iblock is an inetd program adding the client IP to a Packet Filter table. It is meant to be used to block scanner connecting on unused ports.

Go to file

prx 461451d717 Make use of doas mandatory to avoid running iblock as root.		2021-03-20 11:42:00 +01:00
LICENSE	Update license file	2021-02-25 20:43:52 +01:00
Makefile	Add IPv6 support + many others improvements. Patch from prx@ybad.name	2021-03-10 22:34:50 +01:00
README.md	Make use of doas mandatory to avoid running iblock as root.	2021-03-20 11:42:00 +01:00
main.c	Make use of doas mandatory to avoid running iblock as root.	2021-03-20 11:42:00 +01:00

README.md

iblock

iblock is an inetd program adding the client IP to a Packet Filter table.

It is meant to be used to block scanner connecting on unused ports.

How to use

Add a dedicated user

useradd -s /sbin/nologin _iblock

Configure doas

Add in /etc/doas.conf:

permit nopass _iblock cmd /sbin/pfctl

Configure inetd

Start inetd service with this in /etc/inetd.conf:

666 stream tcp nowait _iblock /usr/local/bin/iblock iblock
666 stream tcp6 nowait _iblock /usr/local/bin/iblock iblock

You can change the PF table by adding it as a parameter like this:

666 stream tcp nowait root /usr/local/bin/iblock iblock blocklist
666 stream tcp6 nowait root /usr/local/bin/iblock iblock blocklist

Configure packet filter

Use this in /etc/pf.conf, choose which ports will trigger the ban from the variable:

# services triggering a block
blocking_tcp="{ 21 23 53 111 135 137:139 445 1433 25565 5432 3389 3306 27019 }"

table <blocked> persist

block in quick from <blocked> label iblock
pass in quick on egress inet proto tcp to port $blocking_tcp rdr-to 127.0.0.1 port 666
pass in quick on egress inet6 proto tcp to port $blocking_tcp rdr-to ::1 port 666

Don't forget to reload the rules with pfctl -f /etc/pf.conf.

Get some statistics

Done! You can see IP banned using pfctl -t blocked -T show and iBlock will send blocked addresses to syslog.

In the example I added a label to the block rule, you can use pfctl -s labels to view statistics from this rule, see documentation for column meaning.

TODO

make install doing something
A proper man page