Firehol Blocklists
Firehol blocklists are a collection of automatically updating ipsets from all available security IP Feeds, mainly related to on-line attacks, on-line service abuse, malwares, botnets, command and control servers and other cybercrime activities.
VPS
Installation
Install the following packages:
sudo apt install ipset iprange
Firehol Blocklists
Navigate to Firehol's website or Firehol's github repo and choose which blocklists you want to enable.
Copy the raw links into /home/user/firehol/firehol.conf.
For example:
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_abusers_1d.netset
Firehol Script
Create a script to refresh the firehol ipsets and recreate the iptables rules.
For example /home/user/firehol/firehol.sh:
#!/bin/bash
LOG="/home/user/firehol/firehol.log"
URLS=$(cat "/home/user/firehol/firehol.conf")
echo "Updating Firehol $(date)" >> $LOG
iptables -D INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT > /dev/null 2>&1
iptables -D DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT > /dev/null 2>&1
iptables -D FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT > /dev/null 2>&1
iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT >> $LOG
iptables -I INPUT 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT >> $LOG
iptables -I DOCKER-USER 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT >> $LOG
for URL in $URLS
do
echo $URL >> $LOG
NAME=$(basename $URL)
echo $NAME >> $LOG
FILE="/home/user/firehol/$NAME"
curl -s -k $URL > $FILE
# The following sed removes LAN ranges from the lists otherwise you might block yourself
sed -i -e 's#10.0.0.0/8##' -e 's#172.16.0.0/12##' -e 's#192.168.0.0/16##' -e 's#127.0.0.0/8##' $FILE
COUNT=$(/usr/bin/iprange -C $FILE)
COUNT=${COUNT/*,/}
echo $COUNT >> $LOG
/usr/sbin/ipset create --exist $NAME hash:net family inet maxelem 131072 >> $LOG
/usr/sbin/ipset flush $NAME > /dev/null 2>&1
/usr/bin/iprange $FILE --ipset-reduce 20 --ipset-reduce-entries 65535 --print-prefix "-A $NAME " > $FILE.ipset
/usr/sbin/ipset restore --exist --file $FILE.ipset >> $LOG
/usr/sbin/iptables -D FORWARD -m set --match-set $NAME src -j DROP &>/dev/null
/usr/sbin/iptables -D INPUT -m set --match-set $NAME src -j DROP &>/dev/null
/usr/sbin/iptables -D DOCKER-USER -m set --match-set $NAME src -j DROP &>/dev/null
/usr/sbin/iptables -I DOCKER-USER 2 -m set --match-set $NAME src -j DROP >> $LOG
/usr/sbin/iptables -I INPUT 2 -m set --match-set $NAME src -j DROP >> $LOG
/usr/sbin/iptables -I FORWARD 2 -m set --match-set $NAME src -j DROP >> $LOG
done
Verify that it works and the ipsets have been filled:
chmod +x /home/user/firehol/firehol.sh
sudo /home/user/firehol/firehol.sh
sudo ipset list firehol_level1.netset
Cron Scheduling
Warning - make sure you're not accidentally blocking your own access to the VPS before proceeding.
Run the firehol script on reboot and daily.
For example, add the following to sudo crontab -e:
0 1 * * * /home/user/firehol/firehol.sh
@reboot sleep 120 && /home/user/firehol/firehol.sh
Verify that it runs on reboot and daily. There's a 2 minute delay before it applies after reboots, to give you enough time to fix a lockout.
OPNSense
Alias
Navigate to Firewall > Aliases and create the following aliases:
Name: Firehol
Type: URL IPs
Content:
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_abusers_1d.netset
Name: External
Type: Networks
Content: !10.0.0.0/8, !172.16.0.0/12, !192.168.0.0/16, !127.0.0.1
Name: Firehol_without_internal
Type: Network group
Content: External, Firehol
Firewall
Navigate to Firewall > Rules > WAN and create the following firewall rule:
Action: Block
Interface: WAN
Direction: in
TCP/IP Version: IPv4
Protocol: any
Source: Firehol_without_internal
Destination: any
Cron
Create a cron job to automatically update the blocklists every day.
Navigate to System > Settings > Cron and add the following job:
Eabled: checked
Minutes: 0
Hours: 0
Day of the month: *
Months: *
Days of the week: *
Command: Update and reload firewall aliases
Created: 2024-04-24