
||||
* install 'luci-app-banip' (_opkg install luci-app-banip_)
|
||||
* the application is located in LuCI under 'Services' menu
|
||||
## banIP CLI
|
||||
* All important banIP functions are accessible via CLI as well.
|
||||
<pre><code>
|
||||
~# /etc/init.d/banip
|
||||
Syntax: /etc/init.d/banip [command]
|
||||
|
||||
Available commands:
|
||||
start Start the service
|
||||
stop Stop the service
|
||||
restart Restart the service
|
||||
reload Reload configuration files (or restart if service does not implement reload)
|
||||
enable Enable service autostart
|
||||
disable Disable service autostart
|
||||
enabled Check if service is started on boot
|
||||
refresh Refresh ipsets without new list downloads
|
||||
suspend Suspend banIP processing
|
||||
resume Resume banIP processing
|
||||
query <IP> Query active banIP IPSets for a specific IP address
|
||||
report [<cli>|<mail>|<gen>|<json>] Print banIP related IPset statistics
|
||||
list [<add>|<add_asn>|<add_country>|<remove>|<remove_asn>|<remove_country>] <source(s)> List/Edit available sources
|
||||
timer [<add> <tasks> <hour> [<minute>] [<weekday>]]|[<remove> <line no.>] List/Edit cron update intervals
|
||||
version Print version information
|
||||
running Check if service is running
|
||||
status Service status
|
||||
trace Start with syscall trace
|
||||
</code></pre>
|
||||
|
||||
## banIP config options
|
||||
* usually the pre-configured banIP setup works quite well and no manual overrides are needed
|
||||
* the following options apply to the 'global' config section:
|
||||
* ban\_enabled => main switch to enable/disable banIP service (bool/default: '0', disabled)
|
||||
* ban\_automatic => determine the L2/L3 WAN network device automatically (bool/default: '1', enabled)
|
||||
* ban\_iface => space separated list of WAN network interface(s)/device(s) used by banIP (default: not set, automatically detected)
|
||||
* ban\_realtime => a small log/banIP background monitor to block SSH/LuCI brute force attacks in realtime (bool/default: 'false', disabled)
|
||||
* ban\_target\_src => action to perform when banning inbound IPv4 packets ('DROP'/'REJECT', default: 'DROP')
|
||||
* ban\_target\_src\_6 => action to perform when banning inbound IPv6 packets ('DROP'/'REJECT', default: 'DROP')
|
||||
* ban\_target\_dst => action to perform when banning outbound IPv4 packets ('DROP'/'REJECT', default: 'REJECT')
|
||||
* ban\_target\_dst\_6 => action to perform when banning outbound IPv6 packets ('DROP'/'REJECT', default: 'REJECT')
|
||||
* ban\_log\_src => switch to enable/disable logging of banned inbound IPv4 packets (bool/default: '0', disabled)
|
||||
* ban\_log\_dst => switch to enable/disable logging of banned outbound IPv4 packets (bool/default: '0', disabled)
|
||||
|
||||
* the following options apply to the 'extra' config section:
|
||||
* ban\_debug => enable/disable banIP debug output (bool/default: '0', disabled)
|
||||
* ban\_nice => set the nice level of the banIP process and all sub-processes (int/default: '0', standard priority)
|
||||
* ban\_triggerdelay => additional trigger delay in seconds before banIP processing begins (int/default: '2')
|
||||
* ban\_backupdir => target directory for banIP backups (default: '/tmp')
|
||||
* ban\_sshdaemon => select the SSH daemon for logfile parsing, 'dropbear' or 'sshd' (default: 'dropbear')
|
||||
* ban\_starttype => select the used start type during boot, 'start', 'refresh' or 'reload' (default: 'start')
|
||||
* ban\_maxqueue => size of the download queue to handle downloads & IPSet processing in parallel (int/default: '4')
|
||||
* ban\_fetchutil => name of the used download utility: 'uclient-fetch', 'wget', 'curl', 'aria2c' (default: not set, automatically detected)
|
||||
* ban\_fetchparm => special config options for the download utility (default: not set)
|
||||
* ban\_autoblacklist => store auto-addons temporary in ipset and permanently in local blacklist as well (bool/default: '1', enabled)
|
||||
* ban\_autowhitelist => store auto-addons temporary in ipset and permanently in local whitelist as well (bool/default: '1', enabled)
|
||||
|
||||
## Logging of banned packets
|
||||
* by setting ban\_log\_src=1 / ban\_log\_dst=1 in the config options, banIP will log banned inbound / outbound packets to syslog.
