Giter Club home page Giter Club logo

blocklist-ipsets's Introduction

FireHOL

http://firehol.org/

FireHOL, an iptables stateful packet filtering firewall for humans!
FireQOS, a TC based bandwidth shaper for humans!

Git

These instructions are for people who are working with the git repository. There are more general instructions starting with Upgrade Notes.

Cloning Git Repository

The github firehol repository page lists URLs which can be used to clone the repository.

After cloning you should copy the git hooks, for style checking and more:

cp hooks/* .git/hooks

Building Git Repository

You need GNU autoconf and GNU automake to be able to run:

./autogen.sh
./configure --enable-maintainer-mode
make
make install

If you don't want to have to install pandoc you can instead choose to build without documentation or manpages:

./autogen.sh
./configure --disable-doc --disable-man
make
make install

Re-run autogen.sh whenever you change configure.ac or a Makefile.am

You can run the sbin/* scripts in-situ provided you have done the configure and make steps.

Upgrade Notes

From version 2.0.0-pre6, FireHOL adds combined IPv4/IPv6 support within a single configuration.

If you are upgrading FireHOL from a version earlier than 2.0.0-pre6, please read the upgrade notes.

Installation

If you are installing the package from a tar-files release, FireHOL uses the GNU Autotools so you can just do:

./configure
make
make install

To not have files appear under /usr/local, try something like:

./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make
make install

If your O/S does not usually have a /usr/libexec, you may want to add --libexecdir=/usr/lib to the configure.

You can get help on the options available (including disabling unwanted components) by running:

./configure --help

From version 3.0.0 it is no longer recommended to install firehol by copying files, since a function library is now used, in addition to the scripts.

Getting Started

Configuration for FireHOL goes in /etc/firehol/firehol.conf Configuration for FireQOS goes in /etc/firehol/fireqos.conf

In the examples directory, you can find examples for both programs.

To start the programs:

firehol start
fireqos start

For more details on the command-line options, see the man-pages:

man firehol
man fireqos

Read the tutorials on the website for more information and to learn how to configure the programs.

For detailed information on the configuration files, read the manual online, or start with these the man-pages:

man firehol.conf
man fireqos.conf

You may want to ensure that FireHOL and FireQOS run at boot-time. If you installed from an distribution package this will be configured in the usual way.

For a tar-file installation, the binaries can often be linked directly into /etc/init.d, since their options are SysVInit compatible. Some example systemd service files can be found in the contrib folder.

Support and documentation

The main website is http://firehol.org/.

To ask questions please sign up to the mailing list

Man pages, PDF and HTML documentation are provided as part of the package and can be found in the tarball or in your distribution's standard locations (e.g. /usr/share/doc). The latest manual is also online.

The site has a list of all services supported by FireHOL "out of the box" as well as information on adding new services.

License

Copyright (C) 2012-2017 Phil Whineray <[email protected]>
Copyright (C) 2002-2017 Costa Tsaousis <[email protected]>

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

blocklist-ipsets's People

Contributors

ktsaou avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

blocklist-ipsets's Issues

[firehol_level1]: RAM usage of this list in ipset?

Hello,

i see that the level1 list has 6650 entries which translates to 651 241 274 IPs
In ipset i seen one IP seems to use around 20 bytes if i am not wrong, million IPs is 20 MB and 651 241 274 * 20 bytes is 13024825480 bytes which is 12.13031 GB

I thought IPsets are in RAM, my serer has only like 6GB RAM free. So i can not afford to dedicate much RAM to ipset.

Server has HDD, not SSD. I am curious what is RAM usage of level1 list and what is the best way to apply it in my case so it is effective. Thank You

OpenBL.org is shutting down

From their twitter:

Sorry to announce but due to time and financial constraints https://t.co/56UtmZjNni will stop updating end of April and shutdown end of May.

Depending on how things turn out, removing the lists may be necessary.

ip blacklisted but can be removed

Hi please remove ip address: 92.48.206.226 this is used by NAS4Free nas4free.org and not used for spam.

thanks,
zoon01
developer NAS4Free

The Dragon Research Group (DRG) is dead (dragon_*) feeds

In case you weren't aware, the dragon_* feeds are officially dead and are no longer being updated. Most of the underlying infrastructure responsible for the feed data has been shut down. The home page remains, but eventually it is expected to go away as well. The DRG is in a word, dead.

Perhaps you'd keep any old data around for awhile while the dragonresearchgroup.org page is still accessible? Otherwise, I'd recommend removing references to that project and the data.

