Add ipv6 support #108
Add ipv6 support #108
Conversation
|
Great. Thanks for opening the PR! |
|
Interesting contribution. Two things:
|
|
Relevant paper on the topic:
|
|
It's probably worth noting that IPv6 addresses are mostly distributed in /48 blocks, with some ISPs providing /56 or /64 ranges. IPv6 addresses are almost always subnetted into /64 ranges so it should be safe to block a /64 subnet based on an address from that range. |
It's a current practice but not a recommendation (and its also unnatural in many respects: why assign (and block) 18446744073709551616 IPs at once?). OVH, to take one example, only assign 1 IPv6 to their virtual-servers. |
| BLACKLISTS=( | ||
| "{{ blacklists|join("\"\n \"") }}" | ||
| ) | ||
| MAXELEM={{ maxelements }} | ||
| MAXELEM={{ maxelements_v6 }} |
There was a problem hiding this comment.
redefining the same bash variable.
| #"https://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1" # Project Honey Pot Directory of Dictionary Attacker IPs | ||
| #"https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1" # TOR Exit Nodes | ||
| #"http://danger.rulez.sk/projects/bruteforceblocker/blist.php" # BruteForceBlocker IP List | ||
| "https://www.spamhaus.org/drop/drop.txt" # Spamhaus Don't Route Or Peer List (DROP) | ||
| #"https://cinsscore.com/list/ci-badguys.txt" # C.I. Army Malicious IP List | ||
| #"https://lists.blocklist.de/lists/all.txt" # blocklist.de attackers | ||
| #"https://blocklist.greensnow.co/greensnow.txt" # GreenSnow | ||
| "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset" # Firehol Level 1 | ||
| "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/stopforumspam_7d.ipset" # Stopforumspam via Firehol | ||
| # "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/stopforumspam_7d.ipset" # Stopforumspam via Firehol | ||
| # "https://raw.githubusercontent.com/ipverse/rir-ip/master/country/zz/ipv4-aggregated.txt" # Ban an entire country(-code), see https://github.com/ipverse/rir-ip |
There was a problem hiding this comment.
should not be part of the PR
| DO_OPTIMIZE_CIDR=no | ||
| if exists iprange && [[ ${OPTIMIZE_CIDR:-yes} != no ]]; then | ||
| if exists cidr-merger && [[ ${OPTIMIZE_CIDR:-yes} != no ]]; then |
There was a problem hiding this comment.
No. cidr-merger is not available on Debian-based. Should be a fallback (or a value to passed to $OPTIMIZE_CIDR)
| done | ||
|
|
||
| [[ ${VERBOSE:-no} == yes ]] && echo -e "\\n" |
There was a problem hiding this comment.
Best to do VERBOSE=${VERBOSE:-no} once at the beginning of the script
Added ipv6 support with much inspiration from the code at https://github.com/leshniak/nft-blacklist from @leshniak