README.md (view raw)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 |
# ngx-http-blocklistd
This is a simple module for [nginx](https://nginx.org/) that communicates offending connections (IPs and ports) that visits honeypot locations to [blocklistd](https://man.netbsd.org/blocklistd.8).
## Building and installing
To build it and run it, you need the [source code of nginx](https://nginx.org/download/). To match your current system, run `nginx -V` and obtain the matching version.
This is an example of building the module on a FreeBSD 15.1 system:
```bash
mkdir -p /opt
cd /opt
git clone https://code.petermolnar.net/ngx-http-blocklistd
wget https://nginx.org/download/nginx-1.30.4.tar.gz
tar xf nginx-1.30.4.tar.gz
cd nginx
make clean
./configure --prefix=/usr/local/etc/nginx --with-cc-opt='-I /usr/local/include' --conf-path=/usr/local/etc/nginx/nginx.conf --sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid --error-log-path=/var/log/nginx/error.log --user=www --group=www --with-compat --with-pcre --modules-path=/usr/local/libexec/nginx --with-file-aio --http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx/access.log --with-ld-opt='-L /usr/local/lib' --add-dynamic-module=/opt/ngx-http-blocklistd
make modules
cp -a objs/ngx_http_blocklistd_module.so /usr/local/libexec/nginx/ngx_http_blocklistd_module.so
```
Once done, add it to your `nginx.conf`:
```nginx
load_module /usr/local/libexec/nginx/ngx_http_blocklistd.so;
[...]
http {
[...]
server {
[...]
location xyz {
blocklistd;
}
}
}
```
## Notes
`nginx` needs a `restart` for all this to work properly. Changes, like including a new module were not picked up by `reload`.
Also: the `blocklistd` keyword takes over the processing of the location, but not the access level stage. It means that for example, rate limiting can be applied.
The module returns and internal HTTP 499 which terminates the connection as fast as possible.
## Verifying
To verify if it's running and sending signals you can either watch `blocklistctl dump` and/or turn on debug error logging in nginx by adding `debug` at the end of your `error_log` config line, like `error_log /var/log/nginx/error.log debug`.
```
blocklistctl dump -a
blocklistd 212.96.81.209/32:443 1/3 2026/09/19 14:26:39
blocklistd 176.191.96.103/32:443 1/3 2026/09/19 14:49:16
blocklistd 77.30.177.90/32:443 1/3 2026/09/19 15:05:50
blocklistd 165.101.180.152/32:443 1/3 2026/09/19 15:19:37
blocklistd 109.172.187.226/32:443 1/3 2026/09/19 16:04:49
blocklistd 116.179.33.78/32:443 1/3 2026/09/19 16:20:22
blocklistd 188.26.195.253/32:443 1/3 2026/09/19 16:49:16
blocklistd 85.86.59.80/32:443 1/3 2026/09/19 17:15:08
blocklistd 39.109.119.43/32:443 1/3 2026/09/19 18:06:57
blocklistd 176.18.70.175/32:443 1/3 2026/09/19 14:04:56
[...]
```
## pf and blocklistd configuration
For blocklistd to work with pf you need to add it to your `pf.conf`:
```
table <blocklistd> persist
[...]
anchor "blocklistd/*"
block in from <blocklistd>
```
You'll aso need to extend `/etc/blocklistd.conf` with http and https entries:
```ini
[local]
ssh stream * * * 3 24h
ftp stream * * * 3 24h
smtp stream * * * 3 24h
submission stream * * * 3 24h
submissions stream * * * 3 24h
http stream * * * 3 24h
https stream * * * 3 24h
```
To list the IPs:
```
pfctl -a blocklistd/80 -t port80 -T show
pfctl -a blocklistd/443 -t port443 -T show
```
|