|
||||
* example of a logged inbound (dst) and outbound (src) packet:
|
||||
<pre><code>
|
||||
Oct 2 12:49:14 gateway kernel: [434134.855130] REJECT(dst banIP) IN=br-lan OUT=br-wan MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=100 TOS=0x00 PREC=0x00 TTL=63 ID=7938 PROTO=UDP SPT=16393 DPT=16393 LEN=80
|
||||
|
||||
Oct 3 14:11:13 gateway kernel: [11290.429712] DROP(src banIP) IN=br-wan OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=235 ID=63275 PROTO=TCP SPT=48246 DPT=37860 WINDOW=1024 RES=0x00 SYN URGP=0
|
||||
</code></pre>
|
||||
* to change the default logging behavior, the following options can be added to the 'global' config section:
|
||||
* ban\_log\_src\_opts => IPv4 iptables LOG options for banned inbound packets (default: '-m limit --limit 10/sec')
|
||||
* ban\_log\_src\_opts\_6 => IPv6 iptables LOG options for banned inbound packets (default: '-m limit --limit 10/sec')
|
||||
* ban\_log\_src\_prefix (default: '<ban\_target\_src>(src banIP) ', typically 'DROP(src banIP) ')
|
||||
* ban\_log\_src\_prefix\_6 (default: '<ban\_target\_src\_6>(src banIP) ', typically 'DROP('src banIP)' )
|
||||
* ban\_log\_dst\_opts => IPv4 iptables LOG options for banned outbound packets (default: '-m limit --limit 10/sec')
|
||||
* ban\_log\_dst\_opts\_6 => IPv6 iptables LOG options for banned outbound packets (default: '-m limit --limit 10/sec')
|
||||
* ban\_log\_dst\_prefix (default: '<ban\_target\_dst>(dst banIP) ', typically 'REJECT(dst banIP) ')
|
||||
* ban\_log\_dst\_prefix\_6 (default: '<ban\_target\_dst\_6>(dst banIP) ', typically 'REJECT('dst banIP)' )
|
||||
* Usually the auto pre-configured banIP setup works quite well and no manual overrides are needed
|
||||
|
||||
| Option | Type | Default | Description |
|
||||
| :---------------------- | :----- | :------------------ | :--------------------------------------------------------------------------------------------------- |
|
||||
| ban_enabled | option | 0 | enable the banIP service |
|
||||
| ban_autodetect | option | 1 | auto-detect wan interfaces, devices and subnets |
|
||||
| ban_debug | option | 0 | enable banIP related debug logging |
|
||||
| ban_mail_enabled | option | 0 | enable the mail service |
|
||||
| ban_monitor_enabled | option | 0 | enable the log monitor, e.g. to catch failed ssh/luci logins |
|
||||
| ban_logsrc_enabled | option | 0 | enable the src-related logchain |
|
||||
| ban_logdst_enabled | option | 0 | enable the dst-related logchain |
|
||||
| ban_autoblacklist | option | 1 | add suspicious IPs automatically to the local blacklist |
|
||||
| ban_autowhitelist | option | 1 | add wan IPs/subnets automatically to the local whitelist |
|
||||
| ban_maxqueue | option | 4 | size of the download queue to handle downloads and processing in parallel |
|
||||
| ban_reportdir | option | /tmp/banIP-Report | directory where banIP stores the report files |
|
||||
| ban_backupdir | option | /tmp/banIP-Backup | directory where banIP stores the compressed backup files |
|
||||
| ban_ifaces | list | - | list option to add logical wan interfaces manually |
|
||||
| ban_sources | list | - | list option to add banIP sources |
|
||||
| ban_countries | list | - | list option to add certain countries as an alpha-2 ISO code, e.g. 'de' for germany |
|
||||
| ban_asns | list | - | list option to add certain ASNs (autonomous system number), e.g. '32934' for facebook |
|
||||
| ban_chain | option | banIP | name of the root chain used by banIP |
|
||||
| ban_global_settype | option | src+dst | global settype as default for all sources |
|
||||
| ban_settype_src | list | - | special SRC settype for a certain sources |
|
||||
| ban_settype_dst | list | - | special DST settype for a certain sources |
|
||||
| ban_settype_all | list | - | special SRC+DST settype for a certain sources |
|
||||
| ban_target_src | option | DROP | default src action (used by log chains as well) |
