Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Feature Requests
  3. Firewall / Spamassassin: Automatic list update

Firewall / Spamassassin: Automatic list update

Scheduled Pinned Locked Moved Feature Requests
firewallspamassassin
50 Posts 10 Posters 6.1k Views 10 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • d19dotcaD d19dotca

    There's even a list for Cloudron team to use for this forum 😉 haha

    https://iplists.firehol.org/?ipset=stopforumspam

    Now imagine if that could be used in the firewall automatically. Would be awesome.

    rmdesR Offline
    rmdesR Offline
    rmdes
    wrote on last edited by
    #14

    @d19dotca Yes that's what I meant, hence the lists I suggested: https://forum.cloudron.io/post/20010

    rmdesR 1 Reply Last reply
    0
    • rmdesR rmdes

      @d19dotca Yes that's what I meant, hence the lists I suggested: https://forum.cloudron.io/post/20010

      rmdesR Offline
      rmdesR Offline
      rmdes
      wrote on last edited by
      #15

      The more I read about FireHol the more I wish this was backed into cloudron install directly, it seems to me that Firehol is a great source to rely for blocking bad IP's

      necrevistonnezrN 1 Reply Last reply
      4
      • rmdesR rmdes

        The more I read about FireHol the more I wish this was backed into cloudron install directly, it seems to me that Firehol is a great source to rely for blocking bad IP's

        necrevistonnezrN Offline
        necrevistonnezrN Offline
        necrevistonnezr
        wrote on last edited by
        #16

        @girish
        Did anything come of this...?

        1 Reply Last reply
        2
        • necrevistonnezrN Offline
          necrevistonnezrN Offline
          necrevistonnezr
          wrote on last edited by
          #17

          Can we re-visit this?

          1 Reply Last reply
          2
          • necrevistonnezrN necrevistonnezr referenced this topic on
          • necrevistonnezrN Offline
            necrevistonnezrN Offline
            necrevistonnezr
            wrote on last edited by
            #18

            I guess since the blocklist is in /home/yellowtent/platformdata/firewall/blocklist.txt, one could build something with a script & cron?

            1 Reply Last reply
            4
            • necrevistonnezrN Offline
              necrevistonnezrN Offline
              necrevistonnezr
              wrote on last edited by
              #19

              @girish is the way I described feasible? Is that txt file the actual list the firewall accesses to check blocked IPs or is this txt file e.g. used to feed into a database?

              girishG 1 Reply Last reply
              3
              • necrevistonnezrN necrevistonnezr

                @girish is the way I described feasible? Is that txt file the actual list the firewall accesses to check blocked IPs or is this txt file e.g. used to feed into a database?

                girishG Offline
                girishG Offline
                girish
                Staff
                wrote on last edited by
                #20

                @necrevistonnezr Updating the txt file is not enough. The txt file is actually just a "cache" , the real value is stored in the database.

                necrevistonnezrN 1 Reply Last reply
                1
                • girishG girish

                  @necrevistonnezr Updating the txt file is not enough. The txt file is actually just a "cache" , the real value is stored in the database.

                  necrevistonnezrN Offline
                  necrevistonnezrN Offline
                  necrevistonnezr
                  wrote on last edited by
                  #21

                  @girish Ok, so simple scripting is out of the question.

                  girishG 1 Reply Last reply
                  0
                  • necrevistonnezrN necrevistonnezr

                    @girish Ok, so simple scripting is out of the question.

                    girishG Offline
                    girishG Offline
                    girish
                    Staff
                    wrote on last edited by
                    #22

                    @necrevistonnezr you can still use the api though

                    1 Reply Last reply
                    1
                    • necrevistonnezrN Offline
                      necrevistonnezrN Offline
                      necrevistonnezr
                      wrote on last edited by
                      #23

                      Well, the "setBlockList" operation allows to add a range of IPs but not a list of IPs in a file or am I wrong?

                      curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $CLOUDRON_TOKEN" "https://$CLOUDRON_DOMAIN/api/v1/network/blocklist" --data '{"blocklist":"# Spammy network\n10.244.0.0/16"}'
                      

                      as per: https://docs.cloudron.io/api.html#tag/Network/operation/setBlockList

                      girishG 1 Reply Last reply
                      0
                      • necrevistonnezrN necrevistonnezr

                        Well, the "setBlockList" operation allows to add a range of IPs but not a list of IPs in a file or am I wrong?

