Skip to content

README.md

Latest commit

 

History

History
121 lines (89 loc) · 2.12 KB

README.md

File metadata and controls

121 lines (89 loc) · 2.12 KB

blocklist

Get bad ip's list from blocklist.de, uceprotect.net, binarydefense, firehol, danger.rulez.sk put them on Firewall and keep robots, bruteforces, etc, so far away..
The List:

  • the download is for what type of bad ips? The ips try get access the following ports or services:

    • 21
    • 22
    • 23
    • 25
    • 80
    • 110
    • 143
    • 443
    • 993
    • apache
    • asterisk
    • bots
    • bruteforcelogin
    • courierimap
    • courierpop3
    • dnsbl
    • email
    • ftp
    • imap
    • ircbot
    • pop3
    • submission
    • postfix
    • sip
    • ssh

====Usage:====

Automatic blocklist on Firewall:

Create:

  • a table <blocklist> on your "pf.conf"
table <blocklist> persist file "/var/db/blocklist"
  • a rule to block
  • ie: assume ext_if="em0"
block drop in log quick on $ext_if from <blocklist> to any

if you want not block 'maybe' a some legitimate email and sender notified "why was rejected" by your mail system change rule to:

block drop in log quick on $ext_if proto tcp from <blocklist> to any port != smtp
block drop in log quick on $ext_if proto { udp, icmp } from <blocklist> to any

First run script manually, if all will be ok Then Add on crontab to run ie: every 2 hours

#minute (0-59)
#|	   hour (0-23)
#|      |       day of the month (1-31)
#|      |       |       month of the year (1-12 or Jan-Dec)
#|      |       |       |       day of the week (0-6 with 0=Sun or Sun-Sat)
#|      |       |       |       |       who
#|      |       |       |       |       |       commands
#|      |       |       |       |       |       |
00      */2     *       *       *       root    /usr/local/sbin/blocklist > /dev/null 2>&1

#to execute script on startup
@reboot root    /usr/local/sbin/blocklist > /dev/null 2>&1
Check if get all:

"pfctl -t blocklist -T show | wc -l"

  • Tools:
    • FreeBSD/OpenBSD
    • Wget
  • doesn't work on bash

[^]: The .csh extension in file it is not necessary, has placed only for github detect correct syntax highlighting language on source