AutoFW

This tool is inspired by fail2ban.

Assumes UFW for now.

Building

On Ubuntu: apt-get install -y cmake libpcre2-dev

cmake . make

Usage

1. Create a file autofw.whitelist, containing IP addresses and ranges that should always be allowed to connect.
2. Collect all IP addresses and ranges to block into a new file, say autofw.badips. It may be a good idea to filter out entries in the whitelist.
3. Run ufw insert 1 deny from $ip for each entry in autofw.badips. The ufw tool will automatically ignore duplicates.
4. Collect all blacklisted addresses using the following command: ufw status verbose | grep DENY | awk '{print $4}' > autofw.blacklist
5. Run ./autofw > ufw.updates.
6. Run the ufw.updates script.