3

Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list?

Occasionally, the firewall guys see a high counts of security events on the security devices and will proceed to block them in the firewall or router. Over time, these lists become too long and some IP(s) blocked may not be no longer relevant.

As such, how do we deal with these IP(s)? Thanks.

Improve this question
3
  • Are the IPs blocked inbound or outbound?
    – bangdang
    Commented Apr 27, 2012 at 3:10
  • Hi, it's inbound. Public IP(s) to internal.
    – Fred1234
    Commented Apr 27, 2012 at 3:27
  • The three approaches below all illustrate the challenge for firewall admins. How to manage the block list. There are both FOSS and commercial solutions out there that help manage this process. There are also different approaches like banning traffic based on IP geolocation data (i.e. if you don't do business outside the US, block traffic originating from outside the US). This approach is not foolproof but helps to reduce the overhead of managing a larger blacklist. In the end, there's no good way to determine if a particular source IP should still be blocked (i.e. still infected by a bot).
    – bangdang
    Commented Apr 27, 2012 at 16:13

2 Answers 2

Reset to default
4

Security is nearly always a tradeoff and your strategy here will have to be adjusted to make that tradeoff acceptable to you. I see three aspects:

  1. Unblocking too early.
  2. Unblocking too late.
  3. Extra RAM/CPU/latency of holding long lists of IP addresses in your firewall.

I would unblock any IP that hasn't sent any malicious traffic for some amount of time. The amount of time I would initially choose would be 12 hours. This number strikes a balance that favours letting falsely blocked users back in quickly and keeps the lists short. I've never seen a single IP address pause for 12 hours before sending more malicious traffic although such a thing is possible.

Note that this is 12 hours after the last maliciois traffic was detected, not 12 hours after the block was put in place. If an attacker keeps trying even after he's blocked, he stays blocked.

The number should be tuned based on what you see the attackers doing and on the estimated cost of a falsely blocked user and one extra IP address in the firewall rules.

Improve this answer
2

Adding to the good answer by @Labadadada above, my primary concern is having to do this manually. Perhaps you'd want to take a look at fail2ban. Even if you don't intend to use it as is, you can somehow try to emulate what it does by other means.

In essence, fail2ban watches your log files and matches patterns. For example, it can easily detect multiple failed logins via SSH from a specific IP. You then configure what actions to perform and after what threshold. So, for example, block all access from the IP after 5 failed SSH logins for 15 minutes. You can block the entire IP from all access, or limit the block to the specific port (22), and you can set the time after which to 'unblock' it, the threshold etc.

This gives you some kind of a combination between IDS/IPS and a firewall.

I think fail2ban's approach gives a really good solution because:

  1. you don't need to do anything manually, other than defining those filters. Although there are plenty of ready-made filters out of the box.
  2. you don't need to worry about your blacklist getting too long, it gets cleaned automatically.
  3. any persistent attack will still be mitigated, blocked and 're-blocked' if necessary.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .