aboutsummaryrefslogtreecommitdiff
path: root/net/banip/files
Commit message (Collapse)AuthorAge
* banip: update 0.9.5-5Dirk Brenken2024-05-05
| | | | | | | * fix a processing race condition * it's now possible to disable the icmp/syn/udp safeguards in pre-routing - set the threshold to '0'. Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.5-4Dirk Brenken2024-05-01
| | | | | | | * optimized adding suspicious IPs to Sets in the log monitor * re-added ipblackhole feed Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.5-3Dirk Brenken2024-04-26
| | | | | | | * allow multiple protocol/port definitions per feed, e.g. 'tcp udp 80 443 50000' * removed the default protocol/port limitation from asn feed Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.5-2Dirk Brenken2024-04-21
| | | | | | | | * fixed possible Set search race condition (initiated from LuCI frontend) * fixed the "no result" Set search problem in LuCI * removed abandoned feeds: spamhaus edrop (was merged with spamhaus drop) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.9.5-1Dirk Brenken2024-04-20
| | | | | | | | | | | | | | | | | * added a DDoS protection rules in a new pre-routing chain to prevent common ICMP, UDP and SYN flood attacks and drop spoofed tcp flags & invalid conntrack packets, flood tresholds are configured via 'ban_icmplimit' (default 10/s), 'ban_synlimit' (default 10/s) and 'ban_udplimit' (default 100/s) * the new pre-routing rules are tracked via named nft counters and are part of the standard reporting, set 'ban_logprerouting' accordingly * block countries dynamically by Regional Internet Registry (RIR)/regions, e.g. all countries related to ARIN. Supported service regions are: AFRINIC, ARIN, APNIC, LACNIC and RIPE, set 'ban_region' accordingly * it's now possible to always allow certain protocols/destination ports in wan-input and wan-forward chains, set 'ban_allowflag' accordingly - e.g. ' tcp 80 443-445' * filter/convert possible windows line endings of external feeds during processing * the cpu core autodetection is now limited to max. 16 cores in parallel, set 'ban_cores' manually to overrule this limitation * set the default nft priority to -100 for banIP input/forward chains (pre-routing is set to -150) * update readme * a couple of bugfixes & performance improvements * removed abandoned feeds: darklist, ipblackhole * added new feeds: becyber, ipsum, pallebone, debl (changed URL) * requires a LuCI frontend update as well (separate PR/commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.4-3Dirk Brenken2024-03-04
| | | | | | * fix another logical glitch in the logfile monitor Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.4-2Dirk Brenken2024-03-02
| | | | | | * fix a long standing problem in the logfile-parser with dropbear and compressed IPv6 addresses Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.9.4-1Dirk Brenken2024-03-02
| | | | | | | | | * add support for destination port & protocol limitations for external feeds (see readme for details), useful for lan-forward ad- or DoH-blocking, e.g. only tcp ports 80 and 443 * add turris sentinel blocklist feed * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.3-5Dirk Brenken2024-01-26
| | | | | | * fix the nft Set survey function Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.3-4Dirk Brenken2024-01-07
| | | | | | * made the default mail template "responsive" to get a better view esp. on mobile devices Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.3-3Dirk Brenken2023-12-28
| | | | | | * more init fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.3-2Dirk Brenken2023-12-28
| | | | | | | | | | * rework the device/interface auto-detection (only layer-3 network devices will be detetcted correctly), disable the auto-detection e.g. for special tunnel interfaces * supports now full gawk (preferred, if installed) and busybox awk * raise the default boot timeout to 20 seconds (if 'ban_triggerdelay' is not set) * various small fixes and improvements * readme update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: bump to release 0.9.3-1Dirk Brenken2023-12-11
| | | | | | | * provides an option to transfer log events on remote servers via cgi interface (disabled by default), see readme for details * refine the allowlist check to support IP intervals as well before adding an IP to the blocklist Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.2-4Dirk Brenken2023-11-25
| | | | | | * fix: accidently upload a faulty urlhaus feed regex in the former commit Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.2-3Dirk Brenken2023-11-25
| | | | | | | * fix the urlhaus regex * fix a possible init race condition Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.9.2-2Dirk Brenken2023-11-08
| | | | | | | * support backup/restore for remote allowlists * report the used log variant in status message Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.9.2-1Dirk Brenken2023-11-05
| | | | | | | | * the log file monitor now supports standard log files used by other log daemons like syslog-ng Set 'ban_logreadfile' accordingly, by default it points to /var/log/messages * removed logd dependency, closes #21932 Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.9.1-1Dirk Brenken2023-10-03
