Configuring receiving IP addresses from different services that need to be blocked (blocklists.toml)

By default, the settings are located here:

/etc/kor-elf-shield/blocklists.toml

The path to these settings can be changed in the main settings and can be found here (parameter blocklists).

A copy of the full settings file is here.

There are several sections in this file:

Basic settings
Service Settings

Basic settings

These settings should be located at the beginning of the file before the sections: "Configuring services".

Attention: to receive data, you need to open outgoing port 443. To do this, edit the file. firewall.toml:

[[ports]]
numbers = [443]
directions = ["out"]
protocols = ["tcp"]
action = "accept"

Attention: after enabling, do not forget to enable the necessary services, as they are all disabled by default.

Parameter	enabled
Meaning	true or false
By default	false
Description	Provides support for obtaining lists of blocked IP addresses. true - includes false - turns it off
Examples	`enabled = true` `enabled = false`

Service Settings

Specify the parameters for this section first [[sources]], and then specify the other parameters of this section. Example:

[[sources]]
enabled = false
name = "SPAMDROP"
url = "https://www.spamhaus.org/drop/drop_v4.json"
format = "json"
json_field = "cidr"
limit = 0
interval = 86400

[[sources]]
enabled = false
name = "SPAMDROPV6"
url = "https://www.spamhaus.org/drop/drop_v6.json"
format = "json"
json_field = "cidr"
limit = 0
interval = 86400

Spamhaus Don't Route Or Peer Lists (DROP IPv4)

Service address: https://www.spamhaus.org/blocklists/do-not-route-or-peer/

[[sources]]
enabled = true
name = "SPAMDROP"
url = "https://www.spamhaus.org/drop/drop_v4.json"
format = "json"
json_field = "cidr"
limit = 0
interval = 86400

Spamhaus Don't Route Or Peer Lists (DROP IPv6)

Service address: https://www.spamhaus.org/blocklists/do-not-route-or-peer/

[[sources]]
enabled = true
name = "SPAMDROPV6"
url = "https://www.spamhaus.org/drop/drop_v6.json"
format = "json"
json_field = "cidr"
limit = 0
interval = 86400

DShield.org Recommended Block List

Service address: https://dshield.org

[[sources]]
enabled = true
name = "DSHIELD"
url = "https://www.dshield.org/block.txt"
format = "txt"
txt_type = "cidr"
txt_field_ip = 0
txt_field_cidr = 2
txt_separator = "\t"
limit = 0
interval = 86400

The same list, only we receive data not through CIDR, but through a range of IP addresses.

Attention: it is not recommended to turn DSHIELD on both DSHIELD_INTERVAL at the same time!

[[sources]]
enabled = true
name = "DSHIELD_INTERVAL"
url = "https://www.dshield.org/block.txt"
format = "txt"
txt_type = "interval"
txt_field_ip = 0
txt_field_ip2 = 1
txt_separator = "\t"
limit = 0
interval = 86400

TOR Exit Nodes List

Service address: https://trac.torproject.org/projects/tor/wiki/doc/TorDNSExitList

[[sources]]
enabled = true
name = "TOR"
url = "https://check.torproject.org/torbulkexitlist"
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = " "
limit = 0
interval = 86400

Project Honey Pot Directory of Dictionary Attacker IPs

Service address: https://www.projecthoneypot.org/

[[sources]]
enabled = true
name = "HONEYPOT"
url = "https://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1"
format = "rss"
rss_tag = "item"
rss_field = "title"
rss_field_ip = 0
rss_field_separator = "|"
limit = 0
interval = 86400

C.I. Army Malicious IP List

Service address: https://www.ciarmy.com/

[[sources]]
enabled = true
name = "CIARMY"
url = "https://www.ciarmy.com/list/ci-badguys.txt"
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = " "
limit = 0
interval = 86400

BruteForceBlocker IP List

Service address: https://danger.rulez.sk/index.php/bruteforceblocker/

[[sources]]
enabled = true
name = "BFB"
url = "https://danger.rulez.sk/projects/bruteforceblocker/blist.php"
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = "\t"
limit = 0
interval = 86400

Blocklist.de

Service address: https://www.blocklist.de

The first list shows only the IP addresses added in the last hour.:

[[sources]]
enabled = true
name = "BDE"
url = "https://api.blocklist.de/getlast.php?time=3600"
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = "\t"
limit = 0
interval = 3600

The second list contains all the IP addresses added in the last 48 hours. This is usually a very large list (over 10,000 entries), so make sure you have the necessary resources to use it.

Please note: it is not recommended to turn BDE on both BDEALL at the same time.

