Access control using Fail2Ban and geoip - Revision history

Admin: /* Preface */

2017-06-13T10:33:25Z

Preface

← Older revision		Revision as of 12:33, 13 June 2017
Line 2:		Line 2:
	= Preface =		= Preface =

	This 'guide' explains how to make Debian ~~block (silently drop) DNS requests using~~ [http://wiki.debian.org/iptables iptables] to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)		This 'guide' explains how to make Debian [http://wiki.debian.org/iptables iptables] block (silently drop) DNS requests to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)

	This [https://www.fail2ban.org Fail2ban] configuration can raise an effective [https://en.wikipedia.org/wiki/Geo-fence Geo-Fence] for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)		This [https://www.fail2ban.org Fail2ban] configuration can raise an effective [https://en.wikipedia.org/wiki/Geo-fence Geo-Fence] for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)

Admin: /* Fail2Ban */

2017-06-13T09:14:33Z

Fail2Ban

← Older revision		Revision as of 11:14, 13 June 2017
Line 24:		Line 24:
	<blockquote>		<blockquote>
	==== dnsmasq ====		==== dnsmasq ====
			----

	The configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' found in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-geoip-fence.conf''. If you dont want to totally block dns requests from countries not included in the 'country_list', you can use the regular expression that will filter all 'query[ANY]' requests. it is configured in the file ''/etc/fail2ban/filter.d/pihole-geoip.conf''		The configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' found in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-geoip-fence.conf''. If you dont want to totally block dns requests from countries not included in the 'country_list', you can use the regular expression that will filter all 'query[ANY]' requests. it is configured in the file ''/etc/fail2ban/filter.d/pihole-geoip.conf''
Line 197:		Line 198:
	<blockquote>		<blockquote>
	==== lighttpd ====		==== lighttpd ====
			----

	This configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' located in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-adminweb-geoip-fence.conf'' '''if''' they try to access ''http://[your.domain]/admin'' and subfolders.		This configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' located in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-adminweb-geoip-fence.conf'' '''if''' they try to access ''http://[your.domain]/admin'' and subfolders.

Admin: /* Fail2Ban */

2017-06-13T09:13:28Z

Fail2Ban

← Older revision		Revision as of 11:13, 13 June 2017
Line 20:		Line 20:
	== Fail2Ban ==		== Fail2Ban ==

	I assume [https://www.fail2ban.org Fail2ban] is already installed and ~~configured~~.		I assume [https://www.fail2ban.org Fail2ban] is already installed and running.

	<blockquote>		<blockquote>

Admin at 09:12, 13 June 2017

2017-06-13T09:12:48Z

← Older revision		Revision as of 11:12, 13 June 2017
Line 1:		Line 1:
	[[Category:Debian]][[Category:DNS]][[Category:RaspBerry Pi]][[Category:Pi-Hole]][[File:ANY_flooding_smack_down.PNG\|350px\|thumb\|right\|A flood of [ANY] queries started around 4 am. Configuration and tuning of Fail2Ban started around 8 am and was effectively banning DNS queries from ip's outside Denmark at 10 am. ]]		[[Category:Debian]][[Category:DNS]][[Category:RaspBerry Pi]][[Category:Pi-Hole]][[File:ANY_flooding_smack_down.PNG\|350px\|thumb\|right\|A flood of [ANY] queries started around 4 am. Configuration and tuning of Fail2Ban started around 8 am and was effectively banning DNS queries from ip's outside Denmark at 10 am. ]]
	== Preface ==		= Preface =

	This 'guide' explains how to make Debian block (silently drop) DNS requests using [http://wiki.debian.org/iptables iptables] to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)		This 'guide' explains how to make Debian block (silently drop) DNS requests using [http://wiki.debian.org/iptables iptables] to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)
Line 6:		Line 6:
	This [https://www.fail2ban.org Fail2ban] configuration can raise an effective [https://en.wikipedia.org/wiki/Geo-fence Geo-Fence] for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)		This [https://www.fail2ban.org Fail2ban] configuration can raise an effective [https://en.wikipedia.org/wiki/Geo-fence Geo-Fence] for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)

	=== Geolookup ===		== Geolookup ==

	In order to do a geolookup from the command line, we have to get the GeoIP binary and database installed.		In order to do a geolookup from the command line, we have to get the GeoIP binary and database installed.
Line 18:		Line 18:
	</blockquote>		</blockquote>

	=== Fail2Ban ===		== Fail2Ban ==

	I assume [https://www.fail2ban.org Fail2ban] is already installed and configured.		I assume [https://www.fail2ban.org Fail2ban] is already installed and configured.