| | | | | | | | | * drop packets silently on input and forwardwan chains or actively reject the traffic, set 'ban_blocktype' accordingly * optimized banIP boot/reload handling * removed pppoe quirk in device detection * small fixes and optimizations Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.9.0-1Dirk Brenken2023-07-16
| | | | | | | | | | * supports allowing / blocking of certain VLAN forwards in segregated network environments, set 'ban_vlanallow', ''ban_vlanblock' accordingly * simplified the code/JSON to generate/parse the banIP status * enclose nft related devices in quotation marks , e.g. to handle devices which starts with a number '10g-1' * made the new vlan options available to LuCI (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.9-4Dirk Brenken2023-07-09
| | | | | | * made the etag id parsing more bulletproof (to catch unverified etags as well) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.9-3Dirk Brenken2023-07-08
| | | | | | | * prevent superflous etag function calls during start action (on start backups will be used anyway) * changed the ipthreat feed download URL (load a compressed file variant to save bandwidth) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.9-2Dirk Brenken2023-07-07
| | | | | | * fix a corner case backup issue with empty feed downloads Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.9-1Dirk Brenken2023-07-07
| | | | | | | | | * added HTTP ETag or entity tag support to download only ressources that have been updated on the server side, to save bandwith and speed up banIP reloads * added 4 new feeds: binarydefense, bruteforceblock, etcompromised, ipblackhole (see readme) * updated the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.8-2Dirk Brenken2023-06-24
| | | | | | | | * process local lists in strict sequential order to prevent possible race conditions * support ranges in the IP search, too * fix some minor search issues Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.8-1Dirk Brenken2023-06-21
| | | | | | | | | * Support MAC-/IPv4/IPv6 ranges in CIDR notation * Support concatenation of local MAC addresses with IPv4/IPv6 addresses, e.g. to enforce dhcp assignments (see readme) * small fixes & cosmetics * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.7-1Dirk Brenken2023-06-05
| | | | | | | | | | | * Optionally auto-add entire subnets to the blocklist Sets based on an additional RDAP request with the monitored suspicious IP, set 'ban_autoblocksubnet' accordingly (disabled by default). For more information regarding RDAP see https://www.ripe.net/manage-ips-and-asns/db/registration-data-access-protocol-rdap for reference. * small fixes & cosmetics * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.6-2Dirk Brenken2023-05-16
| | | | | | | | * fix/rework no-op loop * small fixes & cosmetics * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.6-1Dirk Brenken2023-05-12
| | | | | | | | * made the fetch utility function/autodetection more bullet proof * no longer add suspicious IPs to the local blocklist when the nft set timeout has been set * restructure internal functions & small fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.5-2Dirk Brenken2023-05-08
| | | | | | * fixed a log parser regression introduced in latest 0.8.4 update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.5-1Dirk Brenken2023-05-06
| | | | | | | | | | * add support for external allowlist URLs to reference additional IPv4/IPv6 feeds, set 'ban_allowurl' accordingly * make download retries in case of an error configurable, set 'ban_fetchretry' accordingly (default 5) * small fixes * readme update * LuCI update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-5Dirk Brenken2023-05-04
| | | | | | | | * fix remaining small issues * standardize log wording * polished up for branch 23.x Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-4Dirk Brenken2023-05-04
| | | | | | | | * add housekeeping to the autoallow function, only the current uplink will be held * fix small issues * cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-3Dirk Brenken2023-05-02
| | | | | | * add the option 'ban_autoallowuplink' to limit the uplink autoallow function: 'subnet' (default), 'ip' or 'disable' Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-2Dirk Brenken2023-04-28
| | | | | | | * fix domain lookup function (parse banIP config vars) * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.4-1Dirk Brenken2023-04-23
| | | | | | | | | | | | * add support for a custom feeds file (/etc/banip/banip.custom.feeds). Add new or edit existing banIP feeds on your own with the integrated custom feed editor (LuCI-component * add a new option 'ban_blockpolicy' to overrule the default bblock policy (block all chains), see readme for details * change the feed file format and add a new ipthreat feed, see readme * refine (debug) logging * multiple small fixes and improvements * readme update * luci update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.3-2Dirk Brenken2023-04-12
| | | | | | * more init fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.3-1Dirk Brenken2023-04-06
| | | | | | | | | | * add the new init command 'lookup', to lookup the IPs of domain names in the local lists and update them * significant acceleration of the domain lookup function * multiple small fixes and improvements * readme update * luci update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-6Dirk Brenken2023-03-30
| | | | | | * restored some accidently removed init stuff in last commit Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-5Dirk Brenken2023-03-30
