From 2ad1e01924b544a0e55ced4c8278110152728af1 Mon Sep 17 00:00:00 2001 From: Pawel Krawczyk Date: Wed, 1 Oct 2014 12:42:14 +0100 Subject: [PATCH] add content --- README.md | 110 +++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 109 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index dcfcf61..850885f 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,112 @@ blacklist-scripts ================= +This is a collection of shell scripts that are intended to block Linux systems and OpenWRT routers from known sources of malicious traffic. These scripts use `iptables` with highly efficient `ipset` module to check incoming traffic against blacklists populated from publicly available sources. -Various IP blacklisting scripts for Linux and OpenWRT +## Block lists + +* [Emerging Threats](http://rules.emergingthreats.net/fwrules/) - list of other known threats (botnet C&C, compromised servers etc) compiled from various sources, including [Spamhaus DROP](http://www.spamhaus.org/drop/), [Shadoserver](https://www.shadowserver.org/wiki/) and [DShield Top Attackers](http://www.dshield.org/top10.html) +* [www.blocklist.de](https://www.blocklist.de/en/index.html) - list of known password bruteforcers supplied by a network of [fail2ban](http://www.fail2ban.org/wiki/index.php/Main_Page) users +* [iBlocklist](https://www.iblocklist.com/lists.php) - various free and subscription based lists + +## firewall.user +This scripts is indended for OpenWRT routers. It will use the following blocklists by default: + +* www.blocklist.de +* Emerging Threats + +Requirements: + +* `opkg install ipset curl` + +Installation: + + sh firewall.user + cp firewall.user /etc/firewall.user + echo "01 01 * * * sh /etc/firewall.user" >>/etc/crontabs/root + +Results: + + # iptables -vnL + Chain blocklists (2 references) + pkts bytes target prot opt in out source destination + 0 0 LOG all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set emerging-Block-IPs.txt src,dst limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `BLOCK emerging-Block-IPs.txt ' + 0 0 DROP all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set emerging-Block-IPs.txt src,dst + 0 0 LOG all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set fullbogons-ipv4.txt src,dst limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `BLOCK fullbogons-ipv4.txt ' + 0 0 DROP all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set fullbogons-ipv4.txt src,dst + 6 783 LOG all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set export-ips_all.txt src,dst limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `BLOCK export-ips_all.txt ' + 6 783 DROP all -- eth0.2 * 0.0.0.0/0 0.0.0.0/0 match-set export-ips_all.txt src,dst + + Chain forward (1 references) + pkts bytes target prot opt in out source destination + 14994 1753K blocklists all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED + ... + + Chain input (1 references) + pkts bytes target prot opt in out source destination + 250 13802 blocklists all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED + ... + + # ipset list | wc -l + 21553 + +## blacklist.sh + +This script is intended for Linux servers. It does not load Bogons blocklist which can cause serious problems in VPS environments. Blacklists used: + +* www.blocklist.de +* Emerging Threats + +Requirements: + +* On Debian, Ubuntu and other `apt` systems: `apt-get install ipset curl` +* On RedHat, Fedora, CentOS and other RPM systems: `yum install ipset curl` + +Installation: + + sh blacklist.sh + cp blacklist.sh /etc/cron.daily/blacklist + +Results: + + # iptables -vnL + Chain INPUT (policy ACCEPT 40M packets, 159G bytes) + pkts bytes target prot opt in out source destination + 5622K 350M blacklist all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW + + Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) + pkts bytes target prot opt in out source destination + + Chain OUTPUT (policy ACCEPT 39M packets, 166G bytes) + pkts bytes target prot opt in out source destination + + Chain blacklist (1 references) + pkts bytes target prot opt in out source destination + 11 488 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 match-set blacklist src limit: avg 1/min burst 5 LOG flags 0 level 4 prefix `BLACKLIST ' + 11 488 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 match-set blacklist src + + # ipset list | wc -l + 22590 + + # ipset list | head + Name: blacklist + Type: hash:net + Header: family inet hashsize 8192 maxelem 65536 + Size in memory: 416688 + References: 2 + Members: + 183.141.72.28 + 201.210.28.205 + 222.186.56.11 + 178.137.16.203 + + # dmesg|tail + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=61.174.51.198 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=141.212.121.232 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=232 ID=54321 PROTO=TCP SPT=51441 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=58.241.61.162 DST=192.168.100.8 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=17539 PROTO=TCP SPT=4127 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.109.116 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.103.78 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.109.115 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=122.225.109.208 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=61.174.51.200 DST=192.168.100.8 LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=198.71.58.200 DST=192.168.100.8 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=52934 DF PROTO=TCP SPT=59939 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0 + BLACKLIST IN=eth0 OUT= MAC=00:50:56:a0:11:61:44:d3:ca:0f:20:b7:08:00 SRC=198.71.58.200 DST=192.168.100.8 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=52935 DF PROTO=TCP SPT=59939 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0