aboutsummaryrefslogtreecommitdiff
path: root/net/banip/files
Commit message (Collapse)AuthorAge
...
* banip: update nginx matchingOskari Rauta2021-12-03
| | | | | | | | | | | | | | | Currently banip matches nginx log entries starting with nginx[number]:... I am running a containerized nginx with alpine as base, which ends up adding log entries without [number] part.. like this: nginx:... This patch updates regex for nginx log entry search to include both versions. Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
* banip: update 0.7.10-3Richard Gering2021-09-11
| | | | | | * Updated firehol ipset URLs Signed-off-by: Richard Gering <rg4github@dutchies.us>
* banip: update 0.7.10-2Dirk Brenken2021-09-07
| | | | | | | * optimize dns resolve function * cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.7.10Dirk Brenken2021-08-29
| | | | | | | | * switch to unencrypted http downloads for ipdeny.com due to persistant certificate issues * compact json generator code (tested with report files > 2MB) * various code cleanups and optimizations Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: refine/fix nginx search patternDirk Brenken2021-06-17
| | | | | * fix issue with nginx search pattern reported in forum support thread Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.7.9Dirk Brenken2021-06-13
| | | | | | | * add switch 'ban_fetchinsecure' to allow insecure downloads without certificate check (disabled by default) * better explain 'ban_fetchparm' in readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.8Dirk Brenken2021-05-04
| | | | | | | * fix pid file processing of the background monitor plus child processes (bug reported in the forum) * made the enabled/disabled switch of the background monitor functional Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: fix housekeepingDirk Brenken2021-04-23
| | | | | | * fix whitelist housekeeping if you switch between normal- and 'whitelist only' mode Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.7Dirk Brenken2021-04-21
| | | | | | | * add a "whitelist only" mode, this option allows to restrict Internet access from/to a small number of secure websites/IPs, and block access from/to the rest of the Internet. Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: bugfix 0.7.6-2Dirk Brenken2021-04-03
| | | | | * fix housekeeping of external list sources Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.6Dirk Brenken2021-03-28
| | | | | | | | | * rework the central iptables function to significantly reduce the code complexity and the overall number of iptables calls * check early and only once in the chain for ctstate NEW and return otherwise (thanks @ldir-EDB0) * made the whitelist ordering within the chain more flexible Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.5-4Dirk Brenken2021-03-26
| | | | | | | | * fix another IPv4/IPv6 related iptables chain creation problem * fix counter during ipset creation * fix regex for debug counters * fix ipset housekeeping for local sources Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.7.5-3Dirk Brenken2021-03-19
| | | | | * fix iptables/chain creation in setups without IPv6 support Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.5-2Dirk Brenken2021-03-15
| | | | | | | | | * refine the new dns resolving process * add a caching mechanism for the resolved IPs, the detached name lookup takes place only during 'restart' or 'reload' action, 'start' and 'refresh' actions are using an auto-generated backup instead. * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: bump to 0.7.5Dirk Brenken2021-03-14
| | | | | | | * black- and whitelist now supporting domain names as well - the corresponding IPs (IPv4 & IPv6) will be resolved in a detached background process and added to the IPsets Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.3Dirk Brenken2021-02-20
| | | | | | | | | * fix search string/pipe preparation for the background service * fix IPSet maxelem limitation, made it more flexible * fix potential error during resume action * add Cisco Talos IP blacklist * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.2Dirk Brenken2021-02-17
| | | | | | | | | | | * add scanning for suspicious nginx events * add a log counter to track the number of the failed requests or login repetitions of the same ip in the log before banning, defaults are: ssh (3), luci (3), nginx (5) * optimize the background service handling * add 'greensnow' as a new source * update readme and LuCI frontend regarding the new log count options Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: bugfixDirk Brenken2021-02-12
| | | | | * fix a stale pid file during package update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.7.1Dirk Brenken2021-02-07
| | | | | | | * add 'ban_extrasources' to handle banIP-unrelated sets for reporting and queries * add set timeouts for local sources (maclist, whitelist, blacklist) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.7.0Dirk Brenken2021-02-04
| | | | | | | | | | | | | | | | | | | * major rewrite * add support for multiple chains * add mac whitelisting * add support for multiple ssh daemons in parallel * add an ipset report engine * add mail notifications * add suspend/resume functions * add a cron wrapper to set an ipset related auto-timer for automatic blocklist updates * add a list wrapper to add/remove blocklist sources * add 19.x and Turris OS 5.x compatibility code * sources stored in an external compressed json file (/etc/banip/banip.sources.gz) * change Country/ASN download sources (faster/more reliable) * fix DHCPv6/icmpv6 issues Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: DHCPv6 bugfixDirk Brenken2020-12-30
| | | | | * ignore local DHCPv6 related and local icmpv6 traffic in banIP chain Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: removed logd check since logd dep has been droppedJavier Marcet2020-11-10
| | | | Signed-off-by: Javier Marcet <javier@marcet.info>
* banip: adapt openwrt rc.common changesDirk Brenken2020-11-03
| | | | | | | | | * since openwrt master has merged the depending P/R, the old extra_help/extra_commands syntax is no longer working, see #13798 for reference * removed logd dependency, see #13820 for reference Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: Added packet logging feature. Resolved shellcheck warnings.Richard Gering2020-10-24
| | | | Signed-off-by: Richard Gering <rg4github@dutchies.us>
* banip: update 0.3.11Dirk Brenken2019-11-30
| | | | | | | * fix ssh daemon autodetection * fix 'sshd' logfile parsing Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.10Dirk Brenken2019-11-15