| | | | | | | | | * fixed missing version number when installed as separate package (not in build) * fixed cornercase init and mailing issues * sorted Country list by country names ascending * fixed some shellcheck findings Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-4Dirk Brenken2023-03-26
| | | | | | * fixed a race condition if the service is in a disabled state Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-3Dirk Brenken2023-03-22
| | | | | | | | | | | * raise max. timeouts from 10 to 30 seconds to stabilize the autodetection on slow hardware * made interface trigger action configurable, set 'ban_triggeraction' accordingly (default: 'start') * made E-Mail notifications configurable to receive status E-Mais with every banIP run, set 'ban_mailnotification' accordingly (default: disabled) * small fixes & optimizations * readme update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.2-2Dirk Brenken2023-03-10
| | | | | | | | | | | | * fix the auto-detection for pppoe and 6in4 tunnel interfaces * add the new 'ban_nftpolicy' option to expose the nft set policy, values: memory (default), performance * add the new 'ban_nftlogevel' option to expose the nft syslog level, values: emerg, alert, crit, err, warn (default), notice, info, debug, audit * status optimizations * logging optimizations * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.2-1Dirk Brenken2023-03-08
| | | | | | | | | * major performance improvements: clean-up/optimize all nft calls * add a new "ban_reportelements" option, to disable the (time consuming) Set element count in the report (enabled by default) * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.1-3Dirk Brenken2023-03-06
| | | | | | | | | * finalized the LuCI frontend preparation (this is the minmal version to use the forthcoming LuCI frontend) * added a Set survey, to list all elements of a certain set * changed the default logterm for asterisk * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.1-2Dirk Brenken2023-02-26
| | | | | | | | | | * add oisdbig as new feed * LuCI frontend preparation: - the json feed file points always to /etc/banip/banip.feeds (and is no longer compressed) - supply country list in /etc/banip/banip.countries * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.1-1Dirk Brenken2023-02-25
| | | | | | | | | | | | | * add missing wan-forward chain (incl. report/mail adaption) * changed options: - old: ban_blockforward, new: ban_blockforwardwan and ban_blockforwardlan - old: ban_logforward, new: ban_logforwardwan and ban_logforwardlan * add missing dhcp(v6) rules/exceptions * update readme Previously run tested by certain forum users (and by me). Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.0-4Dirk Brenken2023-02-21
| | | | | | * remove bogus log limit Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.0-3Dirk Brenken2023-02-21
| | | | | | * properly initialize the 'proto' variable in the log service Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.0-2Dirk Brenken2023-02-20
| | | | | | | * fix a potential race condition during initial startup (after flash) which leads to a "disabled" service Signed-off-by: Dirk Brenken <dev@brenken.org Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.0 (nft rewrite)Dirk Brenken2023-02-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - complete rewrite of banIP to support nftables - all sets are handled in a separate nft table/namespace 'banIP' - for incoming blocking it uses the inet input hook, for outgoing blocking it uses the inet forward hook - full IPv4 and IPv6 support - supports nft atomic set loading - supports blocking by ASN numbers and by iso country codes - 42 preconfigured external feeds are available, plus local allow- and blocklist - supports local allow- and blocklist (IPv4, IPv6, CIDR notation or domain names) - auto-add the uplink subnet to the local allowlist - provides a small background log monitor to ban unsuccessful login attempts in real-time - the logterms for the log monitor service can be freely defined via regex - auto-add unsuccessful LuCI, nginx, Asterisk or ssh login attempts to the local blocklist - fast feed processing as they are handled in parallel as background jobs - per feed it can be defined whether the input chain or the forward chain should be blocked (default: both chains) - automatic blocklist backup & restore, the backups will be used in case of download errors or during startup - automatically selects one of the following download utilities with ssl support: aria2c, curl, uclient-fetch or wget - supports a 'allowlist only' mode, this option restricts internet access from/to a small number of secure websites/IPs - provides comprehensive runtime information - provides a detailed set report - provides a set search engine for certain IPs - feed parsing by fast & flexible regex rulesets - minimal status & error logging to syslog, enable debug logging to receive more output - procd based init system support (start/stop/restart/reload/status/report/search) - procd network interface trigger support - ability to add new banIP feeds on your own - add a readme with all available options/feeds to customize your installation to your needs - a new LuCI frontend will be available in due course Signed-off-by: Dirk Brenken <dev@brenken.org>
Powered by cgit, Themed by Ted Yin.