How to block ip list

[j0k4b0]

Hi,

I got a lot of SSH, FTP, HTTP auth-spam from china, russia,... ips, I want to block them all.

There are some IP-Lists like that: http://www.ipdeny.com/ipblocks/data/countries/cn.zone

I wrote a script which put all the IPs in my cluster.fw file, which worked very well.

But now every firewall-call from the proxmox-backend is very slow becuase there are more then 20.000 lines for blocked IPs.

Is there any other way to block traffic which is not from EU and USA? Or any way to save the ips in a external file?

Thanks for your help!

 

[guletz]

Do not use any firewall/iptables for this. For huge IP lists, use some routing like a null route, like this:

for line01 in $(cat your-blocking-ip-list.cdir); do

 /sbin/ip route add blackhole "$line01" ;
 
done

Or you can read a old tutorial of mine(use google translate) : http://forum.ubuntu.ro/viewtopic.php?id=23082

The ideea is that the routing table is faster compared with iptables, and it have a cache(iptables do not have a cache). Is not perfect, because this black-list IPs will reach your host, but they din not ever get a response. It would be better if you can use a linux-gateway, who can run this null routes, and Proxmox host will be behind this inux-gateway. In this case your Proxmox host will never be reachable by this black-list IPs.

 

[jim.bond.9862]

why not setup a firewall like pfSense and use that for blocking?
if this is such a big issue a dedicated firewall between outside and inside networks is a MUST.

 

[guletz]

why not setup a firewall like pfSense and use that for blocking?
if this is such a big issue a dedicated firewall between outside and inside networks is a MUST.

Any firewall (even it is X) must read each roule one by one for each new connection. This is a big problem if your X firewall have 20.000 rules like the intiator of this post. In such cases only routing can help you. And a firewall is very static in most of the cases. Routing is dynamic(think at ospfd).
If you have a proxmox cluster, and you want to use a virtual router like pfSense(or whatever X ) ... is a bad decision if you ask me. A good ideea is to use a tool like ospf on any node and to redistribute null routes to all nodes(write once and use on any node - this can not do it any firewall). So no firewall need for this and the performance is much better compared with any firewall solution.
And also think how your dream firewall will be when you will have millions of new connection?

 

[jim.bond.9862]

Any firewall (even it is X) must read each roule one by one for each new connection. This is a big problem if your X firewall have 20.000 rules like the intiator of this post. In such cases only routing can help you. And a firewall is very static in most of the cases. Routing is dynamic(think at ospfd).
If you have a proxmox cluster, and you want to use a virtual router like pfSense(or whatever X ) ... is a bad decision if you ask me. A good ideea is to use a tool like ospf on any node and to redistribute null routes to all nodes(write once and use on any node - this can not do it any firewall). So no firewall need for this and the performance is much better compared with any firewall solution.
And also think how your dream firewall will be when you will have millions of new connection?

This is not true.
read the OP. he has a lot of incoming traffic that he wants to block. this is what a firewall does, protects your network from intruders.

do you think you are smarter than a thousands IT departments around the world, who use firewalls to do the hard work for them?

if OP posters network is home network,and especially if it is a business network, he needs a good firewall router before anything hits the local network, not after. exposing cluster to the outside is stupid. proper setup of any network is
ISP(WAN) ==> ISP modem/router (if needed) ==>firewall/router ==> Switch ==> local network
he does not need to block on IP bases, whe can block per IP range/country/domain basis too.

 

[guletz]

do you think you are smarter than a thousands IT departments around the world, who use firewalls to do the hard work for them?

No. Read again what I wrote. I do not say to not use a firewall. I say only that when you need to block 20.000 IPs or Ip classes, the best option is to have a null route for them. By the way, many IT departments use this. Is not my smart Ideea or my invention.
Try to use both solution and then compare the results (network latency, cpu usage, memory). Then use what is the best. Try to ask yourself if you have a huge flood for example from a single IP, your X firewall can save you? Or maybe a null route?

 

[jim.bond.9862]

I have no problems with a null route, I just saying that it should be setup and configured on a firewall machine rather than directly on the cluster. you should not have anything on local network connected directly to internet.

 

[Jarek]

With route blackholing only outgoing packets (from VM to blocked IP) are affected, so you will stay with many half-opened tcp session until they get tcp timeout.

 

[guletz]

With route blackholing only outgoing packets (from VM to blocked IP) are affected, so you will stay with many half-opened tcp session until they get tcp timeout.

Yes. I said about this problem. But is better then nothing. For sure the better solution is to have an upsteam firewall/gateway who can deal with this. From the initiator of this post I do not understand 100% where he want to use this huge block lists.

 

[j0k4b0]

Hi,

thanks for your answers!

I have orderd an extra server and installes pfSense. I think this is the right way to handle my traffic.

Now I have a problem while setting up the stuff.

