aboutsummaryrefslogtreecommitdiff
path: root/net/banip/files/banip.init
Commit message (Collapse)AuthorAge
* banip: update 0.9.5-2Dirk Brenken2024-04-21
| | | | | | | | * fixed possible Set search race condition (initiated from LuCI frontend) * fixed the "no result" Set search problem in LuCI * removed abandoned feeds: spamhaus edrop (was merged with spamhaus drop) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.3-5Dirk Brenken2024-01-26
| | | | | | * fix the nft Set survey function Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.3-3Dirk Brenken2023-12-28
| | | | | | * more init fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.3-2Dirk Brenken2023-12-28
| | | | | | | | | | * rework the device/interface auto-detection (only layer-3 network devices will be detetcted correctly), disable the auto-detection e.g. for special tunnel interfaces * supports now full gawk (preferred, if installed) and busybox awk * raise the default boot timeout to 20 seconds (if 'ban_triggerdelay' is not set) * various small fixes and improvements * readme update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.2-3Dirk Brenken2023-11-25
| | | | | | | * fix the urlhaus regex * fix a possible init race condition Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.9.1-1Dirk Brenken2023-10-03
| | | | | | | | | * drop packets silently on input and forwardwan chains or actively reject the traffic, set 'ban_blocktype' accordingly * optimized banIP boot/reload handling * removed pppoe quirk in device detection * small fixes and optimizations Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-5Dirk Brenken2023-05-04
| | | | | | | | * fix remaining small issues * standardize log wording * polished up for branch 23.x Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.3-2Dirk Brenken2023-04-12
| | | | | | * more init fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.3-1Dirk Brenken2023-04-06
| | | | | | | | | | * add the new init command 'lookup', to lookup the IPs of domain names in the local lists and update them * significant acceleration of the domain lookup function * multiple small fixes and improvements * readme update * luci update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-6Dirk Brenken2023-03-30
| | | | | | * restored some accidently removed init stuff in last commit Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-5Dirk Brenken2023-03-30
| | | | | | | | | * fixed missing version number when installed as separate package (not in build) * fixed cornercase init and mailing issues * sorted Country list by country names ascending * fixed some shellcheck findings Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-3Dirk Brenken2023-03-22
| | | | | | | | | | | * raise max. timeouts from 10 to 30 seconds to stabilize the autodetection on slow hardware * made interface trigger action configurable, set 'ban_triggeraction' accordingly (default: 'start') * made E-Mail notifications configurable to receive status E-Mais with every banIP run, set 'ban_mailnotification' accordingly (default: disabled) * small fixes & optimizations * readme update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.2-2Dirk Brenken2023-03-10
| | | | | | | | | | | | * fix the auto-detection for pppoe and 6in4 tunnel interfaces * add the new 'ban_nftpolicy' option to expose the nft set policy, values: memory (default), performance * add the new 'ban_nftlogevel' option to expose the nft syslog level, values: emerg, alert, crit, err, warn (default), notice, info, debug, audit * status optimizations * logging optimizations * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.2-1Dirk Brenken2023-03-08
| | | | | | | | | * major performance improvements: clean-up/optimize all nft calls * add a new "ban_reportelements" option, to disable the (time consuming) Set element count in the report (enabled by default) * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.1-3Dirk Brenken2023-03-06
| | | | | | | | | * finalized the LuCI frontend preparation (this is the minmal version to use the forthcoming LuCI frontend) * added a Set survey, to list all elements of a certain set * changed the default logterm for asterisk * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.0-2Dirk Brenken2023-02-20
| | | | | | | * fix a potential race condition during initial startup (after flash) which leads to a "disabled" service Signed-off-by: Dirk Brenken <dev@brenken.org Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.0 (nft rewrite)Dirk Brenken2023-02-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - complete rewrite of banIP to support nftables - all sets are handled in a separate nft table/namespace 'banIP' - for incoming blocking it uses the inet input hook, for outgoing blocking it uses the inet forward hook - full IPv4 and IPv6 support - supports nft atomic set loading - supports blocking by ASN numbers and by iso country codes - 42 preconfigured external feeds are available, plus local allow- and blocklist - supports local allow- and blocklist (IPv4, IPv6, CIDR notation or domain names) - auto-add the uplink subnet to the local allowlist - provides a small background log monitor to ban unsuccessful login attempts in real-time - the logterms for the log monitor service can be freely defined via regex - auto-add unsuccessful LuCI, nginx, Asterisk or ssh login attempts to the local blocklist - fast feed processing as they are handled in parallel as background jobs - per feed it can be defined whether the input chain or the forward chain should be blocked (default: both chains) - automatic blocklist backup & restore, the backups will be used in case of download errors or during startup - automatically selects one of the following download utilities with ssl support: aria2c, curl, uclient-fetch or wget - supports a 'allowlist only' mode, this option restricts internet access from/to a small number of secure websites/IPs - provides comprehensive runtime information - provides a detailed set report - provides a set search engine for certain IPs - feed parsing by fast & flexible regex rulesets - minimal status & error logging to syslog, enable debug logging to receive more output - procd based init system support (start/stop/restart/reload/status/report/search) - procd network interface trigger support - ability to add new banIP feeds on your own - add a readme with all available options/feeds to customize your installation to your needs - a new LuCI frontend will be available in due course Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.7.10Dirk Brenken2021-08-29
