Re: IP Address Blacklists

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2799 bytes --]

Hi,

> On 19 Feb 2020, at 17:13, ummeegge <ummeegge(a)ipfire.org> wrote:
> 
> Hi Michael,
> 
> Am Mittwoch, den 19.02.2020, 11:52 +0000 schrieb Michael Tremer:
>> Hi,
>> 
>>> On 18 Feb 2020, at 16:49, ummeegge <ummeegge(a)ipfire.org> wrote:
>>> 
>>> Hi all,
>>> 
>>> Am Samstag, den 15.02.2020, 15:40 +0000 schrieb Tim FitzGeorge:
>>>> Hi,
>>>> 
>>>> I've pushed the my changes to implement IP Address Blacklists to
>>>> the
>>>> repository at git://git.ipfire.org/people/timf/ipfire-2.x.git on
>>>> the
>>>> ipblacklist branch.
>>>> 
>>>> As a result of discussions with Michael, this has a number of
>>>> changes
>>>> from my first patch series:
>>>> 
>>>> - Removed autoblacklist.
>>>> - Added WUI log pages.
>>>> - Removed status from settings WUI page.
>>>> - Simplified download.
>>>> - Modified sources file 'rate' to allow unit to be specified.
>>>> - Updated sources file 'disable' to allow list to be specified.
>>>> - Changed Dshield download URL to preferred address.
>>>> - Removed Abuse.ch blacklist (discontinued).
>>>> - Removed Talos Malicious blacklist (not appropriate).
>>>> - Added Feodo recommended blacklist.
>>>> - Added blocklist.de all blacklist.
>>>> - Updated ignored messages in logwatch.
>>>> 
>>>> There's also some additional code on the addresscheck branch
>>>> which
>>>> adds
>>>> a WUI page that can check why a URL or address is being
>>>> blocked.  It's
>>>> not production ready, but may possibly be useful in testing.
>>>> 
>>>> Tim
>>> 
>>> thanks for your hard work here which looks great. 
>>> As far as i can see, there are no possiblities to add own lists.
>>> Might
>>> it be an idea for such a possibility ? I use currently e.g. lists
>>> from
>>> firehol --> http://iplists.firehol.org/ via script and IPSet.
>>> Am currently not sure how difficult it is to give the user there
>>> some
>>> individuality to choose it´s own list ?
>> 
>> We currently do not allow this for the IPS either.
>> 
>> And I am not really sure if we should. Why would we not add the lists
>> for all users if we see any value in them.
>> 
>> What reasons are there to allow users to do their own thing?
> Use cases can be different e.g. i remeber a project in the old forum
> which was about a company blocker (facebook, Windows, Apple) or in
> general the whole telemetry stuff can also be unwanted and there are
> some lists out there which can help to block also the "good" ones. If
> there are own vast lists of unwanted IPs, IPSet which is working here,
> is then the best way to do so, therefor my idea to bring in some
> flexibility in this great project to prevent scripting around in
> parallel for, let´s say, doing the same twice.

Is it not better to block the whole AS of those companies in the firewall?

> 
>> 
>>> 
>>> Best,
>>> 
>>> Erik
>>> 
>> 
>> 
>