I am the former Managing Director. Horse's mouth here. :-) Fortunately there is some good news. I'll open up a second issue with details.

Failed to extract geolite2_country on Alpine (busybox)

Hi folks, I'm looking to deploy Alpine Linux as a firewall/filter and it this issue while running update-ipsets.sh:

                                  |
                   geolite2_country| Enabling due to --enable-all option.
                                   | 9049639/10090 mins passed, downloading...
                                   | fetch: 'http://geolite.maxmind.com/download/geoip/database ... '
                                   | HTTP/200 OK
                                   | downloaded successfully
                                   | saving downloaded file
                                   | extracting country and continent netsets...
/usr/bin/unzip: unrecognized option: j
BusyBox v1.25.1 (2016-10-26 16:15:20 GMT) multi-call binary.

Usage: unzip [-lnopq] FILE[.zip] [FILE]... [-x FILE...] [-d DIR]

Extract FILEs from ZIP archive

        -l      List contents (with -q for short form)
        -n      Never overwrite files (default: ask)
        -o      Overwrite
        -p      Print to stdout
        -q      Quiet
        -x FILE Exclude FILEs
        -d DIR  Extract into DIR
                                   | grouping country and continent netsets...
/usr/bin/unzip: unrecognized option: j
BusyBox v1.25.1 (2016-10-26 16:15:20 GMT) multi-call binary.

Usage: unzip [-lnopq] FILE[.zip] [FILE]... [-x FILE...] [-d DIR]

Extract FILEs from ZIP archive

        -l      List contents (with -q for short form)
        -n      Never overwrite files (default: ask)
        -o      Overwrite
        -p      Print to stdout
        -q      Quiet
        -x FILE Exclude FILEs
        -d DIR  Extract into DIR
                                   | aggregating country and continent netsets...
cat: can't open '*.source.tmp': No such file or directory
rm: can't remove '*.source.tmp': No such file or directory
cat: can't open '*.source.tmp.info': No such file or directory
                                   |
                                  *|  ERROR  processed file has no valid entries (zero unique IPs)
                                   |

Clearly the processor/config for geolite2_country is using a special option. I haven't yet looked into what unzip -j does. Is it realistic to see if it can be replaced with something more compatible?

Alpine Linux is built for smaller installs and focusses on security, speed and simplicity, the perfect distro for a router. It's got some things in common with OpenWRT, another platform that I guess may also hit this error as it also runs off busybox.

firehol_webserver.netset blocks nodejs for updating on Debian 8

Issue:

