add content
This commit is contained in:
Pawel Krawczyk
parent
18dab183d2
commit
2ad1e01924
110
README.md
110
README.md
@ -1,4 +1,112 @@
|
||||
blacklist-scripts
|
||||
=================
|
||||
This is a collection of shell scripts that are intended to block Linux systems and OpenWRT routers from known sources of malicious traffic. These scripts use `iptables` with highly efficient `ipset` module to check incoming traffic against blacklists populated from publicly available sources.
|
||||
|
||||
Various IP blacklisting scripts for Linux and OpenWRT
|
||||
## Block lists
|
||||
|
||||
* [Emerging Threats](http://rules.emergingthreats.net/fwrules/) - list of other known threats (botnet C&C, compromised servers etc) compiled from various sources, including [Spamhaus DROP](http://www.spamhaus.org/drop/), [Shadoserver](https://www.shadowserver.org/wiki/) and [DShield Top Attackers](http://www.dshield.org/top10.html)
|
||||
* [www.blocklist.de](https://www.blocklist.de/en/index.html) - list of known password bruteforcers supplied by a network of [fail2ban](http://www.fail2ban.org/wiki/index.php/Main_Page) users
|
||||
* [iBlocklist](https://www.iblocklist.com/lists.php) - various free and subscription based lists
|
||||
|
||||
## firewall.user
|
||||
This scripts is indended for OpenWRT routers. It will use the following blocklists by default:
|
||||
|
||||
* www.blocklist.de
|
||||
* Emerging Threats
|
||||
|
||||
Requirements:
|
||||
|
||||
* `opkg install ipset curl`
|
||||
|
||||
Installation:
|
||||
|
||||
sh firewall.user
|
||||
cp firewall.user /etc/firewall.user
|
||||
echo "01 01 * * * sh /etc/firewall.user" >>/etc/crontabs/root
|
||||
|
||||
Results:
|
||||
|
||||
# iptables -vnL
|
||||
Chain blocklists (2 references)
|
||||
pkts bytes target prot opt in out source destination
|
||||
0 0 LOG all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set emerging-Block-IPs.txt src,dst limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `BLOCK emerging-Block-IPs.txt '
|
||||
0 0 DROP all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set emerging-Block-IPs.txt src,dst
|
||||
0 0 LOG all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set fullbogons-ipv4.txt src,dst limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `BLOCK fullbogons-ipv4.txt '
|
||||
0 0 DROP all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set fullbogons-ipv4.txt src,dst
|
||||
6 783 LOG all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set export-ips_all.txt src,dst limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `BLOCK export-ips_all.txt '
|
||||
6 783 DROP all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set export-ips_all.txt src,dst
|
||||
|
||||
Chain forward (1 references)
|
||||
pkts bytes target prot opt in out source destination
|
||||
14994 1753K blocklists all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED
|
||||
...
|
||||
|
||||
Chain input (1 references)
|
||||
pkts bytes target prot opt in out source destination
|
||||
250 13802 blocklists all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED
|
||||
...
|
||||
|
||||
# ipset list | wc -l
|
||||
21553
|
||||
|
||||
## blacklist.sh
|
||||
|
||||
This script is intended for Linux servers. It does not load Bogons blocklist which can cause serious problems in VPS environments. Blacklists used:
|
||||
|
||||
* www.blocklist.de
|
||||
* Emerging Threats
|
||||
|
||||
Requirements:
|
||||
|
||||
* On Debian, Ubuntu and other `apt` systems: `apt-get install ipset curl`
|
||||
* On RedHat, Fedora, CentOS and other RPM systems: `yum install ipset curl`
|
||||
|
||||
Installation:
|
||||
|
||||
sh blacklist.sh
|
||||
cp blacklist.sh /etc/cron.daily/blacklist
|
||||
|
||||
Results:
|
||||
|
||||
# iptables -vnL
|
||||
Chain INPUT (policy ACCEPT 40M packets, 159G bytes)
|
||||
pkts bytes target prot opt in out source destination
|
||||
5622K 350M blacklist all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW
|
||||
|
||||
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
|
||||
pkts bytes target prot opt in out source destination
|
||||
|
||||
Chain OUTPUT (policy ACCEPT 39M packets, 166G bytes)
|
||||
pkts bytes target prot opt in out source destination
|
||||
|
||||
Chain blacklist (1 references)
|
||||
pkts bytes target prot opt in out source destination
|
||||
11 488 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 match-set blacklist src limit: avg 1/min burst 5 LOG flags 0 level 4 prefix `BLACKLIST '
|
||||
11 488 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 match-set blacklist src
|
||||
|
||||
# ipset list | wc -l
|
||||
22590
|
||||
|
||||
# ipset list | head
|
||||
Name: blacklist
|
||||
Type: hash:net
|
||||
Header: family inet hashsize 8192 maxelem 65536
|
||||
Size in memory: 416688
|
||||
References: 2
|
||||
Members:
|
||||
183.141.72.28
|
||||
201.210.28.205
|
||||
222.186.56.11
|
||||
178.137.16.203
|
||||
|
||||
# dmesg|tail
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=61.174.51.198 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=141.212.121.232 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=232 ID=54321 PROTO=TCP SPT=51441 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=58.241.61.162 DST=192.168.100.8 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=17539 PROTO=TCP SPT=4127 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.109.116 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.103.78 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.109.115 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.109.208 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=61.174.51.200 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=198.71.58.200 DST=192.168.100.8 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=52934 DF PROTO=TCP SPT=59939 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0
|
||||
BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=198.71.58.200 DST=192.168.100.8 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=52935 DF PROTO=TCP SPT=59939 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0
|
||||
|
||||
Loading…
Reference in New Issue
Block a user