firehol/blocklist-ipsets
Blocklist Ipsets
This project is a security utility for aggregating threat intelligence and automating the deployment of high-performance firewall rules. It functions as an aggregator that fetches and normalizes malicious IP address lists from multiple external security feeds and a management tool that deploys these lists into the Linux kernel using ipset for packet filtering.
The system maintains network perimeter defense by using atomic kernel updates to swap IP sets, which allows firewall rules to be updated without interrupting active connections. It includes a range optimizer that simplifies network address data structures to minimize kernel overhead and improve packet inspection speed.
The tool covers broad capability areas including automated firewall management, threat intelligence synchronization, and network range optimization. It also provides monitoring and observability through a reporting system that generates a static website to track the history, age, and overlap of synchronized blocklists.
Features
- Network Perimeter Defense - Provides an automated system for protecting network boundaries by maintaining up-to-date kernel-level firewall rules.
- Malicious Traffic Blocking - Provides a system for blocking network traffic from known malicious IP addresses and subnets at the kernel level.
- Threat Intelligence Normalizations - Normalizes diverse external threat intelligence formats into a standard representation for firewall application.
- IP Set Management - Manages and injects IP address sets directly into the Linux kernel for high-performance packet filtering.
- Firewall Blocklist Automators - Automates the periodic download and application of remote threat intelligence lists to firewall rules.
- IPSet Managers - Automates the deployment of curated IP blocklists into the Linux kernel using ipset for high-performance filtering.
- Threat Intelligence Aggregation - Aggregates and normalizes malicious IP address lists from multiple external security feeds.
- Threat Intelligence Synchronizers - Synchronizes threat intelligence data and malicious IP blocklists from multiple remote sources.
- Feed Downloader and Normalizers - Implements a pipeline to fetch and normalize malicious IP blocklists from multiple external security feeds.
- IP Range Optimizations - Optimizes network address ranges to minimize kernel overhead and increase packet inspection speed.
- Kernel-Level IP Set Optimizations - Structures network address data for high-performance lookups within kernel-level firewall filtering mechanisms.
- Atomic Rule Update Mechanisms - Implements zero-downtime firewall policy updates by swapping data sets in memory to prevent network interruptions.
- Kernel Set Synchronizers - Uses atomic kernel set swapping to ensure continuous traffic flow during firewall policy updates.
- Network Security - A collection of IP blocklists for network security.
- Security Auditing - Manager for downloading and installing cybercrime IP feed sets.