Hit http://security.debian.org jessie/updates InRelease
Ign http://ftp.us.debian.org jessie InRelease
Hit http://ftp.us.debian.org jessie-updates InRelease
Hit http://security.debian.org stretch/updates InRelease
Hit http://packages.dotdeb.org jessie InRelease
Hit http://dl.hhvm.com jessie InRelease
Hit http://mariadb.mirror.rafal.ca jessie InRelease
Hit http://apt.postgresql.org jessie-pgdg InRelease
Hit http://ftp.us.debian.org jessie-backports InRelease
Hit http://security.debian.org jessie/updates/main Sources
Hit http://ftp.us.debian.org stretch InRelease
Hit http://ftp.us.debian.org jessie Release.gpg
Hit http://security.debian.org jessie/updates/contrib Sources
Hit http://security.debian.org jessie/updates/non-free Sources
Hit http://ftp.us.debian.org jessie-updates/main Sources
Hit http://security.debian.org jessie/updates/main amd64 Packages
Hit http://security.debian.org jessie/updates/contrib amd64 Packages
Hit http://ftp.us.debian.org jessie-updates/contrib Sources
Hit http://security.debian.org jessie/updates/non-free amd64 Packages
Hit http://security.debian.org jessie/updates/contrib Translation-en
Hit http://ftp.us.debian.org jessie-updates/non-free Sources
Hit http://security.debian.org jessie/updates/main Translation-en
Hit http://security.debian.org jessie/updates/non-free Translation-en
Hit http://dl.hhvm.com jessie/main amd64 Packages
Hit http://security.debian.org stretch/updates/main Sources
Get:1 http://ftp.us.debian.org jessie-updates/main amd64 Packages/DiffIndex [3,472 B]
Hit http://security.debian.org stretch/updates/contrib Sources
Hit http://mariadb.mirror.rafal.ca jessie/main Sources
Hit http://security.debian.org stretch/updates/non-free Sources
Hit http://packages.dotdeb.org jessie/all Sources
Hit http://mariadb.mirror.rafal.ca jessie/main amd64 Packages
Ign https://deb.nodesource.com jessie InRelease
Hit http://security.debian.org stretch/updates/main amd64 Packages
Hit http://ftp.us.debian.org jessie-updates/contrib amd64 Packages
Hit http://security.debian.org stretch/updates/contrib amd64 Packages
Hit http://mariadb.mirror.rafal.ca jessie/main i386 Packages
Hit http://security.debian.org stretch/updates/non-free amd64 Packages
Get:2 http://ftp.us.debian.org jessie-updates/non-free amd64 Packages/DiffIndex [736 B]
Hit http://packages.dotdeb.org jessie/all amd64 Packages
Hit http://security.debian.org stretch/updates/contrib Translation-en
Hit http://ftp.us.debian.org jessie-updates/contrib Translation-en
Hit http://security.debian.org stretch/updates/main Translation-en
Hit http://apt.postgresql.org jessie-pgdg/main amd64 Packages
Hit http://security.debian.org stretch/updates/non-free Translation-en
Get:3 http://ftp.us.debian.org jessie-updates/main Translation-en/DiffIndex [1,720 B]
Get:4 http://ftp.us.debian.org jessie-updates/non-free Translation-en/DiffIndex [736 B]
Hit http://ftp.us.debian.org jessie Release
Ign http://dl.hhvm.com jessie/main Translation-en_US
Ign http://dl.hhvm.com jessie/main Translation-en
Get:5 http://ftp.us.debian.org jessie-backports/main Sources/DiffIndex [27.8 kB]
Get:6 http://ftp.us.debian.org jessie-backports/contrib Sources/DiffIndex [13.3 kB]
Ign http://mariadb.mirror.rafal.ca jessie/main Translation-en_US
Ign http://mariadb.mirror.rafal.ca jessie/main Translation-en
Get:7 http://ftp.us.debian.org jessie-backports/non-free Sources/DiffIndex [6,760 B]
Get:8 http://ftp.us.debian.org jessie-backports/main amd64 Packages/DiffIndex [27.8 kB]
Ign https://deb.nodesource.com jessie Release.gpg
Get:9 http://ftp.us.debian.org jessie-backports/contrib amd64 Packages/DiffIndex [8,512 B]
Get:10 http://ftp.us.debian.org jessie-backports/non-free amd64 Packages/DiffIndex [6,622 B]
Ign http://packages.dotdeb.org jessie/all Translation-en_US
Ign http://packages.dotdeb.org jessie/all Translation-en
Get:11 http://ftp.us.debian.org jessie-backports/contrib Translation-en/DiffIndex [3,532 B]
Get:12 http://ftp.us.debian.org jessie-backports/main Translation-en/DiffIndex [27.8 kB]
Get:13 http://ftp.us.debian.org jessie-backports/non-free Translation-en/DiffIndex [6,346 B]
Get:14 http://ftp.us.debian.org stretch/main Sources/DiffIndex [27.9 kB]
Get:15 http://ftp.us.debian.org stretch/non-free Sources/DiffIndex [27.8 kB]
Get:16 http://ftp.us.debian.org stretch/contrib Sources/DiffIndex [27.8 kB]
Get:17 http://ftp.us.debian.org stretch/main amd64 Packages/DiffIndex [27.9 kB]
Get:18 http://ftp.us.debian.org stretch/non-free amd64 Packages/DiffIndex [27.8 kB]
Get:19 http://ftp.us.debian.org stretch/contrib amd64 Packages/DiffIndex [27.8 kB]
Ign https://deb.nodesource.com jessie Release
Get:20 http://ftp.us.debian.org stretch/contrib Translation-en/DiffIndex [23.9 kB]
Get:21 http://ftp.us.debian.org stretch/main Translation-en/DiffIndex [27.9 kB]
Get:22 http://ftp.us.debian.org stretch/non-free Translation-en/DiffIndex [27.8 kB]
Hit http://ftp.us.debian.org jessie/main Sources
Hit http://ftp.us.debian.org jessie/non-free Sources
Hit http://ftp.us.debian.org jessie/contrib Sources
Hit http://ftp.us.debian.org jessie/main amd64 Packages
Hit http://ftp.us.debian.org jessie/non-free amd64 Packages
Hit http://ftp.us.debian.org jessie/contrib amd64 Packages
Hit http://ftp.us.debian.org jessie/contrib Translation-en
Ign http://apt.postgresql.org jessie-pgdg/main Translation-en_US
Ign http://apt.postgresql.org jessie-pgdg/main Translation-en
Hit http://ftp.us.debian.org jessie/main Translation-en
Hit http://ftp.us.debian.org jessie/non-free Translation-en
Ign https://deb.nodesource.com jessie/main Sources/DiffIndex
Ign https://deb.nodesource.com jessie/main amd64 Packages/DiffIndex
Ign https://deb.nodesource.com jessie/main Translation-en_US
Ign https://deb.nodesource.com jessie/main Translation-en
Err https://deb.nodesource.com jessie/main Sources
  Failed to connect to deb.nodesource.com port 443: No route to host
Err https://deb.nodesource.com jessie/main amd64 Packages
  Failed to connect to deb.nodesource.com port 443: No route to host
Fetched 382 kB in 26s (14.6 kB/s)
W: Failed to fetch https://deb.nodesource.com/node_0.12/dists/jessie/main/source/Sources  Failed to connect to deb.nodesource.com port 443: No route to host

