net/banip/files/README.md

   1 <!-- markdownlint-disable -->
   2
   3 # banIP - ban incoming and outgoing IP addresses/subnets via sets in nftables
   4
   5 ## Description
   6 IP address blocking is commonly used to protect against brute force attacks, prevent disruptive or unauthorized address(es) from access or it can be used to restrict access to or from a particular geographic area — for example. Further more banIP scans the log file via logread and bans IP addresses that make too many password failures, e.g. via ssh.
   7
   8 ## Main Features
   9 * banIP supports the following fully pre-configured domain blocklist feeds (free for private usage, for commercial use please check their individual licenses).
  10   **Please note:** the columns "WAN-INP", "WAN-FWD" and "LAN-FWD" show for which chains the feeds are suitable in common scenarios, e.g. the first entry should be limited to the LAN forward chain - see the config options 'ban\_blockinput', 'ban\_blockforwardwan' and 'ban\_blockforwardlan' below.
  11
  12 | Feed                | Focus                          | WAN-INP | WAN-FWD | LAN-FWD | Information                                                   |
  13 | :------------------ | :----------------------------- | :-----: | :-----: | :-----: | :-----------------------------------------------------------  |
  14 | adaway              | adaway IPs                     |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  15 | adguard             | adguard IPs                    |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  16 | adguardtrackers     | adguardtracker IPs             |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  17 | antipopads          | antipopads IPs                 |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  18 | asn                 | ASN IPs                        |         |         |    x    | [Link](https://asn.ipinfo.app)                                |
  19 | backscatterer       | backscatterer IPs              |    x    |    x    |         | [Link](https://www.uceprotect.net/en/index.php)               |
  20 | bogon               | bogon prefixes                 |    x    |    x    |         | [Link](https://team-cymru.com)                                |
  21 | country             | country blocks                 |    x    |    x    |         | [Link](https://www.ipdeny.com/ipblocks)                       |
  22 | cinsscore           | suspicious attacker IPs        |    x    |    x    |         | [Link](https://cinsscore.com/#list)                           |
  23 | darklist            | blocks suspicious attacker IPs |    x    |    x    |         | [Link](https://darklist.de)                                   |
  24 | debl                | fail2ban IP blacklist          |    x    |    x    |         | [Link](https://www.blocklist.de)                              |
  25 | doh                 | public DoH-Provider            |         |         |    x    | [Link](https://github.com/dibdot/DoH-IP-blocklists)           |
  26 | drop                | spamhaus drop compilation      |    x    |    x    |         | [Link](https://www.spamhaus.org)                              |
  27 | dshield             | dshield IP blocklist           |    x    |    x    |         | [Link](https://www.dshield.org)                               |
  28 | edrop               | spamhaus edrop compilation     |    x    |    x    |         | [Link](https://www.spamhaus.org)                              |
  29 | feodo               | feodo tracker                  |    x    |    x    |    x    | [Link](https://feodotracker.abuse.ch)                         |
  30 | firehol1            | firehol level 1 compilation    |    x    |    x    |         | [Link](https://iplists.firehol.org/?ipset=firehol_level1)     |
  31 | firehol2            | firehol level 2 compilation    |    x    |    x    |         | [Link](https://iplists.firehol.org/?ipset=firehol_level2)     |
  32 | firehol3            | firehol level 3 compilation    |    x    |    x    |         | [Link](https://iplists.firehol.org/?ipset=firehol_level3)     |
  33 | firehol4            | firehol level 4 compilation    |    x    |    x    |         | [Link](https://iplists.firehol.org/?ipset=firehol_level4)     |
  34 | greensnow           | suspicious server IPs          |    x    |    x    |         | [Link](https://greensnow.co)                                  |
  35 | iblockads           | Advertising IPs                |         |         |    x    | [Link](https://www.iblocklist.com)                            |
  36 | iblockspy           | Malicious spyware IPs          |    x    |    x    |         | [Link](https://www.iblocklist.com)                            |
  37 | myip                | real-time IP blocklist         |    x    |    x    |         | [Link](https://myip.ms)                                       |
  38 | nixspam             | iX spam protection             |    x    |    x    |         | [Link](http://www.nixspam.org)                                |
  39 | oisdbig             | OISD-big IPs                   |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  40 | oisdnsfw            | OISD-nsfw IPs                  |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  41 | oisdsmall           | OISD-small IPs                 |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  42 | proxy               | open proxies                   |    x    |         |         | [Link](https://iplists.firehol.org/?ipset=proxylists)         |
