Deny large number of IPs via ipfw

fbsd fbsd at
Sun Jun 11 15:14:16 UTC 2006

This is still wasted busy work. There are much simpler ways to stop
ssh false login attempts and garbage to website guest books.

In ipfw use rule limit option or change port number ssh uses and
only give your ssh port number to your user group. And for all
websites add a noise image to stop robots from auto entering
garbage.  You should use the correct tools instead of some over kill
3 million ip table entry's is plain stupid. I fired my system admin
when I caught him trying to do the same stupid thing.

-----Original Message-----
From: Dan Mahoney, System Admin [mailto:danm at]
Sent: Sunday, June 11, 2006 10:43 AM
To: fbsd
Cc: questions at
Subject: RE: Deny large number of IPs via ipfw

On Sun, 11 Jun 2006, fbsd wrote:

> Using such an list of ip address from a major rbl is flawed at the
> core of the idea.
> Over 85% of those 3 million ip address are spoofed in the first
> place.
> Most are what would be called false positives.
> Reread the info at the source it says the data is
> not intended to be used the way you are trying to use it.

All it says is: "We're getting a lot of reports of spurious blocking
caused by sites using the CBL to block authenticated access to
/ outgoing mail servers. THE CBL is only designed to be used on
mail, i.e. on the hosts that your MX records point to."

Which I take to mean, yeah, if you're using it on sendmail, you
allow SMTP
AUTH to override blacklists (this is the case by default.)

Whereas my intention would be to use it to block ports such as 80
and 22.
Every system I've found trying to brute-force SSH on my box has
been in this database, and by using mod_access_rbl for apache I was
to catch and block a dozen or so attempts to post spammish content
guestbooks and the like (but I'd like to do this without the
overhead of
apache DNS lookups).

Thanks for your input, though.


> You really need to rethink what you are doing.
> -----Original Message-----
> From: owner-freebsd-questions at
> [mailto:owner-freebsd-questions at]On Behalf Of Dan
> Mahoney,
> System Admin
> Sent: Sunday, June 11, 2006 8:36 AM
> To: questions at
> Subject: Deny large number of IPs via ipfw
> Hey all,
> I've got a file that I just synced from a major RBL, and I'd like
> just
> use it to globally deny access to my system.  Is there an easy way
> to do
> this within ipfw -- the file is about 3 *million* lines, and is
> -Dan
> --
> -The Chest of the nameless streaker of the 1998 Grammy Awards' Bob
> Dylan
> Performance.
> --------Dan Mahoney--------
> Techie,  Sysadmin,  WebGeek
> Gushi on efnet/undernet IRC
> ICQ: 13735144   AIM: LarpGM
> Site:
> ---------------------------
> _______________________________________________
> freebsd-questions at mailing list
> To unsubscribe, send any mail to
> "freebsd-questions-unsubscribe at"


"I am a professional drinker, and I know that that was NOT Jose

"Well, what was it then?"

"I think it was some mixture of Rubbing Alcohol, and Desenex(TM)
Powder, because my feet feel okay, and my back doesn't hurt, but my
stomach is killing me!"

-Dan Mahoney, Costa Rica, August 12th, 1994

--------Dan Mahoney--------
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM

More information about the freebsd-questions mailing list