| | | | | | | | * switch to unencrypted http downloads for ipdeny.com due to persistant certificate issues * compact json generator code (tested with report files > 2MB) * various code cleanups and optimizations Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.2Dirk Brenken2021-02-17
| | | | | | | | | | | * add scanning for suspicious nginx events * add a log counter to track the number of the failed requests or login repetitions of the same ip in the log before banning, defaults are: ssh (3), luci (3), nginx (5) * optimize the background service handling * add 'greensnow' as a new source * update readme and LuCI frontend regarding the new log count options Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.7.0Dirk Brenken2021-02-04
| | | | | | | | | | | | | | | | | | | * major rewrite * add support for multiple chains * add mac whitelisting * add support for multiple ssh daemons in parallel * add an ipset report engine * add mail notifications * add suspend/resume functions * add a cron wrapper to set an ipset related auto-timer for automatic blocklist updates * add a list wrapper to add/remove blocklist sources * add 19.x and Turris OS 5.x compatibility code * sources stored in an external compressed json file (/etc/banip/banip.sources.gz) * change Country/ASN download sources (faster/more reliable) * fix DHCPv6/icmpv6 issues Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: adapt openwrt rc.common changesDirk Brenken2020-11-03
| | | | | | | | | * since openwrt master has merged the depending P/R, the old extra_help/extra_commands syntax is no longer working, see #13798 for reference * removed logd dependency, see #13820 for reference Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.10Dirk Brenken2019-11-15
| | | | | | | * add missing logd dependency * check if logd is enabled during runtime * some more init tweaks Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.9Dirk Brenken2019-11-10
| | | | | * fix 'enabled' service check Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.6Dirk Brenken2019-11-06
| | | | | | | * more startup tweaks * re-use f_log function in helper scripts * small fixes / polish up for forthcoming 19.07 release Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.5Dirk Brenken2019-11-03
| | | | | | | | | | * fix race condition in download utility detection during boot * fix multiple possible bugs in ipset creation * prevent parallel service starts * refine service trigger handling * add ssh daemon auto detection * print to stdout if 'logger' is not available Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.0Dirk Brenken2019-10-04
| | | | | | | | | | | | | | | | * new 'ca-bundle' dependency as all https connections are now validated by default * automatically select the download utility: 'aria2', 'curl', 'uclient-fetch' with libustream-* or wget are supported * track & ban failed LuCI login attempts as well * add a small log/banIP background monitor to block SSH/LuCI brute force attacks in realtime (disabled by default) * add a config version check (please update your default config!) * made the automatic wan detection more stable * fix the IPv6 logfile parser * fix the service status message * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.2.0Dirk Brenken2019-09-09
| | | | | | | | | | | | | | | | * remove 'http-only' mode, all sources are now fetched from https sites * the backup mode is now mandatory ('/tmp' is the default backup directory), always create and re-use backups if available. To force a re-download take the 'reload' action. * support 'sshd' in addition to 'dropbear' for logfile parsing to detect break-in events * always update the black-/whitelist with logfile parsing results in 'refresh' mode (no new downloads) * rework the return code handling * tweak procd trigger * various small fixes * (s)hellsheck cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.1.5Dirk Brenken2019-08-06
| | | | | | | | | | | | | * add extra options to control auto-addons to blacklist & whitelist ('ban_autoblacklist' & 'ban_autowhitelist', both enabled by default). If disabled auto-addons are only stored temporary in the black/whitelist ipset but not in the list itself, fixes #9631 * remove old, no longer needed procd workaround * remove 'zeus' source from default config (discontinued) Signed-off-by: Dirk Brenken <dev@brenken.org> Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.1.4Dirk Brenken2019-06-18
| | | | | | | | | * refine 'refresh' mode, add normal processing/download as fallback * remove needless reload trigger * fix various ipset warnings * fix timer in 'refresh' mode * adapt ssbl regex to new source list format Signed-off-by: Dirk Brenken <dev@brenken.org>
* banIP: release 0.1.0Dirk Brenken2019-01-05
| | | | | | | | | | | | * add automatic blocklist backup & restore, they will be used in case of download errors or during startup in backup mode * add a 'backup mode' to re-use blocklist backups during startup, get fresh lists via reload or restart action * procd interface trigger now supports multiple WAN interfaces * change URL for abuse.ch/feodo list source in default config * small fixes * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.0.6Dirk Brenken2018-11-17
| | | | | | | | | | * support multiple WAN interfaces in iptables rules, set 'ban_iface' option accordingly (as space separated list) or use the LuCI frontend * add new "refresh" mode while triggered by fw changes (no download) * add required ip dependency * fix wrong 'settype' definition for firehol1 in config Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: new package to block incoming & outgoing ip addressesDirk Brenken2018-11-10
a new script based package called "banIP" to block incoming & outgoing ip adresses/subnets via ipset. Features: * a shell script which uses ipset and iptables to ban a large number of IP addresses published in various IP blacklists (bogon, firehol etc.) * support blocking by ASN numbers * support blocking by iso country codes * support local white & blacklist (IPv4, IPv6 & CIDR notation) * auto-add unsuccessful ssh login attempts to local blacklist * auto-add the uplink subnet to local whitelist * per source configuration of SRC (incoming) and DST (outgoing) * supports IPv4 & IPv6 Strong LuCI support: * easy interface to track & change all aspects of your ipset configuration on the fly * integrated IPSet-Lookup * integrated RIPE-Lookup * Log-Viewer & online configuration of white- & blacklist LuCI-Screenshots will follow in the second post. Forum discussion: https://forum.openwrt.org/t/banip-new-project-needs-testers-feedback/16985 Signed-off-by: Dirk Brenken <dev@brenken.org>
Powered by cgit, Themed by Ted Yin.