|
||||
| ban_target_dst | option | REJECT | default dst action (used by log chains as well) |
|
||||
| ban_lan_inputchains_4 | list | input_lan_rule | list option to add IPv4 lan input chains |
|
||||
| ban_lan_inputchains_6 | list | input_lan_rule | list option to add IPv6 lan input chains |
|
||||
| ban_lan_forwardchains_4 | list | forwarding_lan_rule | list option to add IPv4 lan forward chains |
|
||||
| ban_lan_forwardchains_6 | list | forwarding_lan_rule | list option to add IPv6 lan forward chains |
|
||||
| ban_wan_inputchains_4 | list | input_wan_rule | list option to add IPv4 wan input chains |
|
||||
| ban_wan_inputchains_6 | list | input_wan_rule | list option to add IPv6 wan input chains |
|
||||
| ban_wan_forwardchains_4 | list | forwarding_wan_rule | list option to add IPv4 wan forward chains |
|
||||
| ban_wan_forwardchains_6 | list | forwarding_wan_rule | list option to add IPv6 wan forward chains |
|
||||
| ban_mailreceiver | option | - | receiver address for banIP related notification E-Mails |
|
||||
| ban_mailsender | option | no-reply@banIP | sender address for banIP related notification E-Mails |
|
||||
| ban_mailtopic | option | banIP notification | topic for banIP related notification E-Mails |
|
||||
| ban_mailprofile | option | ban_notify | mail profile used in 'msmtp' for banIP related notification E-Mails |
|
||||
| ban_srcarc | option | /etc/banip/banip.sources.gz | full path to the compressed source archive file used by banIP |
|
||||
| ban_maclist | option | /etc/banip/banip.maclist | full path to the maclist file used by banIP |
|
||||
| ban_blacklist | option | /etc/banip/banip.blacklist | full path to the blacklist file used by banIP |
|
||||
| ban_whitelist | option | /etc/banip/banip.whitelist | full path to the whitelist file used by banIP |
|
||||
|
||||
## Examples
|
||||
**list/edit banIP sources:**
|
||||
|
||||
<pre><code>
|
||||
~# /etc/init.d/banip list
|
||||
::: Available banIP sources
|
||||
:::
|
||||
Name Enabled Focus Info URL
|
||||
---------------------------------------------------------------------------
|
||||
+ asn ASN blocks https://asn.ipinfo.app
|
||||
+ bogon Bogon prefixes https://team-cymru.com
|
||||
+ country x Country blocks https://www.ipdeny.com/ipblocks
|
||||
+ debl x Fail2ban IP blacklist https://www.blocklist.de
|
||||
+ doh x Public DoH-Provider https://github.com/dibdot/DoH-IP-blocklists
|
||||
+ drop x Spamhaus drop compilation https://www.spamhaus.org
|
||||
+ dshield x Dshield IP blocklist https://www.dshield.org
|
||||
+ edrop Spamhaus edrop compilation https://www.spamhaus.org
|
||||
+ feodo x Feodo Tracker https://feodotracker.abuse.ch
|
||||
+ firehol1 x Firehol Level 1 compilation https://iplists.firehol.org/?ipset=firehol_level1
|
||||
+ firehol2 Firehol Level 2 compilation https://iplists.firehol.org/?ipset=firehol_level2
|
||||
+ firehol3 Firehol Level 3 compilation https://iplists.firehol.org/?ipset=firehol_level3
|
||||
+ firehol4 Firehol Level 4 compilation https://iplists.firehol.org/?ipset=firehol_level4
|
||||
+ iblockads Advertising blocklist https://www.iblocklist.com
|
||||
+ iblockspy x Malicious spyware blocklist https://www.iblocklist.com
|
||||
+ myip Myip Live IP blacklist https://myip.ms
|
||||
+ nixspam x iX spam protection http://www.nixspam.org
|
||||
+ proxy Firehol list of open proxies https://iplists.firehol.org/?ipset=proxylists
|
||||
+ sslbl x SSL botnet IP blacklist https://sslbl.abuse.ch
|
||||
+ threat x Emerging Threats https://rules.emergingthreats.net
|
||||
+ tor x Tor exit nodes https://fissionrelays.net/lists
|
||||
+ uceprotect1 x Spam protection level 1 http://www.uceprotect.net/en/index.php
|
||||
+ uceprotect2 Spam protection level 2 http://www.uceprotect.net/en/index.php
|
||||
+ voip x VoIP fraud blocklist http://www.voipbl.org
|
||||
