IPQ BDB filter - Summary

This group is not part of the GNU Project.

IPQ BDB filtering is done by a user space daemon that issues verdicts after looking up the IP address in a Berkeley DB. The fuzzy blocking model, freely inspired by STOCKADE, is designed to block dictionary attacks, but it can also mitigate compulsive spammers:

• The probability that an address will be blocked doubles every time it is caught red-handed, so as to reach 100% probability after the given number of times.
• Probabilities then decay automatically, so that all addresses are eventually rehabilitated without human intervention.

IPQ BDB requires you to devise and set up your firewall. That includes configuring regular expression, establishing probabilities and halving times, setting up iptables with NFQUEUE targets or nftables queue statements, as well as getting it all together in the boot sequence and cron jobs.  Thus, ipqbdb can be thought of as a building block for your firewall. Besides the daemon, and the log parser, this tiny package includes utilities to insert or delete IP addresses in a DB from the command line.

Although either iptables or nftables can be used —both rely on the same kernel facility (nfnetlink_queue)— the current version if ipqbdb can only filter IPv4 addresses.

As it requires Netfilter it is probably only usable under the Linux kernel 2.6.14 or later. In addition, it requires the following packages:

• Berkeley DB
• PCRE
• Popt
• libcurl (optional for abuse reporting)

Similar projects: SSHGuard, Fail2ban, Fail2nft

Registration Date: Sat 15 Nov 2008 12:10:32 PM UTC
License: GNU General Public License v3 or later
Development Status: 5 - Production/Stable