topic Re: IP-RBLs for firewalls in General Topics

IP-RBLs for firewalls

jhickey — Tue, 12 Mar 2013 18:25:36 GMT

Riddle me this…

We have issues with malicious traffic coming from Open Proxies, Known Bad Hosts, etc.

Is there such thing as an all IP, Realtime Blacklist for firewalls. There are certain external servers I dont want to be accessible by known bad networks.

I’d love to write a rule like this:

Source = RBL-or-Block-of-BAD-IPs-maintained-by-someone-else Destination=Important Server Action=Drop

And no, I don’t want to buy a million dollar IPS. Isn’t there something in the Linux world called IP Tables.

Justin

Re: IP-RBLs for firewalls

ericgearhart — Tue, 12 Mar 2013 18:36:53 GMT

I'll try to find a firewall specific realtime black list, but funny you should mention this, in PANOS 5.0 Palo Alto added something called "Dynamic Block Lists" that do exactly what you describe.

Re: IP-RBLs for firewalls

jhickey — Tue, 12 Mar 2013 18:56:25 GMT

That is cool. I would assume this works with the SpamHaus "DROP" Dont Route or Peer list. For sure and idea whose time has come. I'd also like to put in all TOR endpoints.

Re: IP-RBLs for firewalls

ericgearhart — Tue, 12 Mar 2013 19:12:31 GMT

Here's an example of a block list... SANS' DSHield has a Recommended Block List. I figured the list would be a bit bigger and more comprehensive though honestly:

http://feeds.dshield.org/block.txt

#    This list summarized the top 20 attacking class C (/24) subnets
#   over the last three days. The number of 'attacks' indicates the 
#   number of targets reporting scans from this subnet.