Admin: /* Preface */

2017-06-13T09:11:39Z

Preface

← Older revision		Revision as of 11:11, 13 June 2017
Line 4:		Line 4:
	This 'guide' explains how to make Debian block (silently drop) DNS requests using [http://wiki.debian.org/iptables iptables] to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)		This 'guide' explains how to make Debian block (silently drop) DNS requests using [http://wiki.debian.org/iptables iptables] to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)

	This [https://www.fail2ban.org Fail2ban] configuration can raise an effective ~~GeoIP~~ fence for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)		This [https://www.fail2ban.org Fail2ban] configuration can raise an effective [https://en.wikipedia.org/wiki/Geo-fence Geo-Fence] for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)

	=== Geolookup ===		=== Geolookup ===

Admin: /* Fail2Ban */

2017-06-13T09:08:20Z

Fail2Ban

← Older revision		Revision as of 11:08, 13 June 2017
Line 23:		Line 23:

	<blockquote>		<blockquote>
	==== ~~DNS GeoIP Fence~~ ====		==== dnsmasq ====

	The configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' found in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-geoip-fence.conf''. If you dont want to totally block dns requests from countries not included in the 'country_list', you can use the regular expression that will filter all 'query[ANY]' requests. it is configured in the file ''/etc/fail2ban/filter.d/pihole-geoip.conf''		The configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' found in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-geoip-fence.conf''. If you dont want to totally block dns requests from countries not included in the 'country_list', you can use the regular expression that will filter all 'query[ANY]' requests. it is configured in the file ''/etc/fail2ban/filter.d/pihole-geoip.conf''
Line 196:		Line 196:

	<blockquote>		<blockquote>
	==== ~~Lighttpd GeoIP Fence~~ ====		==== lighttpd ====

	This configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' located in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-adminweb-geoip-fence.conf'' '''if''' they try to access ''http://[your.domain]/admin'' and subfolders.		This configuration will ban ip adresses from countries that <u>is not</u> included in the ''country_list'' located in the ''[init]'' section of the file ''/etc/fail2ban/action.d/iptables-pihole-adminweb-geoip-fence.conf'' '''if''' they try to access ''http://[your.domain]/admin'' and subfolders.

Admin at 09:04, 13 June 2017

2017-06-13T09:04:36Z

← Older revision		Revision as of 11:04, 13 June 2017
Line 182:		Line 182:
	Hopefully it restarts without any errors... if you get errors in ''/var/log/fail2ban.log'' try to dum the config using the command <code>fail2ban-client -d</code> and hunt the bugs using this info.		Hopefully it restarts without any errors... if you get errors in ''/var/log/fail2ban.log'' try to dum the config using the command <code>fail2ban-client -d</code> and hunt the bugs using this info.

	~~=====~~ Files ~~=====~~		'''Files'''

	This is the file/folder structure for Fail2Ban. I edited/created the files marked with an §		This is the file/folder structure for Fail2Ban. I edited/created the files marked with an §

Admin: /* Files */

2017-06-13T09:04:02Z

Files

← Older revision		Revision as of 11:04, 13 June 2017
Line 356:		Line 356:
	Hopefully it restarts without any errors... if you get errors in ''/var/log/fail2ban.log'' try to dum the config using the command <code>fail2ban-client -d</code> and hunt the bugs using this info.		Hopefully it restarts without any errors... if you get errors in ''/var/log/fail2ban.log'' try to dum the config using the command <code>fail2ban-client -d</code> and hunt the bugs using this info.

	~~=====~~ Files ~~=====~~		'''Files'''

	This is the file/folder structure for Fail2Ban. I edited/created the files marked with an §		This is the file/folder structure for Fail2Ban. I edited/created the files marked with an §

Admin: /* Preface */

2017-06-13T08:54:54Z

Preface

← Older revision		Revision as of 10:54, 13 June 2017
Line 2:		Line 2:
	== Preface ==		== Preface ==

	This 'guide' explains how to block (silently drop) DNS requests using [http://wiki.debian.org/iptables iptables] to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)		This 'guide' explains how to make Debian block (silently drop) DNS requests using [http://wiki.debian.org/iptables iptables] to my [[See my Pi-Hole\| Pi-Hole]] from anywhere in the world but Denmark. Of course you can change that so another country is allowed... or even a selection of countries ;-)

	This [https://www.fail2ban.org Fail2ban] configuration can raise an effective GeoIP fence for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)		This [https://www.fail2ban.org Fail2ban] configuration can raise an effective GeoIP fence for other server services, if configuration of the regular expression, the ports and logfile location is done properly ;-)

Admin: /* Lighttpd GeoIP Fence */

2017-06-13T08:07:56Z

Lighttpd GeoIP Fence

← Older revision		Revision as of 10:07, 13 June 2017
Line 213:		Line 213:
	[Definition]		[Definition]

	# This ~~wil~~ filter all requests for /admin* in lighttpd.log		# This will filter all GET and HEAD requests for /admin* in lighttpd.log
	# Example line: 1496389170\|37.97.47.94\|cloud.pulspc.dk\|GET /admin/api.php?overTimeData10mins HTTP/1.1\|200\|4901		# Example line: 1496389170\|123.123.123.123\|cloud.pulspc.dk\|GET /admin/api.php?overTimeData10mins HTTP/1.1\|200\|4901
	#		#
	failregex = ^\\|<HOST>\\|.\\|GET \/admin.		failregex = ^\\|<HOST>\\|.\\|GET \/admin.
			^\\|<HOST>\\|.\\|HEAD \/admin.

			# This will filter all GET and HEAD requests for all GET requests
			#
			#failregex = ^\\|<HOST>\\|.\\|GET.
			#failregex = ^\\|<HOST>\\|.\\|HEAD.

	#		#