12

We can see from the nginx logs that there is an IP address doing nasty things.

How can we block it with a pf command and then later permanently with the /etc/pf.log? How can we block a x.x.x.x/24 for that IP? It is example: 1.2.3.4

UPDATE: no, looks like OpenBSD doesn't have allow/deny file in /etc. And AFAIK the best advise for blocking abusive IP addresses are using pf.

# cd /etc 
# ls -la|egrep -i 'deny|allow'
# uname -a
OpenBSD foo.com 5.4 GENERIC.MP#0 amd64
# 
  • Do you have a hosts.deny file in the /etc directory? – ryekayo Aug 22 '14 at 18:35
11

The best way to do this is to define a table and create a rule to block the hosts, in pf.conf:

table <badhosts> persist
block on fxp0 from <badhosts> to any

And then dynamically add/delete IP addresses from it:

$ pfctl -t badhosts -T add 1.2.3.4
$ pfctl -t badhosts -T delete 1.2.3.4

Other 'table' commands include flush (remove all), replace and show. See man pfctl for more.

If you want a more permanent list you can keep it in one (or more) files. In pf.conf:

table <badhosts> persist file "/etc/badguys1" file "/etc/badguys2"
block on fxp0 from <badhosts> to any

You can also add hostnames instead of IP addresses. See the "Tables" section of man pf.conf and man pfctl.

Note: The examples above assume that the internet-facing interface is fxp0, please change according to your setup. Also, keep in mind that the rules in pf.conf are evaluated sequentially and for block or pass rules its the last matching rule that applies. With this ruleset

table <badhosts> persist
block on fxp0 from <badhosts> to any
pass inet tcp from 192.168.0.0/24 to any port 80

and after adding 1.2.3.4 and 192.168.0.10 to the badhosts table

$ pfctl -t badhosts -T add 1.2.3.4
$ pfctl -t badhosts -T add 192.168.0.10

all traffic from 1.2.3.4 and 192.168.0.10 will be blocked but the second host will be able to make connections to other machines' port 80 because the pass rule matches and overrides the block rule.

  • 3
    The block rule can be more easily specified as block in from <badhosts>. You don't need to specify interface or the to any part. – kurtm Nov 18 '14 at 15:41
3

I got this information from the website and forgive me for my ill knowledge of OpenBSD, but here it goes. Take a look at this URL. According to it, it states to block an IP you would:

echo '123.123.123.123' >> /etc/pf.blocked.ip.conf

Then you would restart the firewall:

pfctl -d
pfctl -e -f /etc/pf.conf

Or, to add without restarting the firewall type:

pfctl -t blockedips -T add 111.222.333.444

Now to check if it has been added type:

pfctl -t blockedips -T show

Update: Maybe this would help.

  • Open the following file in vi:

    vi /etc/pf.conf

  • Add the following line of code:

    table <blockedips> persist file "/etc/pf.blocked.ip.conf" ext_if="bge0" # interface connected to internet

  • After that point, I would try restarting the firewall and confirming that the IP is blocked by typing:

    pfctl -d
    pfctl -e -f /etc/pf.conf
    pfctl -t blockedips -T show
    
  • I think the table needs to be set to block, but that part is not clear in the howto, I followed it, but the IP is still not blocked – somelooser28533 Aug 22 '14 at 19:04
  • Let me see if I can look up how to do so. – ryekayo Aug 22 '14 at 19:11
  • Just updated my answer, let me know if this helps – ryekayo Aug 22 '14 at 19:16
  • 1
    There is no need do disable and reenable pf to reload pf.conf. pfctl -f /etc/pf.conf is enough. – Zé Loff Sep 10 '14 at 2:00
  • The table line is ok, but you need to add a block rule to make use of it. The ext_if macro only makes sense if by any chance you have an interface named bge0 and if you use that macro later on the file. – Zé Loff Sep 10 '14 at 2:07
3

It's not clear from other answers that you need to create an actual table of the badhosts you are trying to block.

This goes in the pf.conf file, for example I have two badguys files, 1&2 badguys1 is for those who come and go, and badguys2 is for permanent blacklisting.

So if you need to add an ip of someone who is a nuisance for a period of time, add them to badguys1.

Now, in your pf.conf file you have this. In my example I use en1, because that's my WiFi interface. Set that to what ever interface your network comes in on.

table <badhosts> persist file "/etc/badguys1" file "/etc/badguys2"
block on en1 from <badhosts> to any

Now you can add temporary addresses to badguys1. (NOT badhosts, that's a name for the tables)

sudo pfctl -t badguys1 -T add 185.130.5.160

1 table created.
1/1 addresses added.

Although it says 1 table created - it actually adds the ip, not creating a new table. Now if you look in badguys1, you will see the new IP.

sudo pfctl -t badhosts -T show

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.