Write a script which does the following: 1) download the list of IP's from dshield.org 2) Use an awk (or sed, or perl) script to turn them into valid ipfilter syntax. 3) Clear the inactive rule set 4) Add them to the inactive rule set. 5) Add /etc/ipf.rules to the inactive rule set. 6) Swap over the rulesets.
You could maybe add a few things to make it a bit prettier, such as extracting the match count for each dshield.org based rule, coupled with some nice gnuplot graphs ;) Send me the script when you're interested, I'd be interested to see it, or mail the list, I'm fairly sure I wouldn't be the only interested party. -Antony On Monday 09 December 2002 17:01, Tillman wrote: > Howdy, > > I'd like to automate the use of the dshield.org feeds > (http://feeds.dshield.org/top10-2.txt specifically) to block the traffic > at my IPF border firewalls. Howwever, I don't want to interfere with my > existing pre-existing /etc/ipf.rules. I'm also running ipnat. > > My challenge is to insert the dshielf.org IP blocklist near the top of > the rule list, daily, without affecting the rest of my ruleset. > Obviously I'd like to avoid solutions that modify /etc/ipf.rules > in-place :-) > > Is there a way to specific an "include" file in the IPF config file? Are > there any scripts to perform this sort of task that folks are willing to > share? Are there any pitfalls to avoid (such as accidently flushing the > NAT or state tables)? > > TIA, > > - Tillman ************************************************************************* This e-mail and any attachments may contain confidential or privileged information. If you are not the intended recipient, please contact the sender immediately and do not use, store or disclose their contents. Any views expressed are those of the individual sender and not of Kinetic Information System Services Limited unless otherwise stated. www.kinetic.co.uk