  43 | ssbl                | SSL botnet IPs                 |    x    |    x    |         | [Link](https://sslbl.abuse.ch)                                |
  44 | stevenblack         | stevenblack IPs                |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  45 | talos               | talos IPs                      |    x    |    x    |         | [Link](https://talosintelligence.com/reputation_center)       |
  46 | threat              | emerging threats               |    x    |    x    |         | [Link](https://rules.emergingthreats.net)                     |
  47 | threatview          | malicious IPs                  |    x    |    x    |         | [Link](https://threatview.io)                                 |
  48 | tor                 | tor exit nodes                 |    x    |    x    |         | [Link](https://github.com/SecOps-Institute/Tor-IP-Addresses)  |
  49 | uceprotect1         | spam protection level 1        |    x    |    x    |         | [Link](http://www.uceprotect.net/en/index.php)                |
  50 | uceprotect2         | spam protection level 2        |    x    |    x    |         | [Link](http://www.uceprotect.net/en/index.php)                |
  51 | uceprotect3         | spam protection level 3        |    x    |    x    |         | [Link](http://www.uceprotect.net/en/index.php)                |
  52 | urlhaus             | urlhaus IDS IPs                |    x    |    x    |         | [Link](https://urlhaus.abuse.ch)                              |
  53 | urlvir              | malware related IPs            |    x    |    x    |         | [Link](https://iplists.firehol.org/?ipset=urlvir)             |
  54 | webclient           | malware related IPs            |    x    |    x    |         | [Link](https://iplists.firehol.org/?ipset=firehol_webclient)  |
  55 | voip                | VoIP fraud blocklist           |    x    |    x    |         | [Link](https://voipbl.org)                                    |
  56 | yoyo                | yoyo IPs                       |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
  57
  58 * Zero-conf like automatic installation & setup, usually no manual changes needed
  59 * All sets are handled in a separate nft table/namespace 'banIP'
  60 * Full IPv4 and IPv6 support
  61 * Supports nft atomic set loading
  62 * Supports blocking by ASN numbers and by iso country codes
  63 * Supports local allow- and blocklist (IPv4, IPv6, CIDR notation or domain names)
  64 * Auto-add the uplink subnet to the local allowlist
  65 * Provides a small background log monitor to ban unsuccessful login attempts in real-time
  66 * Auto-add unsuccessful LuCI, nginx, Asterisk or ssh login attempts to the local blocklist
  67 * Fast feed processing as they are handled in parallel as background jobs
  68 * Per feed it can be defined whether the wan-input chain, the wan-forward chain or the lan-forward chain should be blocked (default: all chains)
  69 * Automatic blocklist backup & restore, the backups will be used in case of download errors or during startup
  70 * Automatically selects one of the following download utilities with ssl support: aria2c, curl, uclient-fetch or wget
  71 * Supports an 'allowlist only' mode, this option restricts internet access from/to a small number of secure websites/IPs
  72 * Deduplicate IPs accross all sets (single IPs only, no intervals)
  73 * Provides comprehensive runtime information
  74 * Provides a detailed set report
  75 * Provides a set search engine for certain IPs
  76 * Feed parsing by fast & flexible regex rulesets
  77 * Minimal status & error logging to syslog, enable debug logging to receive more output
  78 * Procd based init system support (start/stop/restart/reload/status/report/search/survey)
  79 * Procd network interface trigger support
  80 * Ability to add new banIP feeds on your own
  81
  82 ## Prerequisites
  83 * **[OpenWrt](https://openwrt.org)**, latest stable release or a snapshot with nft/firewall 4 support
  84 * A download utility with SSL support: 'wget', 'uclient-fetch' with one of the 'libustream-*' SSL libraries, 'aria2c' or 'curl' is required
  85 * A certificate store like 'ca-bundle', as banIP checks the validity of the SSL certificates of all download sites by default
  86 * For E-Mail notifications you need to install and setup the additional 'msmtp' package
  87
  88 **Please note the following:**
  89 * Devices with less than 256Mb of RAM are **_not_** supported
  90 * Any previous installation of ancient banIP 0.7.x must be uninstalled, and the /etc/banip folder and the /etc/config/banip configuration file must be deleted (they are recreated when this version is installed)
  91
  92 ## Installation & Usage
  93 * Update your local opkg repository (_opkg update_)
  94 * Install banIP (_opkg install banip_) - the banIP service is disabled by default
  95 * Install the LuCI companion package 'luci-app-banip' (opkg install luci-app-banip)
  96 * It's strongly recommended to use the LuCI frontend to easily configure all aspects of banIP, the application is located in LuCI under the 'Services' menu
  97 * If you're going to configure banIP via CLI, edit the config file '/etc/config/banip' and enable the service (set ban\_enabled to '1'), then add pre-configured feeds via 'ban\_feed' (see the feed list above) and add/change other options to your needs (see the options reference below)
  98 * Start the service with '/etc/init.d/banip start' and check check everything is working by running '/etc/init.d/banip status'
  99
 100 ## banIP CLI interface
 101 * All important banIP functions are accessible via CLI.