W: Failed to fetch https://deb.nodesource.com/node_0.12/dists/jessie/main/binary-amd64/Packages  Failed to connect to deb.nodesource.com port 443: No route to host

E: Some index files failed to download. They have been ignored, or old ones used instead.

firehol.conf relevant settings:

    # subnets - netsets
    for x in fullbogons bogons dshield spamhaus_drop spamhaus_edrop \
        firehol_abusers_1d firehol_abusers_30d \
        firehol_level1 firehol_level2 firehol_level3 \
        firehol_level4 \
        firehol_webserver
    do
        ipset4 create  ${x} hash:net
        ipset4 addfile ${x} ipsets/${x}.netset
        blacklist4 full inface "${world}" log "BLACKLIST ${x^^}" ipset:${x} \
            except src ipset:whitelist
    done

/etc/apt/sources.list.d/nodesource.list

deb https://deb.nodesource.com/node_0.12 jessie main
deb-src https://deb.nodesource.com/node_0.12 jessie main

When firehol_webserver is removed apt-get update works correctly as follows:

Hit http://mariadb.mirror.rafal.ca jessie InRelease
Ign http://ftp.us.debian.org jessie InRelease
Hit http://ftp.us.debian.org jessie-updates InRelease
Hit http://packages.dotdeb.org jessie InRelease
Hit http://dl.hhvm.com jessie InRelease
Hit http://security.debian.org jessie/updates InRelease
Hit http://ftp.us.debian.org jessie-backports InRelease
Hit http://apt.postgresql.org jessie-pgdg InRelease
Hit https://deb.nodesource.com jessie InRelease
Hit http://security.debian.org stretch/updates InRelease
Hit http://ftp.us.debian.org stretch InRelease
Hit http://ftp.us.debian.org jessie Release.gpg
Hit http://ftp.us.debian.org jessie-updates/contrib Sources
Hit http://mariadb.mirror.rafal.ca jessie/main Sources
Hit http://mariadb.mirror.rafal.ca jessie/main amd64 Packages
Hit http://mariadb.mirror.rafal.ca jessie/main i386 Packages
Get:1 http://ftp.us.debian.org jessie-updates/main amd64 Packages/DiffIndex [3,472 B]
Hit http://dl.hhvm.com jessie/main amd64 Packages
Hit http://security.debian.org jessie/updates/non-free Sources
Hit https://deb.nodesource.com jessie/main Sources
Hit https://deb.nodesource.com jessie/main amd64 Packages
Hit http://ftp.us.debian.org jessie-updates/contrib amd64 Packages
Get:2 https://deb.nodesource.com jessie/main Translation-en_US [162 B]
Get:3 https://deb.nodesource.com jessie/main Translation-en [162 B]
Get:4 http://ftp.us.debian.org jessie-updates/non-free amd64 Packages/DiffIndex [736 B]
Get:5 https://deb.nodesource.com jessie/main Translation-en_US [162 B]
Hit http://security.debian.org jessie/updates/non-free amd64 Packages
Get:6 https://deb.nodesource.com jessie/main Translation-en [162 B]
Hit http://packages.dotdeb.org jessie/all Sources
Get:7 https://deb.nodesource.com jessie/main Translation-en_US [162 B]
Hit http://ftp.us.debian.org jessie-updates/contrib Translation-en
Get:8 https://deb.nodesource.com jessie/main Translation-en [162 B]
Hit http://apt.postgresql.org jessie-pgdg/main amd64 Packages
Get:9 https://deb.nodesource.com jessie/main Translation-en_US [162 B]
Get:10 https://deb.nodesource.com jessie/main Translation-en [162 B]
Get:11 http://ftp.us.debian.org jessie-updates/main Translation-en/DiffIndex [1,720 B]
Hit http://packages.dotdeb.org jessie/all amd64 Packages
Get:12 https://deb.nodesource.com jessie/main Translation-en_US [162 B]
Ign https://deb.nodesource.com jessie/main Translation-en_US
Get:13 https://deb.nodesource.com jessie/main Translation-en [162 B]
Ign https://deb.nodesource.com jessie/main Translation-en
Hit http://security.debian.org jessie/updates/non-free Translation-en
Ign http://dl.hhvm.com jessie/main Translation-en_US
Get:14 http://ftp.us.debian.org jessie-updates/non-free Translation-en/DiffIndex [736 B]
