Blocklists - IP, DNS, RBL and ads - Which do you use?

Comments

• chip Member

  December 2022

  Interested
• stoned Member

  December 2022

  Something I use on my mail server:

  #!/bin/bash
  ipset flush
  
  ipset create ipsum hash:net
  ipset create exim hash:net
  ipset create dnsbl hash:net
  
  rm /tmp/iplist.txt
  rm /tmp/exim.txt
  
  grep -i "authenticator failed" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\]:.*/$1/' >> /tmp/iplist.txt
  grep -i "SMTP command timeout" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "no host name found for IP address" /var/log/exim4/mainlog | perl -pe 's/.*(\d+(\.\d+){3}).*/$1/' >> /tmp/iplist.txt
  grep -i "relay not permitted" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "SMTP syntax error" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "refused: too many connections" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "rejected RCPT" /var/log/exim4/mainlog | grep -iv ':' | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  
  for ip in $(cat /tmp/exim.txt | grep -v "#" | cut -f 1); do ipset add exim $ip; done
  iptables -I INPUT -m set --match-set exim src -j DROP
  
  for ip in $(curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt 2>/dev/null | grep -v "#" | cut -f 1 | sort | uniq ); do ipset add ipsum $ip; done
  iptables -I INPUT -m set --match-set ipsum src -j DROP
  
  for ip in $(curl --compressed https://www.spamhaus.org/drop/drop.txt 2>/dev/null | sed 's/;.*$//g'); do ipset add dnsbl $ip; done
  for ip in $(curl --compressed https://www.spamhaus.org/drop/edrop.txt 2>/dev/null | sed 's/;.*$//g'); do ipset add dnsbl $ip; done
  iptables -I INPUT -m set --match-set dnsbl src -j DROP
  
  

  https://github.com/stamparm/ipsum

  Thanked by 1maverick
• tjn Member

  December 2022

  I like your approach @stoned !

  Thanked by 1stoned
• UrDN Member

  December 2022

  @tjn said: Which blocklists (or whitelists!) would you recommend?

  None. It's foolish to delegate your filtering to someone else.
• tjn Member

  December 2022

  @UrDN said:
  None. It's foolish to delegate your filtering to someone else.

  Go on then, how are you doing your filtering?
• stoned Member

  December 2022

  Community maintained efforts are better than solo efforts. A collective database contributed to by many is a good idea in many cases, but not every case.

  Thanked by 1tjn
• UrDN Member

  December 2022

  @tjn said:
  Go on then, how are you doing your filtering?

  Filtering what?
• stoned Member

  December 2022

  #!/bin/bash
  ipset flush
  
  ipset create ipsum hash:net
  ipset create exim hash:net
  ipset create dnsbl hash:net
  
  rm /tmp/iplist.txt
  rm /tmp/exim.txt
  
  grep -i "authenticator failed" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\]:.*/$1/' >> /tmp/iplist.txt
  grep -i "SMTP command timeout" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "no host name found for IP address" /var/log/exim4/mainlog | perl -pe 's/.*(\d+(\.\d+){3}).*/$1/' >> /tmp/iplist.txt
  grep -i "relay not permitted" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "SMTP syntax error" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "refused: too many connections" /var/log/exim4/mainlog | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  grep -i "rejected RCPT" /var/log/exim4/mainlog | grep -iv ':' | perl -pe 's/.*\[(\d+(\.\d+){3})\].*/$1/' >> /tmp/iplist.txt
  
  
  sort -u /tmp/iplist.txt | grep -iv no | grep -v ':'> /tmp/exim.txt
  
  for ip in $(cat /tmp/exim.txt | grep -v "#" | cut -f 1); do ipset add exim $ip; done
  iptables -I INPUT -m set --match-set exim src -j DROP
  
  for ip in $(curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt 2>/dev/null | grep -v "#" | cut -f 1 | sort | uniq ); do ipset add ipsum $ip; done
  iptables -I INPUT -m set --match-set ipsum src -j DROP
  
  for ip in $(curl --compressed https://www.spamhaus.org/drop/drop.txt 2>/dev/null | sed 's/;.*$//g'); do ipset add dnsbl $ip; done
  for ip in $(curl --compressed https://www.spamhaus.org/drop/edrop.txt 2>/dev/null | sed 's/;.*$//g'); do ipset add dnsbl $ip; done
  iptables -I INPUT -m set --match-set dnsbl src -j DROP
  
  

  Somehow magically deleted this line while pasting earlir, sort -u /tmp/iplist.txt | grep -iv no | grep -v ':'> /tmp/exim.txt without which the script doesn't make sense.

  Enjoy

  I do similar custom filtering on all services just like this one, as well as general known bad actors from multiple reported bad actor lists.