mainIPQ BDB filter - Summary

 
 
Membership Info
Group Admin:
1 active member

Group identification
Id: 10071
System Name: ipqbdb
Name: IPQ BDB filter
Group Type: non-GNU software and documentation

Search in this Group


 

This group is not part of the GNU Project.

IPQ BDB filtering is done by a user space daemon that issues verdicts after looking up the IP address in a Berkeley DB. The fuzzy blocking model, freely inspired by STOCKADE, is designed to block dictionary attacks, but it can also mitigate compulsive spammers:

  • The probability that an address will be blocked doubles every time it is caught red-handed, so as to reach 100% probability after the given number of times.
  • Probabilities then decay automatically, so that all addresses are eventually rehabilitated without human intervention.


IPQ BDB requires you to devise and set up your firewall. That includes configuring regular expression, establishing probabilities and halving times, setting up iptables with NFQUEUE targets or nftables queue statements, as well as getting it all together in the boot sequence and cron jobs.  Thus, ipqbdb can be thought of as a building block for your firewall. Besides the daemon, and the log parser, this tiny package includes utilities to insert or delete IP addresses in a DB from the command line.

Although either iptables or nftables can be used —both rely on the same kernel facility (nfnetlink_queue)— the current version if ipqbdb can only filter IPv4 addresses.

As it requires Netfilter it is probably only usable under the Linux kernel 2.6.14 or later. In addition, it requires the following packages:


Similar projects: SSHGuard, Fail2ban, Fail2nft

Registration Date: Sat 15 Nov 2008 12:10:32 PM UTC
License: GNU General Public License v3 or later
Development Status: 5 - Production/Stable

 

Latest News rss feed
Released v1.07
     posted by ale2003, Wed 20 Jan 2021 12:37:52 PM UTC

Adding a category field to each description.  Categorized abuse can then be reported to external sites, for example AbudeIPDB.

Released v1.06
     posted by ale2003, Sat 02 Nov 2019 05:43:14 PM UTC

This release includes a redistribution of jsmn JSON parsing library.  It consists of a single include file.  Using that and libcurl an easily coded RDAP client, abuserdap makes its entry into ipqbdb. [...]

Released v1.05
     posted by ale2003, Thu 06 Jun 2019 12:04:08 PM UTC

Changes and new features:

ibd-parse:

  •    added optional IPv6 prefix in the <HOST> replacement, so as to catch IPv4-mapped or -compatible address,
  •    tweak log line adding descr for changes,
  •    add elapsed time in summary line,
[...]
Released v1.04
     posted by ale2003, Thu 12 Sep 2013 03:58:27 PM UTC

Maintenance release enabling BDB version 5.*, and minor changes including:

  • Man pages for ibd-del, ibd-ban, and ibd-white.  More man pages will be added soon.
  • Allow multiple addresses to be passed in a single ibd-ban command.
  • Accept IPv4 mapped IPv6 addresses.  (These tools will only store IPv4 addresses until I get a real IPv6 host address to experiment with.)
  • Decay treatment tweaks:  Default value changed from 2 mins to 6 hours, and decay doubled on passing the threshold.
Quick Overview
 Memberlist (1 member)

Communication Tools
 Mailing Lists (1 public mailing list)

Back to the top

Powered by Savane 3.13-cf05.
Corresponding source code