+ yoyo x Ad protection blacklist https://pgl.yoyo.org/adservers/
|
||||
---------------------------------------------------------------------------
|
||||
* Configured ASNs: -
|
||||
* Configured Countries: af, bd, br, cn, hk, hu, id, il, in, iq, ir, kp, kr, no, pk, pl, ro, ru, sa, th, tr, ua, gb
|
||||
</code></pre>
|
||||
|
||||
**receive banIP runtime information:**
|
||||
|
||||
# /etc/init.d/banip status
|
||||
::: banIP runtime information
|
||||
+ status : enabled
|
||||
+ version : 0.3.0
|
||||
+ util_info : /usr/bin/aria2c, true
|
||||
+ ipset_info : 10 IPSets with overall 106729 IPs/Prefixes
|
||||
+ backup_dir : /tmp
|
||||
+ last_run : 03.10.2019 19:15:25
|
||||
+ system : UBNT-ERX, OpenWrt SNAPSHOT r11102-ced4c0e635
|
||||
<pre><code>
|
||||
~# /etc/init.d/banip status
|
||||
::: banIP runtime information
|
||||
+ status : enabled
|
||||
+ version : 0.7.0
|
||||
+ ipset_info : 23 IPSets with 302008 IPs/Prefixes
|
||||
+ active_sources : blacklist, country, debl, doh, drop, dshield, feodo, firehol1, iblockspy, nixspam, sslbl, threat,
|
||||
tor, uceprotect1, voip, whitelist, yoyo
|
||||
+ active_devs : eth3
|
||||
+ active_ifaces : wan, wan6
|
||||
+ active_logterms : dropbear, sshd, luci
|
||||
+ active_subnets : xxx.xxx.x.xxx/24, xxxx:xxxx:xxxx:x:xxxx:xxxx:xxxx:xxxx/64
|
||||
+ run_infos : settype: src+dst, backup_dir: /mnt/data/banip, report_dir: /tmp/banIP-Report
|
||||
+ run_flags : protocols (4/6): ✔/✔, log (src/dst): ✔/✘, monitor: ✔, mail: ✔
|
||||
+ last_run : refresh, 0m 16s, 4019/3527/3680, 03.02.2021 19:57:46
|
||||
+ system : PC Engines apu4, OpenWrt SNAPSHOT r15556-20a0d435d8
|
||||
</code></pre>
|
||||
|
||||
**generate an IPSet report:**
|
||||
|
||||
**cronjob for a regular IPSet blocklist update (/etc/crontabs/root):**
|
||||
|
||||
# Every day at 06:00, update the IPSets of banIP
|
||||
00 06 * * * /etc/init.d/banip reload
|
||||
<pre><code>
|
||||
~# /etc/init.d/banip report
|
||||
:::
|
||||
::: report on all banIP related IPSets
|
||||
:::
|
||||
+ Report timestamp ::: 04.02.2021 06:24:41
|
||||
+ Number of all IPSets ::: 24
|
||||
+ Number of all entries ::: 302448
|
||||
+ Number of IP entries ::: 224748
|
||||
+ Number of CIDR entries ::: 77700
|
||||
+ Number of MAC entries ::: 0
|
||||
+ Number of accessed entries ::: 36
|
||||
:::
|
||||
::: IPSet details
|
||||
:::
|
||||
Name Type Count Cnt_IP Cnt_CIDR Cnt_MAC Cnt_ACC Entry details (Entry/Count)
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
whitelist_4 src+dst 1 0 1 0 1
|
||||
xxx.xxxx.xxx.xxxx/24 85
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
whitelist_6 src+dst 2 0 2 0 1
|
||||
xxxx:xxxx:xxxx::/64 29
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
blacklist_4 src+dst 513 513 0 0 2
|
||||
192.35.168.16 3
|
||||
80.82.65.74 1
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
blacklist_6 src+dst 1 1 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
country_4 src 52150 0 52150 0 23
|
||||
124.5.0.0/16 1
|
||||
95.188.0.0/14 1
|
||||
121.16.0.0/12 1
|
||||
46.161.0.0/18 1
|
||||
42.56.0.0/14 1
|
||||
113.64.0.0/10 1
|
||||
113.252.0.0/14 1
|
||||
5.201.128.0/17 1
|
||||
125.64.0.0/11 1
|
||||
90.188.0.0/15 1
|
||||
60.0.0.0/11 1
|
||||
78.160.0.0/11 1
|
||||
1.80.0.0/12 1
|
||||
183.184.0.0/13 1
|
||||
175.24.0.0/14 1
|
||||
119.176.0.0/12 1
|
||||
59.88.0.0/13 1
|
||||
103.78.12.0/22 1
|
||||
123.128.0.0/13 1
|
||||
116.224.0.0/12 1
|
||||
42.224.0.0/12 1
|
||||
82.80.0.0/15 1
|
||||
14.32.0.0/11 1
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
country_6 src 20099 0 20099 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
debl_4 src+dst 29389 29389 0 0 1
|
||||
5.182.210.16 4
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
debl_6 src+dst 64 64 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
doh_4 src+dst 168 168 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