                        curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $CLOUDRON_TOKEN" "https://$CLOUDRON_DOMAIN/api/v1/network/blocklist" --data '{"blocklist":"# Spammy network\n10.244.0.0/16"}'
                        

                        as per: https://docs.cloudron.io/api.html#tag/Network/operation/setBlockList

                        girishG Offline
                        girishG Offline
                        girish
                        Staff
                        wrote on last edited by
                        #24

                        @necrevistonnezr it's a "Newline separated list of IP entries" . So, it can be # Spammy network\n10.244.0.0/16\n1.2.3.4\n3.4.5.6\n172.4.0.0/16

                        necrevistonnezrN 1 Reply Last reply
                        2
                        • girishG girish

                          @necrevistonnezr it's a "Newline separated list of IP entries" . So, it can be # Spammy network\n10.244.0.0/16\n1.2.3.4\n3.4.5.6\n172.4.0.0/16

                          necrevistonnezrN Offline
                          necrevistonnezrN Offline
                          necrevistonnezr
                          wrote on last edited by necrevistonnezr
                          #25

                          @girish I guess there's no mechanism to avoid duplicate entries when using the "setBlockList" operation, correct?

                          In general, I guess something like this should work:

                          #!/bin/bash
                          curl https://www.ipdeny.com/ipblocks/data/countries/kz.zone --output iplist.txt
                          while read -r line; do
                              curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $CLOUDRON_TOKEN" "https://$CLOUDRON_DOMAIN/api/v1/network/blocklist" --data $line"
                          done < iplist.txt
                          rm iplist.txt
                          

                          I don't have know yet how to avoid duplicates in the database..

                          imc67I 1 Reply Last reply
                          3
                          • imc67I Online
                            imc67I Online
                            imc67
                            translator
                            wrote on last edited by
                            #26

                            It should be default functionality to have country block/allow in the Cloudron GUI just like all Synology NAS’s have. It’s 2023 and too dangerous to have everything accessible for everyone. That’s why many Cloudron users (read the forum) are using Cloudflare for this kind of functionality (like I have to do).

                            girishG 1 Reply Last reply
                            4
                            • necrevistonnezrN necrevistonnezr referenced this topic on
                            • imc67I imc67

                              It should be default functionality to have country block/allow in the Cloudron GUI just like all Synology NAS’s have. It’s 2023 and too dangerous to have everything accessible for everyone. That’s why many Cloudron users (read the forum) are using Cloudflare for this kind of functionality (like I have to do).

                              girishG Offline
                              girishG Offline
                              girish
                              Staff
                              wrote on last edited by
                              #27

                              @imc67 IMO, the correct place to implement this is in the network firewall. Most Cloud providers already have a firewall feature and they can then implement this firewall rule at the edge of the network instead of the server itself.

                              I have a Synology router (not NAS) at home. I just use their blocklists. For home setups, the router is the correct place for this. Otherwise, you allow all traffic to come into your home and then it gets rejected by the server wasting cpu and network traffic.

                              That said, I understand why this feature is being requested here instead - no cloud network firewall has this feature. And most likely cloud providers don't listen to our suggestions 😕

                              robiR 1 Reply Last reply
                              1
                              • girishG girish

                                @imc67 IMO, the correct place to implement this is in the network firewall. Most Cloud providers already have a firewall feature and they can then implement this firewall rule at the edge of the network instead of the server itself.

                                I have a Synology router (not NAS) at home. I just use their blocklists. For home setups, the router is the correct place for this. Otherwise, you allow all traffic to come into your home and then it gets rejected by the server wasting cpu and network traffic.

                                That said, I understand why this feature is being requested here instead - no cloud network firewall has this feature. And most likely cloud providers don't listen to our suggestions 😕

                                robiR Offline
                                robiR Offline
                                robi
                                wrote on last edited by
                                #28

                                @girish IME it's a custom support request for the network operator to put those filters on for your IP(s).