 102 ```
 103 ~# /etc/init.d/banip
 104 Syntax: /etc/init.d/banip [command]
 105
 106 Available commands:
 107         start           Start the service
 108         stop            Stop the service
 109         restart         Restart the service
 110         reload          Reload configuration files (or restart if service does not implement reload)
 111         enable          Enable service autostart
 112         disable         Disable service autostart
 113         enabled         Check if service is started on boot
 114         report          [text|json|mail] Print banIP related set statistics
 115         search          [<IPv4 address>|<IPv6 address>] Check if an element exists in a banIP set
 116         survey          [<set name>] List all elements of a given banIP set
 117         running         Check if service is running
 118         status          Service status
 119         trace           Start with syscall trace
 120         info            Dump procd service info
 121 ```
 122
 123 ## banIP config options
 124
 125 | Option                  | Type   | Default                       | Description                                                                           |
 126 | :---------------------- | :----- | :---------------------------- | :------------------------------------------------------------------------------------ |
 127 | ban_enabled             | option | 0                             | enable the banIP service                                                              |
 128 | ban_nicelimit           | option | 0                             | ulimit nice level of the banIP service (range 0-19)                                   |
 129 | ban_filelimit           | option | 1024                          | ulimit max open/number of files (range 1024-4096)                                     |
 130 | ban_loglimit            | option | 100                           | the logread monitor scans only the last n lines of the logfile                        |
 131 | ban_logcount            | option | 1                             | how many times the IP must appear in the log to be considered as suspicious           |
 132 | ban_logterm             | list   | regex                         | various regex for logfile parsing (default: dropbear, sshd, luci, nginx, asterisk)    |
 133 | ban_autodetect          | option | 1                             | auto-detect wan interfaces, devices and subnets                                       |
 134 | ban_debug               | option | 0                             | enable banIP related debug logging                                                    |
 135 | ban_loginput            | option | 1                             | log drops in the wan-input chain                                                      |
 136 | ban_logforwardwan       | option | 1                             | log drops in the wan-forward chain                                                    |
 137 | ban_logforwardlan       | option | 0                             | log rejects in the lan-forward chain                                                  |
 138 | ban_autoallowlist       | option | 1                             | add wan IPs/subnets automatically to the local allowlist                              |
 139 | ban_autoblocklist       | option | 1                             | add suspicious attacker IPs automatically to the local blocklist                      |
 140 | ban_allowlistonly       | option | 0                             | restrict the internet access from/to a small number of secure websites/IPs            |
 141 | ban_basedir             | option | /tmp                          | base working directory while banIP processing                                         |
 142 | ban_reportdir           | option | /tmp/banIP-report             | directory where banIP stores the report files                                         |
 143 | ban_backupdir           | option | /tmp/banIP-backup             | directory where banIP stores the compressed backup files                              |
 144 | ban_protov4             | option | - / autodetect                | enable IPv4 support                                                                   |
 145 | ban_protov6             | option | - / autodetect                | enable IPv4 support                                                                   |
 146 | ban_ifv4                | list   | - / autodetect                | logical wan IPv4 interfaces, e.g. 'wan'                                               |
 147 | ban_ifv6                | list   | - / autodetect                | logical wan IPv6 interfaces, e.g. 'wan6'                                              |
 148 | ban_dev                 | list   | - / autodetect                | wan device(s), e.g. 'eth2'                                                            |
 149 | ban_trigger             | list   | -                             | logical startup trigger interface(s), e.g. 'wan'                                      |