| | | | | | | * add missing logd dependency * check if logd is enabled during runtime * some more init tweaks Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.9Dirk Brenken2019-11-10
| | | | | * fix 'enabled' service check Signed-off-by: Dirk Brenken <dev@brenken.org>
* banIP: update 0.3.8Dirk Brenken2019-11-09
| | | | | | | * limit firewall hotplug trigger to certain wan 'INTERFACE' as well, to prevent possible race conditions during boot Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.7Dirk Brenken2019-11-08
| | | | | | | * fix a logical glitch in the hotplug event handler * properly handle fatal iptables errors - even in subshells Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.6Dirk Brenken2019-11-06
| | | | | | | * more startup tweaks * re-use f_log function in helper scripts * small fixes / polish up for forthcoming 19.07 release Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.5Dirk Brenken2019-11-03
| | | | | | | | | | * fix race condition in download utility detection during boot * fix multiple possible bugs in ipset creation * prevent parallel service starts * refine service trigger handling * add ssh daemon auto detection * print to stdout if 'logger' is not available Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.1Dirk Brenken2019-10-09
| | | | | | | | | * the WAN auto detection now supports multiple interfaces, too * no longer filter out possible LAN devices * add a new DoH (DNS over HTTPS) blocklist source with public DoH DNS server addresses, to effectively block client side DoH communication, e.g. via Firefox or Chrome Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.0Dirk Brenken2019-10-04
| | | | | | | | | | | | | | | | * new 'ca-bundle' dependency as all https connections are now validated by default * automatically select the download utility: 'aria2', 'curl', 'uclient-fetch' with libustream-* or wget are supported * track & ban failed LuCI login attempts as well * add a small log/banIP background monitor to block SSH/LuCI brute force attacks in realtime (disabled by default) * add a config version check (please update your default config!) * made the automatic wan detection more stable * fix the IPv6 logfile parser * fix the service status message * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.2.1Dirk Brenken2019-09-10
| | | | | * fix for #9954 Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.2.0Dirk Brenken2019-09-09
| | | | | | | | | | | | | | | | * remove 'http-only' mode, all sources are now fetched from https sites * the backup mode is now mandatory ('/tmp' is the default backup directory), always create and re-use backups if available. To force a re-download take the 'reload' action. * support 'sshd' in addition to 'dropbear' for logfile parsing to detect break-in events * always update the black-/whitelist with logfile parsing results in 'refresh' mode (no new downloads) * rework the return code handling * tweak procd trigger * various small fixes * (s)hellsheck cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.1.5Dirk Brenken2019-08-06
| | | | | | | | | | | | | * add extra options to control auto-addons to blacklist & whitelist ('ban_autoblacklist' & 'ban_autowhitelist', both enabled by default). If disabled auto-addons are only stored temporary in the black/whitelist ipset but not in the list itself, fixes #9631 * remove old, no longer needed procd workaround * remove 'zeus' source from default config (discontinued) Signed-off-by: Dirk Brenken <dev@brenken.org> Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.1.4Dirk Brenken2019-06-18
| | | | | | | | | * refine 'refresh' mode, add normal processing/download as fallback * remove needless reload trigger * fix various ipset warnings * fix timer in 'refresh' mode * adapt ssbl regex to new source list format Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.1.3Dirk Brenken2019-05-30
| | | | | | | | * change iptables whitelist target from 'ACCEPT' to 'RETURN' to stop traversing the banIP chain and resume at the next chain * cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.1.2Dirk Brenken2019-05-27
| | | | | | * add more IPv4 & IPv6 consistency checks * various cleanups Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.1.1Dirk Brenken2019-05-16
| | | | | | | | * remove needless sort step to reduce system load * change maxqueue default in backend and LuCI frontend to '4' to reduce (default) system load * cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banIP: release 0.1.0Dirk Brenken2019-01-05
| | | | | | | | | | | | * add automatic blocklist backup & restore, they will be used in case of download errors or during startup in backup mode * add a 'backup mode' to re-use blocklist backups during startup, get fresh lists via reload or restart action * procd interface trigger now supports multiple WAN interfaces * change URL for abuse.ch/feodo list source in default config * small fixes * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.0.7Dirk Brenken2018-12-26
| | | | | | * determine L3 and L2 network devices to support pppoe interfaces correctly Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.0.6Dirk Brenken2018-11-17
| | | | | | | | | | * support multiple WAN interfaces in iptables rules, set 'ban_iface' option accordingly (as space separated list) or use the LuCI frontend * add new "refresh" mode while triggered by fw changes (no download) * add required ip dependency * fix wrong 'settype' definition for firehol1 in config Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: new package to block incoming & outgoing ip addressesDirk Brenken2018-11-10
a new script based package called "banIP" to block incoming & outgoing ip adresses/subnets via ipset. Features: * a shell script which uses ipset and iptables to ban a large number of IP addresses published in various IP blacklists (bogon, firehol etc.) * support blocking by ASN numbers * support blocking by iso country codes * support local white & blacklist (IPv4, IPv6 & CIDR notation) * auto-add unsuccessful ssh login attempts to local blacklist * auto-add the uplink subnet to local whitelist * per source configuration of SRC (incoming) and DST (outgoing) * supports IPv4 & IPv6 Strong LuCI support: * easy interface to track & change all aspects of your ipset configuration on the fly * integrated IPSet-Lookup * integrated RIPE-Lookup * Log-Viewer & online configuration of white- & blacklist LuCI-Screenshots will follow in the second post. Forum discussion: https://forum.openwrt.org/t/banip-new-project-needs-testers-feedback/16985 Signed-off-by: Dirk Brenken <dev@brenken.org>
Powered by cgit, Themed by Ted Yin.