Ign http://mariadb.mirror.rafal.ca jessie/main Translation-en_US
Hit http://security.debian.org jessie/updates/main Sources
Ign http://dl.hhvm.com jessie/main Translation-en
Hit http://ftp.us.debian.org jessie Release
Ign http://mariadb.mirror.rafal.ca jessie/main Translation-en
Hit http://security.debian.org jessie/updates/contrib Sources
Hit http://ftp.us.debian.org jessie-updates/main Sources
Hit http://security.debian.org jessie/updates/main amd64 Packages
Hit http://ftp.us.debian.org jessie-updates/non-free Sources
Hit http://security.debian.org stretch/updates/main Sources
Get:15 http://ftp.us.debian.org jessie-backports/main Sources/DiffIndex [27.8 kB]
Hit http://security.debian.org stretch/updates/contrib Sources
Ign http://apt.postgresql.org jessie-pgdg/main Translation-en_US
Hit http://security.debian.org stretch/updates/non-free Sources
Ign http://apt.postgresql.org jessie-pgdg/main Translation-en
Hit http://security.debian.org stretch/updates/main amd64 Packages
Get:16 http://ftp.us.debian.org jessie-backports/contrib Sources/DiffIndex [13.3 kB]
Hit http://security.debian.org stretch/updates/contrib amd64 Packages
Hit http://security.debian.org stretch/updates/non-free amd64 Packages
Hit http://security.debian.org stretch/updates/contrib Translation-en
Ign http://packages.dotdeb.org jessie/all Translation-en_US
Get:17 http://ftp.us.debian.org jessie-backports/non-free Sources/DiffIndex [6,760 B]
Hit http://security.debian.org stretch/updates/main Translation-en
Get:18 http://ftp.us.debian.org jessie-backports/main amd64 Packages/DiffIndex [27.8 kB]
Hit http://security.debian.org stretch/updates/non-free Translation-en
Ign http://packages.dotdeb.org jessie/all Translation-en
Hit http://security.debian.org jessie/updates/contrib amd64 Packages
Hit http://security.debian.org jessie/updates/contrib Translation-en
Get:19 http://ftp.us.debian.org jessie-backports/contrib amd64 Packages/DiffIndex [8,512 B]
Hit http://security.debian.org jessie/updates/main Translation-en
Get:20 http://ftp.us.debian.org jessie-backports/non-free amd64 Packages/DiffIndex [6,622 B]
Get:21 http://ftp.us.debian.org jessie-backports/contrib Translation-en/DiffIndex [3,532 B]
Get:22 http://ftp.us.debian.org jessie-backports/main Translation-en/DiffIndex [27.8 kB]
Get:23 http://ftp.us.debian.org jessie-backports/non-free Translation-en/DiffIndex [6,346 B]
Get:24 http://ftp.us.debian.org stretch/main Sources/DiffIndex [27.9 kB]
Get:25 http://ftp.us.debian.org stretch/non-free Sources/DiffIndex [27.8 kB]
Get:26 http://ftp.us.debian.org stretch/contrib Sources/DiffIndex [27.8 kB]
Get:27 http://ftp.us.debian.org stretch/main amd64 Packages/DiffIndex [27.9 kB]
Get:28 http://ftp.us.debian.org stretch/non-free amd64 Packages/DiffIndex [27.8 kB]
Get:29 http://ftp.us.debian.org stretch/contrib amd64 Packages/DiffIndex [27.8 kB]
Get:30 http://ftp.us.debian.org stretch/contrib Translation-en/DiffIndex [23.9 kB]
Get:31 http://ftp.us.debian.org stretch/main Translation-en/DiffIndex [27.9 kB]
Get:32 http://ftp.us.debian.org stretch/non-free Translation-en/DiffIndex [27.8 kB]
Hit http://ftp.us.debian.org jessie/main Sources
Hit http://ftp.us.debian.org jessie/non-free Sources
Hit http://ftp.us.debian.org jessie/contrib Sources
Hit http://ftp.us.debian.org jessie/main amd64 Packages
Hit http://ftp.us.debian.org jessie/non-free amd64 Packages
Hit http://ftp.us.debian.org jessie/contrib amd64 Packages
Hit http://ftp.us.debian.org jessie/contrib Translation-en
Hit http://ftp.us.debian.org jessie/main Translation-en
Hit http://ftp.us.debian.org jessie/non-free Translation-en
Fetched 382 kB in 7s (49.0 kB/s)
Reading package lists... Done