                                Conscious tech

                                1 Reply Last reply
                                1
                                • d19dotcaD Offline
                                  d19dotcaD Offline
                                  d19dotca
                                  wrote on last edited by
                                  #29

                                  Is it possible to improve / add the IP block list feature to Cloudron in 8.0?

                                  --
                                  Dustin Dauncey
                                  www.d19.ca

                                  1 Reply Last reply
                                  1
                                  • necrevistonnezrN necrevistonnezr

                                    @girish I guess there's no mechanism to avoid duplicate entries when using the "setBlockList" operation, correct?

                                    In general, I guess something like this should work:

                                    #!/bin/bash
                                    curl https://www.ipdeny.com/ipblocks/data/countries/kz.zone --output iplist.txt
                                    while read -r line; do
                                        curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $CLOUDRON_TOKEN" "https://$CLOUDRON_DOMAIN/api/v1/network/blocklist" --data $line"
                                    done < iplist.txt
                                    rm iplist.txt
                                    

                                    I don't have know yet how to avoid duplicates in the database..

                                    imc67I Online
                                    imc67I Online
                                    imc67
                                    translator
                                    wrote on last edited by
                                    #30

                                    @necrevistonnezr said in Firewall / Spamassassin: Automatic list update:

                                    I guess something like this should work

                                    Did you managed it to get it worked like that?

                                    necrevistonnezrN 1 Reply Last reply
                                    0
                                    • imc67I imc67

                                      @necrevistonnezr said in Firewall / Spamassassin: Automatic list update:

                                      I guess something like this should work

                                      Did you managed it to get it worked like that?

                                      necrevistonnezrN Offline
                                      necrevistonnezrN Offline
                                      necrevistonnezr
                                      wrote on last edited by
                                      #31

                                      @imc67 No, as I don’t know how to avoid duplicates in the database - I don’t want to fill up a database with a hard entry limit with nonsense

                                      imc67I 1 Reply Last reply
                                      0
                                      • necrevistonnezrN necrevistonnezr

                                        @imc67 No, as I don’t know how to avoid duplicates in the database - I don’t want to fill up a database with a hard entry limit with nonsense

                                        imc67I Online
                                        imc67I Online
                                        imc67
                                        translator
                                        wrote on last edited by imc67
                                        #32

                                        @necrevistonnezr I gave it a try with some help by ChatGPT and it works flawless!! Except the API can't handle large list where the GUI is able to handle without an issue.

                                        The script automatically downloads all the geo lists in an array, creates a copy/paste file for the GUI and then prepares the file in JSON style and connect/upload via API.

                                        When I choose only a few countries is works perfect, however when choosing all the desired ones:

                                        @girish @nebulon I get a line 83: /usr/bin/curl: Argument list too long

                                        I can copy/paste the full list in the GUI, it takes some time but it uploads and settles all IP ranges (about 87k)

                                        Does anyone know how to do this via the API?

                                        robiR girishG 2 Replies Last reply
                                        2
                                        • imc67I imc67

                                          @necrevistonnezr I gave it a try with some help by ChatGPT and it works flawless!! Except the API can't handle large list where the GUI is able to handle without an issue.

                                          The script automatically downloads all the geo lists in an array, creates a copy/paste file for the GUI and then prepares the file in JSON style and connect/upload via API.

                                          When I choose only a few countries is works perfect, however when choosing all the desired ones:

                                          @girish @nebulon I get a line 83: /usr/bin/curl: Argument list too long

                                          I can copy/paste the full list in the GUI, it takes some time but it uploads and settles all IP ranges (about 87k)

                                          Does anyone know how to do this via the API?

                                          robiR Offline
                                          robiR Offline
                                          robi
                                          wrote on last edited by
                                          #33

                                          @imc67 Since it works from the browser, you should be able to inspect the API calls in the browser console.

                                          Conscious tech

                                          imc67I 1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Don't have an account? Register

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • Bookmarks
                                          • Search