73 lines
3.6 KiB
Markdown
73 lines
3.6 KiB
Markdown
# AutoFW
|
|
|
|
This tool is inspired by fail2ban, but is simpler and less forgiving.
|
|
There are no configuration files, and addresses stay blocked until they are explicitly removed.
|
|
You provide it with a list of whitelisted and blacklisted IP addresses and ranges, and its output is a list of commands to blacklist slightly larger IP ranges covering multiple IP addresses.
|
|
|
|
It assumes UFW for now.
|
|
|
|
## Examples
|
|
|
|
- For a.b.c.0 and a.b.c.1 you will get a block on a.b.c.0/31.
|
|
- For a.b.c.0 and a.b.c.255 you will get a block on a.b.c.0/24.
|
|
- You will also get a block on a.b.0.0/16, if there are at least 4 blacklisted IP blocks on the form a.b.z.0, for any z.
|
|
|
|
## Building
|
|
|
|
The easiest way to build this is to use Docker.
|
|
|
|
1. Install the Docker command line client on your machine.
|
|
1. Run `./build.sh`. This will build a binary for aarch64 or x84_64, depending on your host.
|
|
1. You can also add the parameter `arm` or `x86` to the `./build.sh` script to build for a particular architecture.
|
|
1. The result will be a binary in the `bin` sub directory.
|
|
1. You can then run `./run.sh` for an interactive environment. In this case the source code will be copied to new `src-x` directory (where `x` depends on the architecture), so your changes do not disappear when the Docker container exits. This script also takes the parameter `arm` or `x86`.
|
|
|
|
Some functions are perhaps overly general, but that is because they are taken directly from the [EMG](https://nordicmessaging.se) source code.
|
|
|
|
## Usage
|
|
|
|
First you create a file autofw.whitelist, containing IP addresses and ranges that should always be allowed to connect to your server.
|
|
|
|
Then create a script that performs the tasks below. This can be run by cron.
|
|
|
|
1. Collect all IP addresses and ranges to block into a new file, say `autofw.badips`. It may be a good idea to filter out entries in the whitelist.
|
|
1. Run `ufw insert 1 deny from $ip` for each entry in `autofw.badips`. The ufw tool will automatically ignore duplicates.
|
|
1. Collect all blacklisted addresses using the following command:
|
|
``ufw status verbose | grep DENY | awk '{print $4}' > autofw.blacklist``
|
|
1. Run `./autofw > ufw.updates`.
|
|
1. Run the `./ufw.updates` script.
|
|
1. Finally run `ufw reload` to activate the new rules.
|
|
|
|
Both the whitelist and blacklist can contain both individual IP addresses and ranges on the form a.b.c.d/e, where e is between 0 and 32.
|
|
In our own installation at [Braxo](https://braxo.se) we also sort the list of bad IP addresses and remove duplicates, between steps 1 and 2.
|
|
This way we can easily know if something has changed, or if we can just skip the rest of the steps.
|
|
|
|
To block machines trying to attack your SMTP server sending invalid commands, you can use a command such as the one below.
|
|
Then simply add additional commands as needed, based on your own log files from whatever applications you are running.
|
|
|
|
cat /var/log/mail.log |
|
|
grep 'non-SMTP command' |
|
|
awk '{print $8}' |
|
|
tr '[]' ' ' |
|
|
awk '{print $2}' >> autofw.badips
|
|
|
|
If you run `ufw insert 1 deny from x.y.z.w` manually at some point, that IP will stay blocked.
|
|
It will then possibly be merged with any of the other blocked IP addresses.
|
|
|
|
The output from `./autofw` is a list of UFW commands.
|
|
Here we assume we have blocked a.b.c.115 and a.b.c.116, and whitelisted e.f.g.h.
|
|
The reason we first delete the rule for e.f.g.h and then add it back, is to make sure it comes first.
|
|
This way whitelisted addresses can never be blocked.
|
|
|
|
yes | ufw delete deny from a.b.c.115/32
|
|
yes | ufw delete deny from a.b.c.116/32
|
|
ufw insert 1 deny from a.b.c.112/29
|
|
yes | ufw delete allow from e.f.g.h/32
|
|
ufw insert 1 allow from e.f.g.h/32
|
|
|
|
## TODO
|
|
|
|
- Better git/ssh setup.
|
|
- IPv6
|
|
- Other firewall backends, such as raw iptables.
|
|
|