remove ip address

Hi, can you remove IP '46.45.109.193' from list about cybercrime. Network from this IP was fixed.

Expanded CIDR Ranges

Hi - Is there a version of the firehol list that contains all the cidr ranges already expanded, ie, every unique ip per line? If not, is there a recommended tool/script to do this in one batch command?

Thanks!

disable ipset list

First I wanted to say, fantastic feature. Thank you for all your work to aggregate so many freely available iplists under one easy to use feature!

I was wondering if there was any way to turn off an iplist's auto updates once its enabled? Something like "update-ipsets disable"? I couldn't find anything like that in the wiki, and I couldn't find any man page.

Why are there bitcoin nodes in these lists?

You have lists of bitcoin nodes in blocklist-ipsets.
Do you think that they should be blocked?
How do they relate to cybercrime? According to the description in README.md, just such are listed here.

.git repo metadata size

323M ./.git
360M .
The .git dir is 323 MB and the total size is 360 MB. Is this expected? If so, is there something I can do to keep the size down on the client side?

Question on the Atlas and Alienvault lists

It seems the Alienvault and Atlas lists are no longer available; however, this repository still has a copy of these lists.

Are you getting these lists by way of some private arrangements with the maintainers?

Beer Money

I know that this project is an aggregation of other people's intelligence, but I still want to sling you some beer money for your excellent work with this.

How would one go about doing that?

Blocking 8.8.8.8

Well,

Your lists started blocking 8.8.8.8
After a quick check-up, turns out you guys are blocking google DNS due to some hphosts entries.
Since the list maintainer does only domain based lists, I'ld say this is on you. (:

127.0.0.1 and 8.8.8.8?

8.8.8.8 found in
["cleantalk_updated_30d", "packetmail_emerging_ips", "hphosts_psh", "cleantalk_30d", "firehol_abusers_30d", "hphosts_fsa", "firehol_webserver", "cleantalk_updated_7d", "cleantalk_7d"]

127.0.0.1 found in
["nullsecure", "botscout_30d", "botscout_7d", "hphosts_ats", "hphosts_exp", "hphosts_mmt", "hphosts_psh", "jigsaw_malware", "hphosts_hjk", "threatcrowd", "hphosts_fsa", "ransomware_feed", "hphosts_hfs", "firehol_webserver", "hphosts_grm", "hphosts_pha", "hphosts_emd", "hphosts_wrz"]

seriously?

Bluetack lists are not free

iBlocklist.com free version of BlueTack.co.uk IPs

Actually the lists you included from bluetack are redistributed by iblocklist without permission. There are no free versions.

Great work on everything else though.

Blocking AWS

I noticed today that Firehol level 3 was blocking a large grouping of AWS ip addresses.

For example:
54.81.100.98-54.81.100.98
54.81.122.6-54.81.122.6
54.81.158.0-54.81.158.255
54.81.168.0-54.81.168.255
54.81.171.0-54.81.171.255

I am concerned that legitimate business may be impacted by blocking subsets of these ip addresses.

[dm_tor]: Error, converted file is empty.

Apologies for asking this in firehol_level1 comments - feel free to delete it from there..

When I run update-ipsets I'm having a problem with dm_tor. Initially it was showing the problem:

dm_tor| 35 fails so far, time increased from 30 to 750 mins
| LATER 370/750 mins passed, will fetch in 380 mins
| download is the same, but we need to re-process it
| converting with 'remove_comments'
| ERROR converted file is empty.

but it is now showing the error:

dm_tor| 37 fails so far, time increased from 30 to 810 mins
| 1912/810 mins passed, downloading...
| fetch: 'https://www.dan.me.uk/torlist/'
| HTTP/000 SSL Error
| ERROR failed - 38 consecutive failures so far.
| download manager reports failure

I hope this helps you to help me. Let me know if you need any further information.

history

Hi,

The commit history only goes up to September 25th, presumably because it is being restarted.
Is there a way to access a longer history, even for only some of the lists?

