Hi everyone,
Due to the number of people who have requested my add-blocking scripts,
I figured I would also post them to @misc so anyone can easily enjoy
network-wide bad-host/add-blocking.
I won't go into detail on how to set up routing/dhcp/unbound/anchors
etc, for that see: https://www.openbsd.org/faq/pf/example1.html
I've included some example files from my an Edgerouter I have set up .
They are trimmed down for brevities sake; the conf files are not
production ready, these are merely examples.
This setup is easily customizable, if you come across any other block
lists you prefer, then they can be dropped in no problem. I chose to use
solely the StevenBlack hosts file because it is a master list compiled
from all the major banlists found in popular blocking products such as
uBlock Origin, Addblock Plus et al. I also chose this file because it is
filtered for duplicates as unbound(8) is said to struggle when there are
redundancies in the blocklists, I'm told -- though I've never had any issue.
You're going to have to read the scripts and create the directories the
scripts are calling and edit the anchor macros to fit your interface
layout (I doubt everyone here is running cnmac0 as egress) and also will
have to make the scripts executable and set them to run at regular
intervals with crontab, ideally nightly.
I didn't make these scripts intelligent because I figured it was simpler
to just run mkdir once rather than add extra lines to the script.
I know the pf.conf is fairly long, I thought I would show an example of
my prio and queing setup as an example, or conversely to see if anyone
can poke any holes in it.
All the relevant bits regarding the anchors and blocklists are found at
the end of the pf.conf file. See below that for the anchor conf files
we're calling as well.
Hope this helps,
Jordan Geoghegan
First, the scripts:
*DNS addblock script:*
StevenBlack.sh:
cd /var/unbound/etc/banlist && \
ftp https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts && \
cat hosts | grep '^0\.0\.0\.0' | awk '{print "local-zone: \""$2"\" redirect\nlocal-data:
\""$2" A 0.0.0.0\""}' > ads.conf
rcctl reload unbound
###
*IP based malicious IP blocking:*
banlist.sh:
cd /etc/blocklist && ftp https://www.binarydefense.com/banlist.txt\
&& ftp https://rules.emergingthreats.net/blockrules/compromised-ips.txt\
&& ftp https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt\
&& ftp
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset\
&& pfctl -a banlist -f /etc/banlist.conf
###
As you can see, we are going to have to make an anchor in pf called
'banlist' and modify the unbound.conf to load our banlist 'ads.conf'
If that's all you need, then you're pretty much good to go. If you would
like to see my example conf files, see below.
*
Example unbound.conf:*
# $OpenBSD: unbound.conf,v 1.7 2016/03/30 01:41:25 sthen Exp $
server:
interface: 172.17.17.1
interface: 127.0.0.1
access-control: 172.17.17.0/24 allow
access-control: 172.17.0.0/24 allow
do-not-query-localhost: no
hide-identity: yes
hide-version: yes
include: /var/unbound/etc/banlist/ads.conf
forward-zone:
name: "."
forward-addr: UR.DNS.GO.HERE
forward-addr: UR.DNS.GO.HERE
###
*Example pf.conf:*
# $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
#
ext_if="{ cnmac0 }"
int_if="{ cnmac1 cnmac2 }"
lan_if="{ cnmac1 }"
wifi_if="{ cnmac2 }"
goodguys="{ 172.17.17.0/24 }"
wifiguys="{ 172.17.0.0/24 }"
chromecast="{ 172.17.0.12 172.17.0.13 172.17.0.23 }"
xbox360="{ 172.17.0.19 }"
printer="{ 172.17.0.17 }"
Jordan="{ XXX.XX.XXX.XX }"
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 }
# Queue List [ Download ]
queue download on cnmac2 bandwidth 70M max 70M
queue media-down parent download bandwidth 20M min 5M max 20M burst 24M for
200ms
queue xbox-down parent media-down bandwidth 4M max 4M burst 8M for 200ms
queue chrome-down parent media-down bandwidth 16M max 16M burst 20M for 225ms
queue std-down parent download bandwidth 50M min 5M max 50M burst 70M for 500ms
default
set block-policy drop
set loginterface egress
set skip on lo0
match in all scrub (no-df random-id max-mss 1440)
match out on egress inet from !(egress:network) to any nat-to (egress:0)
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block quick inet6
block all
# A bit of edgy prio and bandwidth queuing, I felt like taking pf out for a
test drive here
pass in on $lan_if from $goodguys tag LAN set prio 6
pass in on $wifi_if from $wifiguys tag WIFI modulate state set queue std-down
pass in on $wifi_if from $chromecast tag CHROME modulate state set prio 2 \
set queue chrome-down
block out on $lan_if tagged WIFI
block out on $lan_if tagged CHROME
antispoof for { egress cnmac0 cnmac1 cnmac2 lo0 }
pass in quick on $ext_if from $Jordan to any tag Jordan
block in on $ext_if proto { tcp udp } from any to any port ssh ! tagged Jordan
pass out on $ext_if inet
# Printers Ruleset | Block Printer on Egress && allow $goodguys subnet
block out on $ext_if from $printer to any
pass out quick on $wifi_if from $goodguys to $printer
# Spammers
anchor banlist
load anchor banlist from "/etc/banlist.conf"
# DNS Redirect
anchor dns
load anchor dns from "/etc/dns-redirect.conf"
###
*Anchor banlist.conf:*
# $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $
#
## Spammers ##
table <banlist> persist file "/etc/blocklist/banlist.txt"\
file "/etc/blocklist/compromised-ips.txt"\
file "/etc/blocklist/emerging-Block-IPs.txt"\
file "/etc/blocklist/firehol_level3.netset"
block in on egress from <banlist> to any
block out log on egress from any to <banlists>
####
*Anchor dns-redirect.conf:***
# $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $
#
wifi_lan="{ cnmac2 }"
# DNS Redirect
pass in on $wifi_lan proto { tcp udp } from any to \
{ 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 209.244.0.3 } port 53 \
tag google rdr-to 172.17.17.1
# I added this because several devices were aggressively pinging 8.8.8.8 on my
network and it was annoying me
pass in on $wifi_lan from any to \
{ 8.8.8.8 8.8.4.4 } \
tag google rdr-to 172.17.17.1