As you can see in the screenshot I attached, there is a NAT-Firewall.
My local network has the ip-network 192.168.0.1/24


Now I want to give my VM in proxmox an local address (eg. 192.168.0.5).
In the first step only one vm should have a local ip and must still available via the public ip.

Before I can give my VM an local ip, I have to setup my proxmox host. This is my question. How can I setup my host to work with both networks? My public and my local? Below you can see my current host setup.

I only have one network-card in my dedicated server. Is it possible to use both ip-networks via one network-card? If yes, how to setup the stuff?

 

[jim.bond.9862]

This is my question. How can I setup my host to work with both networks? My public and my local?

well first of all you don't.

the proper setup would be :

1. your pfSense machine will have 2 network interfaces. i.e. eth0 , eth1
lets say you decide to dedicate eth0 as WAN and eth1 as LAN


your WAN line (the line from your ISP connected to the ISP provided modem) would go into your pfSense machine. eth0 interface.
now pfSense can act as your firewall and Router, providing DNS and DHCP all together. if you plugin the eth1(LAN) into a switch it will act as ar full function router. in essence your pfsense machine will be your gateway to the outside.

everything else, including your proxmox host(s) will work with in LAN domain that is your (192.168.0.0/24) network

in proxmox simply setup a bridge pointing to your pfSense as a gateway/dns and connect all your VMs to that bridge
if you want DHCP it will be provided by pfSense. if you want static just use IP outside of your DHCP range.

 

[bofh]

well first of all you don't.

the proper setup would be :

1. your pfSense machine will have 2 network interfaces. i.e. eth0 , eth1
lets say you decide to dedicate eth0 as WAN and eth1 as LAN

Well no.
This is only one possibilits, PF sense will then be no router but will NAT and Masquerade the traffic.

There 3 Basic options to configure a seperate Firewall, however you could have done this with a VM too that makes it 4)

Option one - Virtual only
You setup another bridge (vmbr1 for example) and put all regular vms on this ip range
you use vmbr0 only for your pfsense wmhost
pfsense has a second nic on vmbr1

define vmbr0 as wan abd br1 as lan
voila all vms have now to go trough pfsense

however you still need to convince promox to live on br1 too
not shure if possible, i just play with promox for a very short time now

Now about very basic hardware pfsense setup

you have 3 choices

- masquerade / portforward
- masquerade / nat
- routed

the first 2 are with lan and wan, mainly having a private iprange in at your server
has advantages but also major drawbacks.

at the forward option your vms wont have public ips
so vor every vm you wanna reach from outside you need to create a nat/or portforward on pf sense and point it to your private vm ip
this sounds not so bad - well it get messy quick and you drown in rules
also private ips are now a criticla factor on vm side.

at nat you will have kinda external ips but your voms wont know that.
get messy quick with ssl and dns (you will have to run split dns and stuff and even then it can get messy)



3rd one routed
thats the best option for vms that serve the big old dump we call internet
if your provider gives you a subnet to your ip then its super easy
wan interface gets primary ip
"LAN" Interface will be the dedicaded subnet you recieved
every vm can have their public ips without any nat


in all cases you can set your firewall rules
however be aware

pfsense is for beginners counter intuitve (and in that regard a PIA)
it requires friendly rules because every interface is considered incomming


that means you cannot define a rule to deny certain traffic into a subnet
for exmaple you cant say no port 80 ON LAN interface
you must set no port 80 TO LAN interface ON WAN interface

so every restrictions you do in the lan interface means lan cannot do rule a-x
and yes this can get messy quick on a bigger wall (and headaches)

however there also floating rules but they apply to all interfaces same time
so floating rule no port 80 to ip x means no interface can commincate with that ip on port 80
this is good for some rules but not all, also they aply always first



alternative solution:
on a single promox server
iptable all incomming traffic to no thanks
setup an openvpn server to login
to your promox over openvpn


honestly never let a interface like promox open in the net. hypervisors shoudl always drop all incomming except maybe an deicaded vpn
if you have someting like rescue service at your hosters site, dont even open ssh in the open.
nothing but pure openvpn (individucal certs, tls key, hmac and so on the full program)

only serving the net vms get a whole in your hypervisor firewall nobody else
at the end for one hpv pf sense as an external solution wont make much sense (but at least neat openvpn server on it )

 

[bofh]

Hi,

But now every firewall-call from the proxmox-backend is very slow becuase there are more then 20.000 lines for blocked IPs.
is there any other way to block traffic which is not from EU and USA? Or any way to save the ips in a external file?

one more thing, called geoip - you will lvoe it
you wont block ips, but regions. much faster less headache for your cpu

however again id recommend block all traffic always for admin things (every not serving a purpose port is a nono)
only if a port is really needed to be shared it should be open

admin ports (like ssh, promox, etc) are never needed outside.
instead use an vpn tunnel, always use an vpn tunnel, only use an vpn tunnel
no exceptions
theres never a need to be open with anything other than real serving services