StopForumSpam.com -> iptables

Tips and Tricks for Networking

Moderator: jkerr82508

User avatar
Snorkasaurus
Berserk
Posts: 586
Joined: 30 Dec 2013, 19:19
Contact:

StopForumSpam.com -> iptables

Postby Snorkasaurus » 20 Mar 2014, 05:37

In a recent post here viking60 mentioned SFS and I decided to go have a look at it. I found this post in their forums which shows how to automagically download their list and block spammers using .htaccess files, but as someone points out in the thread, .htaccess is a slow and resource intensive way to do that. Not too long ago I started playing with ipset (and iptables) to block large lists of IP's and ranges - and thought that it might work well for SFS too. Here's what I came up with...

Start with the dependencies:

Code: Select all

apt-get install zip unzip ipset

Then add this to your existing iptables firewall script:

Code: Select all

ipset create sfs_block hash:net
iptables -I FORWARD -p tcp --dport 80:443 -m set --match-set sfs_block src -j DROP

Then a script that updates the ipset:

Code: Select all

ipset destroy tempset
ipset create tempset hash:net
cd /tmp
wget -N http://www.stopforumspam.com/downloads/listed_ip_7.zip
unzip listed_ip_7.zip
sed 's:^:add tempset :' listed_ip_7.txt > listed_ip_7_importfile.txt
ipset restore < listed_ip_7_importfile.txt
rm listed_ip_7_importfile.txt
ipset swap tempset sfs_block


The script can just be cron'ed daily to keep it reasonably updated... hopefully someone will find that helpful. :-)

NOTE: I selected a number of IP's from the list and whois'ed them to see what I would find. Some of them were hosting providers (infected webapps and plugins no doubt) so I would suggest not blocking them from legitimate services that may be running in a hosted environment (like SMTP for example).

S.

User avatar
viking60
Über-Berserk
Posts: 8958
Joined: 14 Mar 2010, 16:34

Re: StopForumSpam.com -> iptables

Postby viking60 » 20 Mar 2014, 14:29

Great stuff :s I did not know that I could download the "hall of shame" aka listed_ip_7.zip
Keep it coming.
checking it out now...

O yes that works just fine :B
Here is what I did.
I installed ipset
and tried to check things out with

Code: Select all

ipset list
At this point I got an unknown command error so I remembered that I probably would have to do it as root

Code: Select all

sudo ipset list

Which worked and pretty much had nothing to show. So we need to be root for these operations.
Then I used your tip to create my own/your list and called it sfs_block - as you did.
I made a file which I called sfsblock.sh and put your script in there and chmoded it

Code: Select all

sudo chmod +x+r sfsblock.sh

and ran it like this

Code: Select all

sudo ./sfsblock.sh

That went through so time to check the result again:

Code: Select all

sudo ipset list

and the result:
:A

Code: Select all

Name: sfs_block
Type: hash:net
Header: family inet hashsize 16384 maxelem 65536
Size in memory: 878232
References: 1
Members:
223.82.149.209
178.33.35.224
23.94.19.175
175.44.5.157
198.27.98.23
198.50.174.130
36.72.2.141
23.107.182.241
117.139.111.82
117.26.84.18
46.148.31.241
110.85.74.170
188.208.7.13
198.50.253.42
109.169.5.182
115.62.226.10
198.2.222.205
213.169.128.51
: and on and on and on it goes

:B
Just to make it less scary for others to try:
You can remove your list or set with

Code: Select all

sudo ipset destroy sfs_block
If you want to go back to square one.
Manjaro 64bit on the main box -Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz and nVidia Corporation GT200b [GeForce GTX 275] (rev a1. + Centos on the server - Arch on the laptop.
"There are no stupid questions - Only stupid answers!"

User avatar
Snorkasaurus
Berserk
Posts: 586
Joined: 30 Dec 2013, 19:19
Contact:

Re: StopForumSpam.com -> iptables

Postby Snorkasaurus » 20 Mar 2014, 14:55

viking60 wrote:I did not know that I could download the "hall of shame"

I found their downloads page which has a few different lists you can download. Some are updated hourly while others are daily... and a number of them have limits on how frequently you can download them. I also really like their "always going to be free" policy.

S.

User avatar
viking60
Über-Berserk
Posts: 8958
Joined: 14 Mar 2010, 16:34

Re: StopForumSpam.com -> iptables

Postby viking60 » 20 Mar 2014, 17:03

Yes I like their approach and I am also responsible for reporting some of the spammers listed there, I am proud to say.
This approach is somewhat drastic though - because it shuts out the IP from the server.
There can be lots and lots of decent people being shut out with that approach. But I must admit that I did cut of many Chinese IP's from my server back when we had the Chinese spam wave.

These days India is the main spamming sinner so I am really considering to discriminate IP ranges from them too.. :think:
Manjaro 64bit on the main box -Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz and nVidia Corporation GT200b [GeForce GTX 275] (rev a1. + Centos on the server - Arch on the laptop.
"There are no stupid questions - Only stupid answers!"

User avatar
Snorkasaurus
Berserk
Posts: 586
Joined: 30 Dec 2013, 19:19
Contact:

Re: StopForumSpam.com -> iptables

Postby Snorkasaurus » 20 Mar 2014, 18:17

viking60 wrote:and I am also responsible for reporting some of the spammers listed there, I am proud to say.

:berserkf

viking60 wrote:This approach is somewhat drastic though - because it shuts out the IP from the server.

Perhaps I am a little jaded and angry... I like the drastic approach. :-)

viking60 wrote:admit that I did cut of many Chinese IP's from my server back when we had the Chinese spam wave.
These days India is the main spamming sinner so I am really considering to discriminate IP ranges from them too.. :think:


Blocking entire countries is actually where my ipset adventure started, now I also have sets for "bad people", "misidentified Bingbot", and "hosted servers". I am a monster.

S.

User avatar
viking60
Über-Berserk
Posts: 8958
Joined: 14 Mar 2010, 16:34

Re: StopForumSpam.com -> iptables

Postby viking60 » 21 Mar 2014, 13:04

Spoken like a true berserk - so you got upgraded. :s
You will need to re-upload your avatar though - sorry about that :oops:
Manjaro 64bit on the main box -Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz and nVidia Corporation GT200b [GeForce GTX 275] (rev a1. + Centos on the server - Arch on the laptop.
"There are no stupid questions - Only stupid answers!"

User avatar
Snorkasaurus
Berserk
Posts: 586
Joined: 30 Dec 2013, 19:19
Contact:

Re: StopForumSpam.com -> iptables

Postby Snorkasaurus » 21 Mar 2014, 14:35

viking60 wrote:Spoken like a true berserk - so you got upgraded. :s

Booyeah! :-)
viking60 wrote:You will need to re-upload your avatar though - sorry about that :oops:

I kind of like the new guy, I think I'll leave him for a bit. :dance:

Thanks v60!
S.


Return to “Networking”