[[sources]]
enabled = true
name = "BDEALL"
url = "https://lists.blocklist.de/lists/all.txt"
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = "\t"
limit = 0
interval = 86400

Stop Forum Spam (IPv4)

Service address: https://www.stopforumspam.com/downloads

Many of the available lists contain a huge number of IP addresses, so you should be careful when choosing this list.

[[sources]]
enabled = true
name = "STOPFORUMSPAM"
url = "https://www.stopforumspam.com/downloads/listed_ip_1.zip"
zip = true
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = " "
limit = 0
interval = 86400

Stop Forum Spam (IPv6)

Service address: https://www.stopforumspam.com/downloads

Many of the available lists contain a huge number of IP addresses, so you should be careful when choosing this list.

[[sources]]
enabled = true
name = "STOPFORUMSPAMV6"
url = "https://www.stopforumspam.com/downloads/listed_ip_1_ipv6.zip"
zip = true
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = " "
limit = 0
interval = 86400

GreenSnow Hack List

Service address: https://greensnow.co

[[sources]]
enabled = true
name = "GREENSNOW"
url = "https://blocklist.greensnow.co/greensnow.txt"
format = "txt"
txt_type = "default"
txt_field_ip = 0
txt_separator = " "
limit = 0
interval = 86400

If you want to implement your own list or want to understand the parameters, a description of the parameters may help you.:

Parameter	enabled
Meaning	true or false
Description	Enables or disables receiving data from this list. true - includes false - turns it off
Examples	`enabled = true` `enabled = false`
Parameter	name
Meaning	The name must be unique and the following characters are allowed: "a-z, A-Z, -, _"
Description	The name that will be used in the creation set in. nftables
Examples	`name = "SPAMDROP"`
Parameter	url
Meaning	Point out URL
Description	The address that the program will use to get a list of IP addresses to block.
Examples	`url = "https://www.spamhaus.org/drop/drop_v4.json"`
Parameter	limit
Meaning	From 0
Description	This is the maximum number of IP addresses from the list that can be used. A value of 0 means that all IP addresses are used.
Examples	`limit = 0` `limit = 10000`
Parameter	interval
Meaning	From 60
Description	The update interval for downloading the list should be at least 60 seconds (not recommended), but 86400 (per day) will be more than enough.
Examples	`interval = 86400`
Parameter	zip
Meaning	true or false
Description	If the received file is in zip the format, then it must be included zip = true.
Examples	`zip = true` `zip = false`
Parameter	format
Meaning	There are several formats: "json", "txt", "rss"
Description	We specify the format that the service returns.
Examples	`format = "json"` `format = "txt"`
Parameter	json_field
Meaning	Key name
Description	This field is used if `format = "json"`. Here we specify the name of the key that we use to get the IP address.
Examples	`json_field = "cidr"`
Parameter	txt_type
Meaning	Acceptable values: "default", "cidr", "interval"
Description	This field is used if `format = "txt"`.
Examples	`txt_type = "cidr"`
Parameter	txt_field_ip
Meaning	Acceptable values from 0 and above
Description	This field is used if `format = "txt"`. This is the index of the field for getting the IP address.
Examples	`txt_field_ip = 0`
Parameter	txt_field_ip2
Meaning	Acceptable values from 0 and above
Description	This field is used if `format = "txt"` and. `txt_type = "interval"` Specifies the index of the field for obtaining the second IP (software).
Examples	`txt_field_ip2 = 1`
Parameter	txt_separator
Meaning	We specify a symbol for separation
Description	This field is used if `format = "txt"`. This is the separator. The parser uses it to split a string into fields.
Examples	`txt_separator = "\t"`
Parameter	txt_field_cidr
Meaning	Acceptable values from 0 and above
Description	This field is used if `format = "txt"` and. `txt_type = "cidr"` Specifies the index of the field to receive cidr.
Examples	`txt_field_cidr = 2`
Parameter	rss_tag
Meaning	Name of the parent tag
Description	This field is used if `format = "rss"`. Points to the parent tag.
Examples	`rss_tag = "item"`
Parameter	rss_field
Meaning	Tag name
Description	This field is used if `format = "rss"`. Indicates the tag that is located inside the parent tag.
Examples	`rss_field = "title"`
Parameter	rss_field_separator
Meaning	A symbol for separating text
Description	This field is used if `format = "rss"`. If you need to split the resulting text.
Examples	`rss_field_separator = "\|"` `rss_field_separator = ""`
Parameter	rss_field_ip
Meaning	Acceptable values from 0 and above
Description	This field is used if `format = "rss"` and is specified `rss_field_separator`. This is the index of the field for getting the IP address.
Examples	`rss_field_ip = 0`