PKG_NAME:=banip

PKG_VERSION:=0.8.1

PKG_LICENSE:=GPL-3.0-or-later

PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>

$(INSTALL_CONF) ./files/banip.tpl $(1)/etc/banip

$(INSTALL_CONF) ./files/banip.allowlist $(1)/etc/banip

$(INSTALL_CONF) ./files/banip.blocklist $(1)/etc/banip

$(INSTALL_CONF) ./files/banip.feeds $(1)/etc/banip

endef

$(eval $(call BuildPackage,banip))

## Main Features

* banIP supports the following fully pre-configured domain blocklist feeds (free for private usage, for commercial use please check their individual licenses).

| Feed | Focus | WAN-INP | WAN-FWD | LAN-FWD | Information |

| :------------------ | :----------------------------- | :-----: | :-----: | :-----: | :----------------------------------------------------------- |

| iblockspy | Malicious spyware IPs | x | x | x | [Link](https://www.iblocklist.com) |

| myip | real-time IP blocklist | x | x | | [Link](https://myip.ms) |

| nixspam | iX spam protection | x | x | | [Link](http://www.nixspam.org) |

| oisdnsfw | OISD-nsfw IPs | | | x | [Link](https://github.com/dibdot/banIP-IP-blocklists) |

| oisdsmall | OISD-small IPs | | | x | [Link](https://github.com/dibdot/banIP-IP-blocklists) |

| proxy | open proxies | x | | | [Link](https://iplists.firehol.org/?ipset=proxylists) |

* provides a small background log monitor to ban unsuccessful login attempts in real-time

* auto-add unsuccessful LuCI, nginx, Asterisk or ssh login attempts to the local blocklist

* fast feed processing as they are handled in parallel as background jobs

* automatic blocklist backup & restore, the backups will be used in case of download errors or during startup

* automatically selects one of the following download utilities with ssl support: aria2c, curl, uclient-fetch or wget

* provides comprehensive runtime information

* provides a detailed set report

* provides a set search engine for certain IPs

**Please note the following:**

* Devices with less than 256Mb of RAM are **_not_** supported

## Installation & Usage

* update your local opkg repository (_opkg update_)

* install banIP (_opkg install banip_) - the banIP service is disabled by default

* start the service with '/etc/init.d/banip start' and check check everything is working by running '/etc/init.d/banip status'

## banIP CLI interface

| ban_mailtopic | option | banIP notification | topic for banIP related notification E-Mails |

| ban_mailprofile | option | ban_notify | mail profile used in 'msmtp' for banIP related notification E-Mails |

| ban_resolver | option | - | external resolver used for DNS lookups |

## Examples

**banIP report information**

~# /etc/init.d/banip status

::: banIP runtime information

+ status : active

+ element_count : 206644

+ active_feeds : allowlistvMAC, allowlistv4, allowlistv6, torv4, torv6, countryv6, countryv4, dohv4, dohv6, firehol1v4, deblv4, deblv6,

adguardv6, adguardv4, adguardtrackersv6, adguardtrackersv4, adawayv6, adawayv4, oisdsmallv6, oisdsmallv4, stevenblack

+ active_devices : eth2

+ active_interfaces : wan, wan6

+ active_subnets : 91.61.199.218/24, 2a02:910c:0:80:e542:4b0c:846d:1d33/128

+ run_flags : proto (4/6): ✔/✔, log (wan-inp/wan-fwd/lan-fwd): ✔/✔/✔, deduplicate: ✔, split: ✘, allowed only: ✘

+ last_run : action: restart, duration: 1m 6s, date: 2023-02-25 08:55:55

+ system_info : cores: 2, memory: 1826, device: Turris Omnia, OpenWrt SNAPSHOT r22125-52ddb38469

```

Finally add a valid E-Mail receiver address.

A valid JSON source object contains the following required information, e.g.:

```

[...]

},

[...]

```

## Support

Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-support-thread/16985) or contact me by mail <dev@brenken.org>

## Removal

* stop all banIP related services with _/etc/init.d/banip stop_

Have fun!

Dirk

ban_basedir="/tmp"

ban_backupdir="${ban_basedir}/banIP-backup"

ban_reportdir="${ban_basedir}/banIP-report"

ban_pidfile="/var/run/banip.pid"

ban_lock="/var/run/banip.lock"

ban_blocklist="/etc/banip/banip.blocklist"

done

fi

json_close_array

json_add_string "run_flags" "protocol (4/6): $(f_char ${ban_protov4})/$(f_char ${ban_protov6}), log (wan-inp/wan-fwd/lan-fwd): $(f_char ${ban_loginput})/$(f_char ${ban_logforwardwan})/$(f_char ${ban_logforwardlan}), deduplicate: $(f_char ${ban_deduplicate}), split: $(f_char ${split}), allowed only: $(f_char ${ban_allowlistonly})"

json_add_string "last_run" "${runtime:-"-"}"

json_add_string "system_info" "cores: ${ban_cores}, memory: ${ban_memory}, device: ${ban_sysver}"

f_log "err" "system libraries not found"

fi

[ ! -d "/etc/banip" ] && f_log "err" "banIP config directory not found, please re-install the package"

[ ! -r "/etc/config/banip" ] && f_log "err" "banIP config not found, please re-install the package"

[ "$(uci_get banip global ban_enabled)" = "0" ] && f_log "err" "banIP is currently disabled, please set the config option 'ban_enabled' to '1' to use this service"

fi

ban_feed=""

else

json_init

f_log "err" "banIP feed file can't be loaded"

fi

[ "${ban_deduplicate}" = "1" ] && printf "\n" >"${ban_tmpfile}.deduplicate"

"descurl": "https://www.nixspam.net",

"flag": "gz"

},

"oisdnsfw": {

"url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdnsfw-ipv4.txt",

"url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdnsfw-ipv6.txt",