IP Block file - Unable to connect to Interal Web Server

[Matt_Parfitt]

I am currently following SK103154 - How to block traffic coming from known malicious IP addresses

I've uploaded my custom IP blacklist file to an internal Web Server. When I run the command in step 10, it is returning Warning, cannot connect to http://"hostname"/CheckPoint-IPBlacklist/BlacklistedIPs.txt. Repsonse:.60.

I've checked the permissions are set so Everyone can modify. I'm not sure why it cannot connect?

[Vladimir]

1. try curl on the same path to see if the destination is reachable.

2. If you are referring to the server by name, please make sure that it is resolvable as used in the full path.

3. do not forget to use "-s /full_path_to/ip_block.sh" first time you execute the command in step 10.

[Matt_Parfitt]

Thanks for the suggestions. I has just ran curl and it connected successfully. The server name is resolvable as used in the full path. 

Also, here is the command I'm running for step 10:

./ip_block_activate.sh -a on -g /opt/IP-Blacklist/gw_list_file.txt -b /opt/IP-Blacklist/bypass_file.txt -f /opt/IP-Blacklist/feed_file.txt -s /opt/IP-Blacklist/ip_block.sh

I'm still getting the error though.

[HeikoAnkenbrand]

Hi Matt,

In R80.20 it is more effective to do this with the following command on SecureXL level. You may have to build a small script yourself. I'll be creating a script in the next few days.

The blacklist blocks all traffic to and from the specified IP addresses.

The blacklist drops occur in SecureXL, which is more efficient than an Access Control Policy to drop the packets.

This can be very helpful e.g. with DoS attacks to block an IP on SecureXL level.

# fwaccel dos blacklist -a <ip>

# fwaccel dos blacklist -s

# fwaccel dos blacklist -d <ip>

More see here:

R80.20 - IP blacklist in SecureXL 

Regards

Heiko

[Matt_Parfitt]

Thank you, scripting is not my strong point. So I could script it to point to a text file with a list of IP's in?