2

My /etc/rc.firewall file contains the following additional lines created by me, with the purpose of banning attacker's DDoSers IPs:

${fwcmd} add deny ip from 122.228.19.80/24,\
                          185.234.219.65/24,\
                          92.118.38.57/24,\
                          185.36.81.143/24,\
                          141.98.10.137/24,\
                          45.125.66.144/24,\
                          185.100.87.190/24,\
                          45.142.195.6/24,\
                          45.143.223.52/24,\
                          103.7.10.131/24,\
                          52.178.192.68/24,\
                          80.82.77.33/24,\
                          164.68.112.178/24,\
                          81.95.5.34/24 to any

The list dramatically grows each week. How may I create a text file so that ipfw would fetch these IPs from there directly? What's the simplest way to do this?

P.S: I found no reason to hide/mask those IPs above, because they're truly and randomly filling log files, not regular users at all! It'd be useful for anyone else to know about them to block them too :)

OS: FreeBSD 12.1

2
  • Are you sure this is a good way to go? You are blocking entire subnets, not just single IPs. – Panki Feb 17 '20 at 14:42
  • My server is not really a production unit, publicity of it is pretty low. And also, /24 wouldn't hurt me/my case, just the last 0-254 ones. A single IP of them has at least ..*.1-196 range! – Andreas Feb 17 '20 at 14:44
2

Quick and dirty

All configuration of ipfw is done by issuing the command ipfw. In your case this is wrapped into ${fwcmd} and is a parameter substitution (see sh(0) paragraph Parameter Expansion). /etc/rc.firewall can then be treated as a sh shell script (with some additional helper functions).

It is then as simple as:

cat list.txt | xargs -I BANIP ${fwcmd} add deny ip from BANIP to any

The file list.txt is piped into xargs which contructs the command. list.txt should contain one IP address or subnet per line.

Example:

122.228.19.80
185.234.219.65
92.118.38.57/24
185.36.81.143/24

Be quiet

From your question we cannot see what ${fwcmd} expands to. It might be as simple as ipfw. For use in a script it is a good idea to use ipfw -q (see ipfw(8)) to make it more robust. It will create a table for you when adding and gracefully handle adding the same address twice.

Tables

Adding a whole bunch of deny rules as above is a little messy. It will be much cleaner if you put them into a table and then base the rule on the table.

First we create the table #1 and populate it:

ipfw -q table 1 add 122.228.19.80
ipfw -q table 1 add 185.234.219.65
ipfw -q table 1 add 92.118.38.57/24
ipfw -q table 1 add 185.36.81.143/24

Then we use the table in our rule:

ipfw add deny ip from 'table(1)' to any

We then use the same list.txt as before. We can then flush and reload the table on the go:

ipfw table 1 flush
cat list.txt | xargs ipfw -q table 1 add

The above can be executed on the command line while playing around.

And in context of your configuration script it would be something like:

cat list.txt | xargs ${fwcmd} table 1 add
${fwcmd} add deny ip from 'table(1)' to any

The 'ticks' around table(1) is to ensure the shell does not try to interpret () in any way. You could choose to escape them as well. Same result but is a little harder for a human to read.

${fwcmd} add deny ip from table\(1\) to any

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.