 150 | ban_triggerdelay        | option | 10                            | trigger timeout before banIP processing begins                                        |
 151 | ban_triggeraction       | option | start                         | trigger action on ifup events, e.g. start, restart or reload                          |
 152 | ban_deduplicate         | option | 1                             | deduplicate IP addresses across all active sets                                       |
 153 | ban_splitsize           | option | 0                             | split ext. sets after every n lines/members (saves RAM)                               |
 154 | ban_cores               | option | - / autodetect                | limit the cpu cores used by banIP (saves RAM)                                         |
 155 | ban_nftloglevel         | option | warn                          | nft loglevel, values: emerg, alert, crit, err, warn, notice, info, debug, audit       |
 156 | ban_nftpriority         | option | -200                          | nft priority for the banIP table (default is the prerouting table priority)           |
 157 | ban_nftpolicy           | option | memory                        | nft policy for banIP-related sets, values: memory, performance                        |
 158 | ban_nftexpiry           | option | -                             | expiry time for auto added blocklist members, e.g. '5m', '2h' or '1d'                 |
 159 | ban_feed                | list   | -                             | external download feeds, e.g. 'yoyo', 'doh', 'country' or 'talos' (see feed table)    |
 160 | ban_asn                 | list   | -                             | ASNs for the 'asn' feed, e.g.'32934'                                                  |
 161 | ban_country             | list   | -                             | country iso codes for the 'country' feed, e.g. 'ru'                                   |
 162 | ban_blockinput          | list   | -                             | limit a feed to the wan-input chain, e.g. 'country'                                   |
 163 | ban_blockforwardwan     | list   | -                             | limit a feed to the wan-forward chain, e.g. 'debl'                                    |
 164 | ban_blockforwardlan     | list   | -                             | limit a feed to the lan-forward chain, e.g. 'doh'                                     |
 165 | ban_fetchcmd            | option | - / autodetect                | 'uclient-fetch', 'wget', 'curl' or 'aria2c'                                           |
 166 | ban_fetchparm           | option | - / autodetect                | set the config options for the selected download utility                              |
 167 | ban_fetchinsecure       | option | 0                             | don't check SSL server certificates during download                                   |
 168 | ban_mailreceiver        | option | -                             | receiver address for banIP related notification E-Mails                               |
 169 | ban_mailsender          | option | no-reply@banIP                | sender address for banIP related notification E-Mails                                 |
 170 | ban_mailtopic           | option | banIP notification            | topic for banIP related notification E-Mails                                          |
 171 | ban_mailprofile         | option | ban_notify                    | mail profile used in 'msmtp' for banIP related notification E-Mails                   |
 172 | ban_mailnotification    | option | 0                             | receive E-Mail notifications with every banIP run                                     |
 173 | ban_reportelements      | option | 1                             | list set elements in the report, disable this to speed up the report significantly    |
 174 | ban_resolver            | option | -                             | external resolver used for DNS lookups                                                |
 175
 176 ## Examples
 177 **banIP report information**
 178 ```
 179 ~# /etc/init.d/banip report
 180 :::
 181 ::: banIP Set Statistics
 182 :::
 183     Timestamp: 2023-02-25 08:35:37
 184     ------------------------------
 185     auto-added to allowlist: 0
 186     auto-added to blocklist: 4
 187
 188     Set                  | Elements     | WAN-Input (packets)   | WAN-Forward (packets) | LAN-Forward (packets)
 189     ---------------------+--------------+-----------------------+-----------------------+------------------------
 190     allowlistvMAC        | 0            | -                     | -                     | OK: 0
 191     allowlistv4          | 15           | OK: 0                 | OK: 0                 | OK: 0
 192     allowlistv6          | 1            | OK: 0                 | OK: 0                 | OK: 0
 193     torv4                | 800          | OK: 0                 | OK: 0                 | OK: 0
 194     torv6                | 432          | OK: 0                 | OK: 0                 | OK: 0
