On Mon, 09 Dec 2002 17:52:01 +0000 Antony Riley <[EMAIL PROTECTED]> wrote:
> > Write a script which does the following: > > 1) download the list of IP's from dshield.org > 2) Use an awk (or sed, or perl) script to turn them into valid ipfilter > syntax. Well here is a stab at 1 and 2: wget -q -O - http://feeds.dshield.org/top10-2.txt | awk ' BEGIN { if (ENVIRON["INTERFACE"]) { INT= "on " ENVIRON["INTERFACE"]}} { print "block in quick",INT, "from ", $1 "/32 to any"}' no interface set in the env: block in quick from 172.163.101.234/32 to any block in quick from 194.203.13.178/32 to any block in quick from 216.12.23.131/32 to any block in quick from 80.56.71.232/32 to any block in quick from 202.30.198.96/32 to any block in quick from 211.100.8.173/32 to any block in quick from 166.114.91.98/32 to any block in quick from 202.96.125.119/32 to any block in quick from 148.243.170.135/32 to any block in quick from 80.129.249.26/32 to any with interface set in the env: block in quick on bobo7 from 172.163.101.234/32 to any block in quick on bobo7 from 194.203.13.178/32 to any block in quick on bobo7 from 216.12.23.131/32 to any block in quick on bobo7 from 80.56.71.232/32 to any block in quick on bobo7 from 202.30.198.96/32 to any block in quick on bobo7 from 211.100.8.173/32 to any block in quick on bobo7 from 166.114.91.98/32 to any block in quick on bobo7 from 202.96.125.119/32 to any block in quick on bobo7 from 148.243.170.135/32 to any block in quick on bobo7 from 80.129.249.26/32 to any Feel free to use it under the terms of the new bsd licence. marc > 3) Clear the inactive rule set > 4) Add them to the inactive rule set. > 5) Add /etc/ipf.rules to the inactive rule set. > 6) Swap over the rulesets. > > You could maybe add a few things to make it a bit prettier, such as extracting > the match count for each dshield.org based rule, coupled with some nice > gnuplot graphs ;) > > Send me the script when you're interested, I'd be interested to see it, or > mail the list, I'm fairly sure I wouldn't be the only interested party. > > -Antony > > On Monday 09 December 2002 17:01, Tillman wrote: > > Howdy, > > > > I'd like to automate the use of the dshield.org feeds > > (http://feeds.dshield.org/top10-2.txt specifically) to block the traffic > > at my IPF border firewalls. Howwever, I don't want to interfere with my > > existing pre-existing /etc/ipf.rules. I'm also running ipnat. > > > > My challenge is to insert the dshielf.org IP blocklist near the top of > > the rule list, daily, without affecting the rest of my ruleset. > > Obviously I'd like to avoid solutions that modify /etc/ipf.rules > > in-place :-) > > > > Is there a way to specific an "include" file in the IPF config file? Are > > there any scripts to perform this sort of task that folks are willing to > > share? Are there any pitfalls to avoid (such as accidently flushing the > > NAT or state tables)? > > > > TIA, > > > > - Tillman > > ************************************************************************* > This e-mail and any attachments may contain confidential or privileged > information. If you are not the intended recipient, please contact the > sender immediately and do not use, store or disclose their contents. > Any views expressed are those of the individual sender and not of Kinetic > Information System Services Limited unless otherwise stated. > > www.kinetic.co.uk > >
