DOCSEARCHbyAlgolia
Submit Docs

FireHOL Blocklist IPSets

repository·master·Indexed 26 days ago

https://github.com/firehol/blocklist-ipsets

A collection of IP blocklists (netsets and ipsets) for blocking known attackers, spam sources, and unrouteable IPs. It provides IPv4 hash:net lists derived from MaxMind GeoLite2, IP2Location, and IPDeny, including granular sets for countries, continents, and specific provider types such as anonymous and satellite providers.

Tokens
28.2K
Snippets
52
Records
100
Agent score
87%

What's inside firehol-blocklist-ipsets

  1. Overview of blocklist-ipsets repository

    master
    This repository provides a collection of IP blocklists that are dynamically updated using FireHOL's update-ipsets.sh script. The lists are self-maintained via cron jobs and are updated once per day. Users can access direct links to all files at https://iplists.firehol.org. The repository is designed to be updated easily using git pull to synchronize all lists at once.

  2. Overview of MaxMind GeoLite2 ipsets

    master

    This repository provides ipsets generated from MaxMind GeoLite2 databases. These databases provide free IP geolocation data (updated on the first Tuesday of each month) and are used to create ipsets for countries, continents, and specific provider types.

    License Attribution Requirement: If you use this data in advertising or documentation, you must include the following attribution:

    This product includes GeoLite2 data created by MaxMind, available from www.maxmind.com.

  3. Understand the update frequency of ipip_country lists

    master
    The ipip_country lists are updated based on an internal maximum frequency configuration. A list is never downloaded sooner than its stated update frequency. Additionally, if a list has not been modified on the server (verified via the HTTP IF_MODIFIED_SINCE method), a download may not occur even after the update frequency has expired.

  4. Understand the dynamic ipset update mechanism

    master

    The ipset lists are updated dynamically based on internal configuration. Updates are subject to the following rules:

    1. Update Frequency: A list will never be downloaded sooner than the update frequency specified in the internal configuration.
    2. Conditional Downloads: Even if the update frequency has expired, a list may not be downloaded if it has not been modified on the server. This is determined using the HTTP IF_MODIFIED_SINCE method to save bandwidth and resources.

  5. Understand MaxMind GeoLite2 IPset coverage

    master

    The GeoLite2 ipsets are generated from MaxMind's free IP geolocation databases. These ipsets cover several data dimensions:

    • Country ipsets: Includes subnets for country (location), registered_country (registration), and represented_country (e.g., military bases). If these values differ, the subnet is added to all applicable ipsets.
    • Continent ipsets: Includes geolite2/continent_*.netset files based on the continent where the IP subnet is located.
    • Global provider ipsets:
      • geolite2/anonymous.netset: Includes subnets flagged with A1 (is anonymous provider).
      • geolite2/satellite.netset: Includes subnets flagged with A2 (is satellite provider).

  6. Select specialized IPsets for web clients and servers

    master

    For targeted protection of web-facing infrastructure, use these specialized sets in conjunction with firehol_level1:

    • firehol_webclient: An IP blacklist of IPs that a web client should never talk to (includes cybercrime). Use this on top of firehol_level1.
    • firehol_webserver: A blacklist of IPs that should never be used by your web users (includes malware hosts, bots, myip, and stopforumspam_toxic). Use this on top of firehol_level1, level2, level3, and potentially firehol_proxies or firehol_anonymous.

  7. Select FireHOL IPset levels for protection

    master

    FireHOL provides pre-aggregated IPsets categorized by protection levels. Choose a level based on your risk tolerance and the type of service you are protecting:

    • Level 1 (Basic): Maximum protection with minimum false positives. Suitable for basic protection on all internet-facing servers, routers, and firewalls. Includes dshield, feodo, fullbogons, and spamhaus_drop.
    • Level 2 (Essentials): Tracks attacks from the last ~48 hours. Includes blocklist_de, dshield_1d, and greensnow.
    • Level 3: Tracks attacks, spyware, and viruses reported in the last 30 days. Includes bruteforceblocker, ciarmy, dshield_30d, myip, and vxvault.
    • Level 4: Tracks attacks but may include a large number of false positives. Includes blocklist_net_ua, botscout_30d, cybercrime, iblocklist_hijacked, iblocklist_spyware, and iblocklist_webexploit.

  8. Best practices for using IP blocklists

    master

    When implementing IP blocklists, follow these safety guidelines to avoid self-denial of service:

    1. Verify Sources: Check the maintenance site of each list to ensure you trust the provider.
    2. Apply at the Internet Edge: Apply blocklists at the internet-facing side of your firewall.
    3. Avoid LAN/DMZ Blocking: Do not apply bogons or fullbogons lists (which contain private, unrouteable IPs) on your DMZ or LAN side, as this will block you from your own firewall.
    4. Use a Whitelist: Always maintain a whitelist of trusted IP addresses or subnets. Configure your firewall rules so that if an IP is in the whitelist, it is not blocked by the blacklists.
    5. Handle TOR carefully: The lists include TOR network IPs (bm_tor, dm_tor, et_tor). Only block these if your specific use case (e.g., eCommerce) requires it.

  9. Comply with MaxMind GeoLite2 attribution requirements

    master

    Because these ipsets use GeoLite2 data, you must meet the attribution requirement of the Creative Commons Attribution-ShareAlike 3.0 Unported License. Include the following text in all advertising and documentation mentioning features of or use of this database:

    This product includes GeoLite2 data created by MaxMind, available from www.maxmind.com.

    > This product includes GeoLite2 data created by MaxMind, available from [www.maxmind.com](http://www.maxmind.com).

  10. Update ipsets while the firewall is running

    master
    To update your ipsets without stopping your firewall, use the update-ipsets.sh script from the FireHOL distribution. This script downloads necessary updates and calls FireHOL to refresh the ipsets in the kernel. It is recommended to run this via cron (e.g., every 10 minutes) as it is optimized to only download lists that have changed.

  11. Configure FireHOL to use provided ipsets

    master

    To use these lists in your firehol.conf, you must first create the ipsets and then add the files. Note that subnets should use hash:net and individual IPs should use hash:ip.

    For subnets (netsets):

    for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
    ipset4 create ${x} hash:net
    ipset4 addfile ${x} ipsets/${x}.netset
    blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} except src ipset:whitelist
done

    For individual IPs:

    for x in feodo palevo sslbl zeus openbl blocklist_de
do
    ipset4 create ${x} hash:ip
    ipset4 addfile ${x} ipsets/${x}.ipset
    blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} except src ipset:whitelist
done

    Performance Tip: To improve iptables performance, change the blacklist4 keyword full to input. This ensures only the first packet of a NEW inbound connection is checked.

    # our wan interface
wan="dsl0"

# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted

# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
    ipset4 create  ${x} hash:net
    ipset4 addfile ${x} ipsets/${x}.netset
    blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
        except src ipset:whitelist
done

# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
    ipset4 create  ${x} hash:ip
    ipset4 addfile ${x} ipsets/${x}.ipset
    blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
        except src ipset:whitelist
done