I ask because I'd like to cross reference with the scans at censys.io.

Github is blocked

For file firehol_level3.netset github is being blocked on our network (192.30.253.112). Had to set that rule to deny_inbound only. Was this on purpose? Whois for the above IP indeed belongs to github.

Cannot create ipsets in kernel, tried iprange and update-ipsets

Hello,

I use your excellent Firehol script for over 10 years already, it is very good, exceptional convenience.

Recently I began to find how I can block some unwanted connections.

Phil kindly pointed me to ipset and iprange.

I have installed the latest versions of your scripts from github on my Debian v8 system, upgraded all distro packages too before building Firehol.

Unfortunately I cannot add any IPs to kernel ipset. I tried iprange and update-ipsets.

Can you please point me to several examples of how to generate ipsets by iprange and update-ipsets?

I tried:

ipset destroy
update-ipsets enable iblocklist_org_microsoft
update-ipsets

ipset list - displays empty

Got following in the syslog:
May 8 21:05:35 atom update-ipsets.sh[18989]: INFO: iblocklist_org_microsoft: 9126545/727 mins passed, downloading...
May 8 21:05:37 atom update-ipsets.sh[18989]: INFO: iblocklist_org_microsoft: HTTP/200 OK
May 8 21:05:37 atom update-ipsets.sh[18989]: SAVED: iblocklist_org_microsoft: no need to load ipset in kernel

Then
ipset create iblocklist_org_microsoft hash:net
update-ipsets

ipset list - still displays empty

Please suggest, what am I doing wrong?

193.106.238.29

Hi.
Could you please provide a reason for listing IP: 193.106.238.29?
Thanks in advance.

DataPlane.org feeds

DataPlane.org is providing feeds. Perhaps you'd consider incorporating them into the project? I am the former managing director of the DRG and have spun up this new independent project, partially modeled on some of the past DRG work I had done.

Secret attackers???

Good morning!

I think my websites are the premier attack targets of the Internet because the attacking IP-s are not on any blacklist.

$ wc -l ../szerver4
803 ../szerver4
$ ls *.ipset | xargs -I %% grep -Fx -f %% ../szerver4 | sort | uniq | wc -l
370
$ ls *.netset | xargs -I %% grepcidr -f %% ../szerver4 | sort | uniq | wc -l
376

History of changes

I understand that the history is pruned with each update due to gitlabs request. (as told in #51). Is there a history of this repo anywhere? I am in need of historical entries...

mx.yandex.ru (213.180.204.89) listed

Accidentally 213.180.204.89 (mx.yandex.ru, MX for Yandex.mail service) listed, causing lots of troubles with sending mail to Yandex customers.

[safonov@m102 ~]$ dig mx yandex.ru

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.4 <<>> mx yandex.ru
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20735
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 6

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;yandex.ru.                     IN      MX

;; ANSWER SECTION:
yandex.ru.              205     IN      MX      10 mx.yandex.ru.

;; ADDITIONAL SECTION:
mx.yandex.ru.           1194    IN      A       213.180.204.89
mx.yandex.ru.           1194    IN      A       93.158.134.89
mx.yandex.ru.           1194    IN      A       87.250.250.89
mx.yandex.ru.           1194    IN      A       77.88.21.89
mx.yandex.ru.           1194    IN      A       213.180.193.89

;; Query time: 1 msec
;; SERVER: 192.168.210.222#53(192.168.210.222)
;; WHEN: Ср апр 26 14:34:03 +05 2017
;; MSG SIZE  rcvd: 137



wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/stopforumspam_7d.ipset | grep 213.180.204.89
213.180.204.89

There are no new commits in master branch

Hello!
I use your wonderful repository to get processed reputation lists. But recently the process of updating the repository (master branch) has stopped. Is it due to some technical problems?

Thanks!

firehole_level1 (dshield)

The script is unable to download the dshield list....

                            dshield| 2 fails so far, time decreased from 10 to 5 mins
                                   | 11/5 mins passed, downloading...
                                   | fetch: 'http://feeds.dshield.org/block.txt'
                                   | HTTP/301 Error 60 returned by curl
                                   |  ERROR  failed - 3 consecutive failures so far.
                                   | download manager reports failure
                     firehol_level1| examining source ipsets:
                                   |  - bambenek_c2
                                   |  WARNING  will be generated without 'dshield' - enable 'dshield' it to be included the next time
                                   |  - feodo
                                   |  - fullbogons
                                   |  - palevo
                                   |  - spamhaus_drop
                                   |  - spamhaus_edrop
                                   |  + sslbl
                                   |  - zeus_badips
                                   |  + ransomware_rw
                                   | merging files...
                                   | source file has been updated
                                   | converting with 'cat'
                                   |  SAME  processed set is the same with the previous one.