doh_6 src+dst 122 122 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
drop_4 src+dst 965 0 965 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
drop_6 src+dst 36 0 36 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
dshield_4 src+dst 20 0 20 0 1
|
||||
89.248.165.0/24 1
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
feodo_4 src+dst 325 325 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
firehol1_4 src+dst 2763 403 2360 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
iblockspy_4 src+dst 3650 2832 818 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
nixspam_4 src+dst 9577 9577 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
sslbl_4 src+dst 104 104 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
threat_4 src+dst 1300 315 985 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
tor_4 src+dst 1437 1437 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
tor_6 src+dst 478 478 0 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
uceprotect1_4 src+dst 156249 156249 0 0 6
|
||||
192.241.220.137 1
|
||||
128.14.137.178 1
|
||||
61.219.11.153 1
|
||||
138.34.32.33 1
|
||||
107.174.133.130 2
|
||||
180.232.99.46 1
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
voip_4 src+dst 12563 12299 264 0 0
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
yoyo_4 src+dst 10472 10472 0 0 1
|
||||
204.79.197.200 2
|
||||
--------------------------------------------------------------------------------------------------------------------
|
||||
</code></pre>
|
||||
|
||||
**Enable E-Mail notification via 'msmtp':**
|
||||
To use the email notification you have to install & configure the package 'msmtp'.
|
||||
Modify the file '/etc/msmtprc', e.g.:
|
||||
<pre><code>
|
||||
[...]
|
||||
defaults
|
||||
auth on
|
||||
tls on
|
||||
tls_certcheck off
|
||||
timeout 5
|
||||
syslog LOG_MAIL
|
||||
[...]
|
||||
account ban_notify
|
||||
host smtp.gmail.com
|
||||
port 587
|
||||
from <address>k@gmail.com
|
||||
user <gmail-user>
|
||||
password <password>
|
||||
</code></pre>
|
||||
Finally enable E-Mail support and add a valid E-Mail receiver address in LuCI.
|
||||
|
||||
**Edit, add new adblock sources:**
|
||||
The banIP blocklist sources are stored in an external, compressed JSON file '/etc/banip/banip.sources.gz'.
|
||||
This file is directly parsed in LuCI and accessible via CLI, just call _/etc/init.d/banip list_.
|
||||
|
||||
To add new or edit existing sources extract the compressed JSON file _gunzip /etc/banip/banip.sources.gz_.
|
||||
A valid JSON source object contains the following required information, e.g.:
|
||||
<pre><code>
|
||||
[...]
|
||||
"tor": {
|
||||
"url_4": "https://lists.fissionrelays.net/tor/exits-ipv4.txt",
|
||||
"url_6": "https://lists.fissionrelays.net/tor/exits-ipv6.txt",
|
||||
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]|$)/{print \"add tor_4 \"$1}",
|
||||
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]]|$)/{print \"add tor_6 \"$1}",
|
||||
"focus": "Tor exit nodes",
|
||||
"descurl": "https://fissionrelays.net/lists"
|
||||
},
|
||||
[...]
|
||||
</code></pre>
|
||||
Add an unique object name, make the required changes to 'url_4', 'rule_4' (and/or 'url_6', 'rule_6'), 'focus' and 'descurl' and finally compress the changed JSON file _gzip /etc/banip/banip.sources.gz_ to use the new source object in banIP.
|
||||
<b>Please note:</b> if you're going to add new sources on your own, please make a copy of the default file and work with that copy further on, cause the default will be overwritten with every banIP update. To reference your copy set the option 'ban\_srcarc' which points by default to '/etc/banip/banip.sources.gz'
|
||||
|
||||
## Support
|
||||
Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-support-thread/16985) or contact me by mail <dev@brenken.org>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user