b17588a856
a new script based package called "banIP" to block incoming & outgoing ip adresses/subnets via ipset. Features: * a shell script which uses ipset and iptables to ban a large number of IP addresses published in various IP blacklists (bogon, firehol etc.) * support blocking by ASN numbers * support blocking by iso country codes * support local white & blacklist (IPv4, IPv6 & CIDR notation) * auto-add unsuccessful ssh login attempts to local blacklist * auto-add the uplink subnet to local whitelist * per source configuration of SRC (incoming) and DST (outgoing) * supports IPv4 & IPv6 Strong LuCI support: * easy interface to track & change all aspects of your ipset configuration on the fly * integrated IPSet-Lookup * integrated RIPE-Lookup * Log-Viewer & online configuration of white- & blacklist LuCI-Screenshots will follow in the second post. Forum discussion: https://forum.openwrt.org/t/banip-new-project-needs-testers-feedback/16985 Signed-off-by: Dirk Brenken <dev@brenken.org>
75 lines
3.6 KiB
Markdown
75 lines
3.6 KiB
Markdown
# banIP - ban incoming and/or outgoing ip adresses via ipsets
|
|
|
|
## Description
|
|
IP address blocking is commonly used to protect against brute force attacks, prevent disruptive or unautherized address(es) from access or it can be used to restrict access to or from a particular geographic area — for example.
|
|
|
|
## Main Features
|
|
* support many IP blocklist sources (free for private usage, for commercial use please check their individual licenses):
|
|
* zero-conf like automatic installation & setup, usually no manual changes needed
|
|
* supports six different download utilities: uclient-fetch, wget, curl, aria2c, wget-nossl, busybox-wget
|
|
* Really fast downloads & list processing as they are handled in parallel as background jobs in a configurable 'Download Queue'
|
|
* provides 'http only' mode without installed ssl library for all non-SSL blocklist sources
|
|
* full IPv4 and IPv6 support
|
|
* ipsets (one per source) are used to ban a large number of IP addresses
|
|
* supports blocking by ASN numbers
|
|
* supports blocking by iso country codes
|
|
* supports local white & blacklist (IPv4, IPv6 & CIDR notation), located by default in /etc/banip/banip.whitelist and /etc/banip/banip.blacklist
|
|
* auto-add unsuccessful ssh login attempts to local blacklist
|
|
* auto-add the uplink subnet to local whitelist
|
|
* per source configuration of SRC (incoming) and DST (outgoing)
|
|
* integrated IPSet-Lookup
|
|
* integrated RIPE-Lookup
|
|
* blocklist source parsing by fast & flexible regex rulesets
|
|
* minimal status & error logging to syslog, enable debug logging to receive more output
|
|
* procd based init system support (start/stop/restart/reload/status)
|
|
* procd network interface trigger support
|
|
* output comprehensive runtime information via LuCI or via 'status' init command
|
|
* strong LuCI support
|
|
* optional: add new banIP sources on your own
|
|
|
|
## Prerequisites
|
|
* [OpenWrt](https://openwrt.org), tested with the stable release series (18.06) and with the latest snapshot
|
|
* a download utility:
|
|
* to support all blocklist sources a full version (with ssl support) of 'wget', 'uclient-fetch' with one of the 'libustream-*' ssl libraries, 'aria2c' or 'curl' is required
|
|
* for limited devices with real memory constraints, banIP provides also a 'http only' option and supports wget-nossl and uclient-fetch (without libustream-ssl) as well
|
|
|
|
## Installation & Usage
|
|
* install 'banip' (_opkg install banip_)
|
|
* at minimum configure the needed IP blocklist sources, the download utility and enable the banIP service in _/etc/config/banip_
|
|
* control the banip service manually with _/etc/init.d/banip_ start/stop/restart/reload/status or use the LuCI frontend
|
|
|
|
## LuCI banIP companion package
|
|
* it's recommended to use the provided LuCI frontend to control all aspects of banIP
|
|
* install 'luci-app-banip' (_opkg install luci-app-banip_)
|
|
* the application is located in LuCI under 'Services' menu
|
|
|
|
## Examples
|
|
**receive banIP runtime information:**
|
|
|
|
<pre><code>
|
|
/etc/init.d/banip status
|
|
::: banIP runtime information
|
|
+ status : enabled
|
|
+ version : 0.0.5
|
|
+ fetch_info : /bin/uclient-fetch (libustream-ssl)
|
|
+ ipset_info : 3 IPSets with overall 29510 IPs/Prefixes
|
|
+ last_run : 08.11.2018 15:03:50
|
|
+ system : GL-AR750S, OpenWrt SNAPSHOT r8419-860de2e1aa
|
|
</code></pre>
|
|
|
|
**cronjob for a regular block list update (/etc/crontabs/root):**
|
|
|
|
<pre><code>
|
|
0 06 * * * /etc/init.d/banip reload
|
|
</code></pre>
|
|
|
|
|
|
## Support
|
|
Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-new-project-needs-testers-feedback/16985) or contact me by mail <dev@brenken.org>
|
|
|
|
## Removal
|
|
* stop all banIP related services with _/etc/init.d/banip stop_
|
|
* optional: remove the banip package (_opkg remove banip_)
|
|
|
|
Have fun!
|
|
Dirk
|