Network feed

[the_rock]

Hey boys and girls,

Happy Friday! Figured would share this, as its super useful, specially for anyone who is not running AV or AB blades on the firewall to block known bad IPs out there. All you do is create new network feed (can only be tested if running R81.20) and then those can be used to block the traffic from those feeds. There are 8 of them and all you do is replace number 1-8 in the link below:

Github link -> https://github.com/stamparm/ipsum

feed example -> https://raw.githubusercontent.com/stamparm/ipsum/master/levels/1.txt

You can create 8 separate network feeds, simply keep replacing numbers sequentially, 1 to 8.

Thanks @delToro1 for sharing this in my other IOC post.

I set it up in my Azure lab and so far, got 140K hits in less than 1 day, that is super impressive even though its Azure, but I got no hosts behind the fw in that lab at all.

Example:

 

Thanks a bunch as well to Miroslav Stampar for creating this.

https://github.com/stamparm

Best,

Andy

[PhoneBoy]

Nice one!

[the_rock]

Thank you 🙂

[the_rock]

Btw, just added all 8 feeds to see how many IP addresses were there, showed 234,909 all together, not bad 🙂

Andy

[delToro1]

So cool!! 😉

[the_rock]

Absolutely!

[the_rock]

Just to add, I also found below, which probably has millions of bad IP addresses, as it contains LOTS of /16 subnets. I did a search and saw there was 131 entries for /16, so right there thats 8.5 million, plus remaining /21,/22,/23,/17 etc...would not be surprised its close to 15 M all together.

https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt

Best,

Andy

[Scottc98]

@the_rock    What is the result if the feed in question on your block rule contains no entries at all (i.e. the feed source becomes empty and the previous cached files on the GW is cleared)?    Does it result in no matches and therefore nothing will hit it?      More fearful of some situation where it starts blocking more than it should be 🙂  

[the_rock]

I noticed one in my lab with no entries, but had not seen any such issues as of yet, what you described.

Andy

[the_rock]

One thing I will say though, as a word of caution, though those feeds block BUNCH of bad IPs, but it could happen that something is blocked inadvertently where people may need access to the cloud portal. In my experience, its not often, but there is a chance for it.

Andy

[rrbranco]

https://support.checkpoint.com/results/sk/sk132193

"

...

IP Allow List (Exception List)

The IP whitelist provides a convenient way to allow certain IP addresses to bypass the enforcement actions, that have been defined by threat intelligence feeds.

This document provides instructions for managing IP addresses within the IP white list, also known as the IP exception list.

1. Edit the File:

vi $FWDIR/conf/ip_whitelist.eng

1. Append IP Addresses:

Add the desired IP addresses, one per line.

1. Save Changes:

Ensure you save the file after adding the IP addresses.

Exemption from Enforcement: IP addresses listed in the $FWDIR/conf/ip_whitelist.eng file will not be subject to enforcement actions even if they appear in any of the threat intelligence feeds.

…

“

Question: 

• Is this file located on the Management Server or GW ?
  • If on the Management Server, how do we update it on MaaS ?  The same way as we do with $FWDIR/lib/table.def ?
• What is the syntax ?  One IP per line or IP/mask to allow a network ?
• Can it be Dynamically updated from a Datacenter object from AWS / Azure / GCP ... ?
• How often it is read ?  On a policy push operation ?  I mean, if we include and/or exclude something, when it will start to be enforced with the recent changes ?

Besides that, IMHO information about "IP Allow list" could be included on the Admin Guide, like here (or close) for instance:  https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_ThreatPrevention_AdminGuide/...

🖖

Best regards,  

[the_rock]

The file is 100% on the mgmt server. Does it get auto updated? Im not so sure about that as per sk. Syntax is simply one IP per line, as mask will always be /32 anyway.

Andy