It's Deja Vu All Over Again

— Yogi Bera

All the way back in 2021, APIBAN provided a method of integrating with IPset. I wrote about it in a post titled “APIBAN Now Has IPset.”

First I can’t believe it’s been more than 5 years with APIBAN. I’m so proud of this project and the help it’s provided.

Second, I can’t believe that it’s taken me 5 years to integrate ipset into the APIBAN iptables client. Which brings me to…

APIBAN Now Supports IPset in the Iptables Client

In the years since APIBAN was started, the “active” list of ip’s to ban has grown. If you’re blocking both the SIP and HTTP sets, there’s an average of 4-5000 ip’s “active.” If you’re still running iptables, having this many ip’s in rules can be problematic (to say the least).

Well, the iptables go client, now supports ipset.

How Do I Use IPset?

1. Download the latest, updated client from github
2. Download the latest config.json from github as well.
3. Add your key to the config.
4. Change ipset from false to true.

Wala

An updated config, set to use ipset, should look something like:

{
	"apikey":"MY API KEY",
	"lkid":"100",
	"version":"2.0",
	"set":"all",
	"flush":"200",
	"chain":"APIBAN",
	"ipset":true,
	"allowed":[
		{
			"cidr":"1.1.1.1/32"
		},
		{
			"cidr":"208.67.207.0/24"
		}
	]
}

The client will automatically add the ipset rule to your INPUT chain and then start using ipset to store the ip’s.

Wait. What’s “allowed”?

Also in this newest update is the ability to add allowed ip’s and subnets (in cidr format) to keep certain ip’s from ever being blocked by the client.

iptables vs nftables

Look, I didn’t want to use nftables. Not at all. And as someone that avoids religious wars (like maridb vs postgres, debian vs fedora, etc), I feel no joy in saying this… but…

nftables is simply better.

It’s just faster, more efficient, and handles both ipv4 and ipv6 with ease. The APIBAN nftables client uses sets (a built in feature) and has performed flawlessly with huge volumes of ip addresses.

Anyway…

Bottom line is that if you’re not using nftables, you should then use the ipset feature of the updated iptables client.

About APIBAN

APIBAN helps prevent unwanted SIP traffic by identifying addresses of known bad actors before they attack your system. Bad actors are collected through globally deployed honeypots and curated by LOD/APIBAN.

APIBAN started from discussions at tech conferences (in particular Kamailio World and Astricon). Most of the attendees had seen increases in malicious SIP traffic and we all thought there should be a way to share the active “bad actors.”

When I found myself with some downtime, and with the support of LOD, some honeypots were deployed… an API was made to share the data, and APIBAN was born.

Additional Reading

• apiban.org
• LOD.com (Main sponsor of APIBAN)
• apiban on github (apiban clients and examples)
• iptables client
• nftables client

Thank you for supporting APIBAN!