On the Internet we can find (usually crowdsourced) lists of malicious IP addresses responsible for attacks. We can easily integrate them in Foomuuri in order to block connections from these bad hosts. Not only does this improve security, it is also a performance win, because our daemons don’t don’t have to waste any more time dealing with these malicious connections.
The blocklists
- blocklist.de: a crowdsourced list of IP addresses involved in all kinds of attacks
- techmdw blacklist: this list is compiled by the Swedish company TechMDW AB and is based on Crowdsec with their own additions
- Greensow
- Spamhaus DROP: The Don’t Route or Peer List by Spamhaus contains netblocks which you should never interact with because they are leased or stolen by criminal organisations
- Emerging Threats: compilation of Spamhaus DROP list, the top attackers list by DShield and lists by abuse.ch
- Interserver: list consisting of IP addresses attacking servers of the web hosting company Interserver
- Stopforumspam: list of toxic IP addresses which are believed to be used only for spamming websites
Blocking incoming connections from malicious IPs
Create file/etc/foomuuri/iplist.conf with these contents:
iplist {
@blocklist_de https://lists.blocklist.de/lists/all.txt refresh=15m
@techmdw https://blacklist.techmdw.com/ refresh=30m
@greensnow https://blocklist.greensnow.co/greensnow.txt refresh=30m
@et https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt refresh=24h
@interserver https://rbldata.interserver.net/ip.txt refresh=15m
@stopforumspam https://www.stopforumspam.com/downloads/toxic_ip_cidr.txt refresh=2h
@spamhausdrop https://www.spamhaus.org/drop/drop.txt refresh=24h
@spamhausdropv6 https://www.spamhaus.org/drop/dropv6.txt refresh=24h
}Then in the public-localhost section (which I usually put in /etc/foomuuri/public-localhost.conf), add this at the top:
saddr @blocklist_de drop counter "blocklist.de"
saddr @techmdw drop counter "techmdw"
saddr @greensnow drop counter "greensnow"
saddr @spamhausdrop drop counter "spamhausdrop"
saddr @spamhausdropv6 drop counter "spamhausdropv6"
saddr @et drop counter "et"
saddr @interserver drop counter "interserver"
saddr @stopforumspam drop counter "stopforumspam"In order to prevent getting locked out of your system yourself because of a false positive or an error in one of the lists, I recommend adding one rule which allows you to always access your system before these rules. For example to make sure you can always connect from IP xxx.xxx.xxx.xxx put this as first rule in public-localhost section:
ssh saddr xxx.xxx.xxx.xxx acceptIn the rules above I’m not logging all the details of the dropped connections, but I’m keeping a counter so that I can see how many times such a rule has been hit. You can use the command
# foomuuri list counterto see how many packets and bytes have been dropped by these rules.
If you want to log all individual dropped connections , you can add this at the end of every line:
log "name_of_the_blocklsit"They will then be logged with the prefix name_of_the_blocklist.
Rejecting outgoing connections to malicious IPs
We can also block outgoing connections. You should especially do this for the Spamhaus DROP lists. Add this to the localhost-public section:
daddr @blocklist_de reject counter "out_blocklist.de" log "out_blocklist.de"
daddr @techmdw reject counter "out_techmdw" log "out_techmdw"
daddr @greensnow reject counter "out_greensnow" log "out_greensnow"
daddr @spamhausdrop reject counter "out_spamhausdrop" log "out_spamhausdrop"
daddr @spamhausdropv6 reject counter "out_spamhausdropv6" log "out_spamhausdropv6"
daddr @et reject counter "out_et" log "out_et"
daddr @interserver reject counter "out_interserver" log "out_interserver"
daddr @stopforumspam reject counter "out_stopforumspam" log "out_stopforumspam"Notice that I’m rejecting instead of dropping these connections so that applications don’t keep on waiting until the connection attempt times out and I’m logging these. Normally these rules should only very rarely get triggered, but if they do you want detailed logs so you easily investigate what’s going on.
Dropping or allowing incoming connections by country of origin
Another very effective method to prevent abuse is to limit connections to services like SSH and your mail server to certain countries of origin. You can find lists of IP (both IPv4 and IPv6) addresses per country on https://github.com/ipverse/rir-ip/tree/master/country . You can add them to an iplist in Foomuuri and then use these in the public-localhost section. Note that these lists are not perfect and sometimes connections can come from another country than from the one the IP address is registered to in this database. Especially public VPN services sometimes suffer from these problems, so be careful if you are using these.
You can also use this aggregated list of all European IP addresses, but unfortunately that list only exists for IPv4 addresses.
To use this aggregated list, add this to the iplist section:
@europe https://ipv4.fetus.jp/krfilter.4.txt refresh=24h Then with these rules in the the public-localhost section, I only allow IPv4 connections to port 143 (IMAP), 993 (IMAPs), port 587 (Submission), port 465 (Submissions) from European IPs. Note that I allow IPv6 from the whole world because this aggregated list only contains IPv4 addresses.
ssh ipv4 saddr @europe
ssh ipv6
ssh drop counter "non-europe" log "non-europe"
imap ipv4 saddr @europe
imap ipv6
imap drop counter "non-europe" log "non-europe"
imaps ipv4 saddr @europe
imaps ipv6
imaps drop counter "non-europe" log "non-europe"
submission ipv4 saddr @europe
submission ipv6
submission drop counter "non-europe" log "non-europe"
submissions ipv4 saddr @europe
submissions ipv6
submissions drop counter "non-europe" log "non-europe"More information
https://github.com/FoobarOy/foomuuri/wiki/Configuration#iplist