Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list?

Occasionally, the firewall guys see a high counts of security events on the security devices and will proceed to block them in the firewall or router. Over time, these lists become too long and some IP(s) blocked may not be no longer relevant.

As such, how do we deal with these IP(s)? Thanks.

share|improve this question
    
Are the IPs blocked inbound or outbound? –  bangdang Apr 27 '12 at 3:10
    
Hi, it's inbound. Public IP(s) to internal. –  Fred1234 Apr 27 '12 at 3:27
    
The three approaches below all illustrate the challenge for firewall admins. How to manage the block list. There are both FOSS and commercial solutions out there that help manage this process. There are also different approaches like banning traffic based on IP geolocation data (i.e. if you don't do business outside the US, block traffic originating from outside the US). This approach is not foolproof but helps to reduce the overhead of managing a larger blacklist. In the end, there's no good way to determine if a particular source IP should still be blocked (i.e. still infected by a bot). –  bangdang Apr 27 '12 at 16:13
add comment

3 Answers

up vote 3 down vote accepted

Security is nearly always a tradeoff and your strategy here will have to be adjusted to make that tradeoff acceptable to you. I see three aspects:

  1. Unblocking too early.
  2. Unblocking too late.
  3. Extra RAM/CPU/latency of holding long lists of IP addresses in your firewall.

I would unblock any IP that hasn't sent any malicious traffic for some amount of time. The amount of time I would initially choose would be 12 hours. This number strikes a balance that favours letting falsely blocked users back in quickly and keeps the lists short. I've never seen a single IP address pause for 12 hours before sending more malicious traffic although such a thing is possible.

Note that this is 12 hours after the last maliciois traffic was detected, not 12 hours after the block was put in place. If an attacker keeps trying even after he's blocked, he stays blocked.

The number should be tuned based on what you see the attackers doing and on the estimated cost of a falsely blocked user and one extra IP address in the firewall rules.

share|improve this answer
add comment

Adding to the good answer by @Labadadada above, my primary concern is having to do this manually. Perhaps you'd want to take a look at fail2ban. Even if you don't intend to use it as is, you can somehow try to emulate what it does by other means.

In essence, fail2ban watches your log files and matches patterns. For example, it can easily detect multiple failed logins via SSH from a specific IP. You then configure what actions to perform and after what threshold. So, for example, block all access from the IP after 5 failed SSH logins for 15 minutes. You can block the entire IP from all access, or limit the block to the specific port (22), and you can set the time after which to 'unblock' it, the threshold etc.

This gives you some kind of a combination between IDS/IPS and a firewall.

I think fail2ban's approach gives a really good solution because:

  1. you don't need to do anything manually, other than defining those filters. Although there are plenty of ready-made filters out of the box.
  2. you don't need to worry about your blacklist getting too long, it gets cleaned automatically.
  3. any persistent attack will still be mitigated, blocked and 're-blocked' if necessary.
share|improve this answer
add comment

A few questions for you:

  • Is the firewall stateful?
  • Is the firewall on the perimiter of a DMZ?
  • Do you have traffic from the public internet that must be let in for some reason? Such as for a web server?

If your answers to these are yes, yes, and no, then I would say blacklist all public IPs, and only explicitly allow those that you know to be acceptable to your network. This is a better practice than allowing everything and letting the firewall determine what is suspicious or not (better job for an IPS/IDS).

If you do have a web server that needs access, consider setting up a DMZ for the web server and forward all port 80 and 443 traffic to the DMZ from your perimeter router/firewall, and block all other inbound traffic. That's what I'd do.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.