How to block abusive IP addresses with pf in OpenBSD?

Question

We can see from the nginx logs that there is an IP address doing nasty things.

How can we block it with a pf command and then later permanently with the /etc/pf.log? How can we block a x.x.x.x/24 for that IP? It is example: 1.2.3.4

UPDATE: no, looks like OpenBSD doesn't have allow/deny file in /etc. And AFAIK the best advise for blocking abusive IP addresses are using pf.

# cd /etc 
# ls -la|egrep -i 'deny|allow'
# uname -a
OpenBSD foo.com 5.4 GENERIC.MP#0 amd64
# 

Answer 1

The best way to do this is to define a table and create a rule to block the hosts, in pf.conf:

table <badhosts> persist
block on fxp0 from <badhosts> to any

And then dynamically add/delete IP addresses from it:

$ pfctl -t badhosts -T add 1.2.3.4
$ pfctl -t badhosts -T delete 1.2.3.4

Other 'table' commands include flush (remove all), replace and show. See man pfctl for more.

If you want a more permanent list you can keep it in one (or more) files. In pf.conf:

table <badhosts> persist file "/etc/badguys1" file "/etc/badguys2"
block on fxp0 from <badhosts> to any

You can also add hostnames instead of IP addresses. See the "Tables" section of man pf.conf and man pfctl.

Note: The examples above assume that the internet-facing interface is fxp0, please change according to your setup. Also, keep in mind that the rules in pf.conf are evaluated sequentially and for block or pass rules its the last matching rule that applies. With this ruleset

table <badhosts> persist
block on fxp0 from <badhosts> to any
pass inet tcp from 192.168.0.0/24 to any port 80

and after adding 1.2.3.4 and 192.168.0.10 to the badhosts table

$ pfctl -t badhosts -T add 1.2.3.4
$ pfctl -t badhosts -T add 192.168.0.10

all traffic from 1.2.3.4 and 192.168.0.10 will be blocked but the second host will be able to make connections to other machines' port 80 because the pass rule matches and overrides the block rule.

Answer 2

It's not clear from other answers that you need to create an actual table of the badhosts you are trying to block.

This goes in the pf.conf file, for example I have two badguys files, 1&2 badguys1 is for those who come and go, and badguys2 is for permanent blacklisting.

So if you need to add an ip of someone who is a nuisance for a period of time, add them to badguys1.

Now, in your pf.conf file you have this. In my example I use en1, because that's my WiFi interface. Set that to what ever interface your network comes in on.

table <badhosts> persist file "/etc/badguys1" file "/etc/badguys2"
block on en1 from <badhosts> to any

Now you can add temporary addresses to badguys1. (NOT badhosts, that's a name for the tables)

sudo pfctl -t badguys1 -T add 185.130.5.160

1 table created.
1/1 addresses added.

Although it says 1 table created - it actually adds the ip, not creating a new table. Now if you look in badguys1, you will see the new IP.

sudo pfctl -t badhosts -T show

Answer 3

I got this information from the website and forgive me for my ill knowledge of OpenBSD, but here it goes. Take a look at this URL. According to it, it states to block an IP you would:

echo '123.123.123.123' >> /etc/pf.blocked.ip.conf

Then you would restart the firewall:

pfctl -d
pfctl -e -f /etc/pf.conf

Or, to add without restarting the firewall type:

pfctl -t blockedips -T add 111.222.333.444

Now to check if it has been added type:

pfctl -t blockedips -T show

Update: Maybe this would help.

• Open the following file in vi:

  vi /etc/pf.conf

• Add the following line of code:

  table <blockedips> persist file "/etc/pf.blocked.ip.conf" ext_if="bge0" # interface connected to internet

• After that point, I would try restarting the firewall and confirming that the IP is blocked by typing:

  pfctl -d
  pfctl -e -f /etc/pf.conf
  pfctl -t blockedips -T show