Developer Tools - Network tab shows the following response headers:

Date		"Fri, 31 Mar 2017 15:19:38 GMT"			[Learn More]
Server		"Apache"					[Learn More]
Location	"https://secure.dshield.org/indexd.html"	[Learn More]
Content-Length	"246"						[Learn More]
Content-Type	"text/html; charset=iso-8859-1"

Setting up a blocklist

I am thinking about setting up a new blocklist.
My WordPress WAF bans every attacker on the first try.
I've just tested all my 803 IP-s on Wordpress.com's Protect API, 131 are known, but I have to mention that they work with a one hour TTL.

Would you include it here?

stopforumspam: do not block IPs with low number of incidents

Hello,

does stopforumspam provide any way to get only IPs with lets say more than 2-3 incidents in last 90 days? Or other way exclude low risk IPs from the DB? I know i can reduce risks by using 1day or 7 day blocklist, but banning based on number of incidents in time period would be much more accurate for me.

I had to disable whole SFS blocklist because this was customer of mine who was blocked: https://www.stopforumspam.com/evidence/157095723, the IP looks quite innocent in my oppinion and it is probably shared IP and in higher risk location, but it blocked the customer and i do not want this to happen again.

127.0.0.1 listed

Hey in this commit : b361dc48ee4db5369c92cd616c8d30ade11c7416 we seem to have blocked 127.0.0.1 .

Can you kindly remove 127.0.0.1 from the list.

Request: firehol_webclient IP list

@ktsaou First I must say the FireHOL IP Lists are a world class gem, simply fantastic work !

I would like to suggest a new "firehol_webclient" IP list, sharing some of the firehol_webserver blocklists, but more designed for outgoing, forwarded traffic from web browsers.

You have stated here:

Generally speaking, firehol_webserver should be applied in a stateful way, at the input (i.e. inbound NEW connections) of a web server. It should not be applied to outbound NEW connections of the web server.

A new firehol_webclient list could be applied in the OUTPUT and FORWARD chains protecting web clients, and no harm applied to the INPUT chain as well.

Preventing phishing attacks would be the primary objective, here is a first-cut at a "firehol_webclient" IP list:

hphosts_psh
cleanmx_phishing
atlas_phishing_30d
atlas_fastflux_30d
blueliv_crimeserver_last_2d
maxmind_proxy_fraud
hphosts_emd
hphosts_exp
hphosts_hjk

I understand that a custom list could be performed with update-ipsets and a local unfiltered DNS resolver, but official firehol_webclient support would be a great addition.

Android mobiles

Hello!

I want to use firehol with pfsense at home. When I add the list to my ipv4 tab with deny both, my android devices are not able to use the wifi anymore.

any ideas here?
thanks

5 new IP feeds to consider

I suggest checking out the following 5 feeds:

Shalla

Look likely to be the only (free for private use) provider of an up to date porn list:
http://www.shallalist.de/index.html
They provide a lot more than porn-filtering btw. Looks good and well maintained. They do offer a commercial license.

OpenPhish:

This is their dedicated community feed:
https://openphish.com/feed.txt

Cedia.org

Their selection of feeds:
https://mirror.cedia.org.ec/malwaredomains/
Seems to be updated daily:
https://mirror.cedia.org.ec/malwaredomains/justdomains

Spam404

They are integrated in uBlock and AdBlockPlus:
https://github.com/Dawsey21/Lists/blob/master/main-blacklist.txt

StevenBlack

This is a well maintained and well-estanlished hosts-list to block out all kinds of stuff. It would nicely complement the current firehol_webclient lists.

"Extending and consolidating hosts files from a variety of sources like adaway.org, mvps.org, malwaredomains.com, someonewhocares.org, yoyo.org, and potentially others. You can optionally invoke extensions to block additional sites by category."

https://github.com/StevenBlack/hosts/blob/master/hosts

Location of Output Files

In the default setup the aggregated result file is located here:
/usr/local/etc/firehol/ipsets/firehol_level1.netset

Is there a simple configuration location that I can set to have the output files generated in a different folder?
For example: /usr/share/

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.