Dinamic (www list) IP BAN ...

Dinamic (www list) IP BAN ...

[Roque]

Hi all, i wonder if someone could help me with a little problem ...
I need to ban a number of IP´s that are posted in a plain text file on
a web site; the file changes every 30Min. The file is as simple as

banned-ip1    #Reason1
banned-ip2    #Reason
...

The url can be reached in this way: http://www.url.com/ip/banned.txt

I have read the iptables man pages and haven´t seen nothing similar.
Is it really posible to do so?
Thanks in Advance. roque@lpgc.net

Re: Dinamic (www list) IP BAN ...

[Frank Gruellich]

Hello,

* Roque <roque@lpgc.net> 22. Apr 04:
> I need to ban a number of IP´s that are posted in a plain text file on
> a web site; the file changes every 30Min. The file is as simple as
> 
> banned-ip1    #Reason1
> banned-ip2    #Reason
> ...
> 
> The url can be reached in this way: http://www.url.com/ip/banned.txt

WARNING: this is very, very bad!  Don't insert rules automatic from an
untrusted source (anything outside of your net _is_ untrusted).  Said
this...

> I have read the iptables man pages and haven´t seen nothing similar.
> Is it really posible to do so?

 # iptables -N banned_ips 2>/dev/null
 # iptables -F banned_ips
 # wget --output-document=- http://www.url.com/ip/banned.txt |
 > while read ip reason
 > iptables -A banned_ips -d $ip -j REJECT
 > done

Repeat this every 30min by cron.  Insert the chain banned_ips whereever
you need it (likely in your FORWARD).

HTH,
 regards, Frank.
-- 
Sigmentation fault

Re: Dinamic (www list) IP BAN ...

[Antony Stone]

On Thursday 22 April 2004 5:47 pm, Roque wrote:

> Hi all, i wonder if someone could help me with a little problem ...
> I need to ban a number of IP´s that are posted in a plain text file on
> a web site; the file changes every 30Min. The file is as simple as
>
> banned-ip1    #Reason1
> banned-ip2    #Reason
> ...
> The url can be reached in this way: http://www.url.com/ip/banned.txt
>
> I have read the iptables man pages and haven´t seen nothing similar.
> Is it really posible to do so?

I would suggest you set up a cron job which runs a shell script to fetch the 
list (using wget or lynx etc), then add the current IPs to a user-defined 
chain, then switch a rule in INPUT or FORWARD (you don't say which it is you 
want to ban, possibly both) to that chain from the previous one which was in 
place, then flush the old list ready for populating the next time around.

ie: you have two user-defined chains, one of which is in use, and the other of 
which you are populating with the banned IPs, then you switch between them.

Don't try adn use just one list, or else you will either (a) have trouble 
removing the old entries, or (b) have some period of time when there are no 
IPs in the banned list (which presumably is undesirable).

Regards,

Antony.

-- 
Success is a lousy teacher.  It seduces smart people into thinking they can't 
lose.

 - William H Gates III

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Dinamic (www list) IP BAN ...

[cky]

Hi,

just write a little script and call it by a cronjob every 30 minutes or so.

I assume your banlistfile is splitted into 2 or more tables (as you show), like:

192.168.0.3     #comment 1
10.10.3.2         #comment 2
192.168.44.2   #comment 3

and so on.

So take a look at this (very simple) script (if you've more iptables rules, you've to change the script, of course):


#!/bin/bash

banfile="/path/to/banlist.txt"

iptables -F
iptables -Z

for ip in `cat $banfile | awk '{print $1}'`; do
	iptables -A INPUT -s $ip -j DROP
done


That's all.


Best regards,
Thomas


On Thu, 22 Apr 2004 17:47:19 +0100
Roque <roque@lpgc.net> wrote:

> Hi all, i wonder if someone could help me with a little problem ...
> I need to ban a number of IP´s that are posted in a plain text file on
> a web site; the file changes every 30Min. The file is as simple as
> 
> banned-ip1    #Reason1
> banned-ip2    #Reason
> ...
> 
> The url can be reached in this way: http://www.url.com/ip/banned.txt
> 
> I have read the iptables man pages and haven´t seen nothing similar.
> Is it really posible to do so?
> Thanks in Advance. roque@lpgc.net