 195     countryv6            | 34282        | OK: 0                 | OK: 1                 | -
 196     countryv4            | 35508        | OK: 1872              | OK: 0                 | -
 197     dohv6                | 343          | -                     | -                     | OK: 0
 198     dohv4                | 540          | -                     | -                     | OK: 3
 199     firehol1v4           | 1670         | OK: 296               | OK: 0                 | OK: 16
 200     deblv4               | 12402        | OK: 4                 | OK: 0                 | OK: 0
 201     deblv6               | 41           | OK: 0                 | OK: 0                 | OK: 0
 202     adguardv6            | 12742        | -                     | -                     | OK: 161
 203     adguardv4            | 23183        | -                     | -                     | OK: 212
 204     adguardtrackersv6    | 169          | -                     | -                     | OK: 0
 205     adguardtrackersv4    | 633          | -                     | -                     | OK: 0
 206     adawayv6             | 2737         | -                     | -                     | OK: 15
 207     adawayv4             | 6542         | -                     | -                     | OK: 137
 208     oisdsmallv6          | 10569        | -                     | -                     | OK: 0
 209     oisdsmallv4          | 18800        | -                     | -                     | OK: 74
 210     stevenblackv6        | 11901        | -                     | -                     | OK: 4
 211     stevenblackv4        | 16776        | -                     | -                     | OK: 139
 212     yoyov6               | 215          | -                     | -                     | OK: 0
 213     yoyov4               | 309          | -                     | -                     | OK: 0
 214     antipopadsv4         | 1872         | -                     | -                     | OK: 0
 215     urlhausv4            | 7431         | OK: 0                 | OK: 0                 | OK: 0
 216     antipopadsv6         | 2081         | -                     | -                     | OK: 2
 217     blocklistvMAC        | 0            | -                     | -                     | OK: 0
 218     blocklistv4          | 1174         | OK: 1                 | OK: 0                 | OK: 0
 219     blocklistv6          | 40           | OK: 0                 | OK: 0                 | OK: 0
 220     ---------------------+--------------+-----------------------+-----------------------+------------------------
 221     30                   | 203208       | 12 (2173)             | 12 (1)                | 28 (763)
 222 ```
 223
 224 **banIP runtime information**
 225 ```
 226 ~# /etc/init.d/banip status
 227 ::: banIP runtime information
 228   + status            : active (nft: ✔, monitor: ✔)
 229   + version           : 0.8.2-2
 230   + element_count     : 211397
 231   + active_feeds      : allowlistvMAC, allowlistv4, allowlistv6, adawayv4, adawayv6, adguardv4, adguardtrackersv4, adguardv6, adguardtrackersv
 232                         6, antipopadsv4, antipopadsv6, cinsscorev4, countryv6, countryv4, deblv4, deblv6, dohv4, dohv6, firehol1v4, oisdsmallv
 233                         6, oisdsmallv4, stevenblackv6, stevenblackv4, webclientv4, blocklistvMAC, blocklistv4, blocklistv6
 234   + active_devices    : eth2 ::: wan, wan6
 235   + active_subnets    : 91.64.148.211/24, 2b02:710c:0:80:e442:4b0c:637d:1d33/128
 236   + nft_info          : priority: -200, policy: memory, loglevel: warn, expiry: -
 237   + run_info          : base: /mnt/data/banIP, backup: /mnt/data/banIP/backup, report: /mnt/data/banIP/report, feed: /etc/banip/banip.feeds
 238   + run_flags         : auto: ✔, proto (4/6): ✔/✔, log (wan-inp/wan-fwd/lan-fwd): ✔/✔/✔, dedup: ✔, split: ✘, allowed only: ✘
 239   + last_run          : action: restart, duration: 0m 55s, date: 2023-03-10 19:33:08
 240   + system_info       : cores: 2, memory: 1830, device: Turris Omnia, OpenWrt SNAPSHOT r22248-bf055fcdca
 241 ```
 242
 243 **banIP search information**
 244 ```
 245 ~# /etc/init.d/banip search 221.228.105.173
 246 :::
 247 ::: banIP Search
 248 :::
 249     Looking for IP '221.228.105.173' on 2023-02-08 22:12:48
 250     ---
 251     IP found in Set 'oisdbasicv4'
 252 ```
 253
 254 **banIP survey information**
 255 ```
 256 ~# /etc/init.d/banip survey cinsscorev4
 257 :::
 258 ::: banIP Survey
 259 :::
 260     List the elements of Set 'cinsscorev4' on 2023-03-06 14:07:58
 261     ---
 262 1.10.187.179
 263 1.10.203.30
 264 1.10.255.58
 265 1.11.67.53
 266 1.11.114.211
 267 1.11.208.29
 268 1.12.75.87
 269 1.12.231.227
 270 1.12.247.134
 271 1.12.251.141
 272 1.14.96.156
 273 1.14.250.37
 274 1.15.40.79
 275 1.15.71.140
 276 1.15.77.237
 277 [...]
 278 ```
 279 **default regex for logfile parsing**
 280 ```
 281 list ban_logterm 'Exit before auth from'
 282 list ban_logterm 'luci: failed login'
 283 list ban_logterm 'error: maximum authentication attempts exceeded'
 284 list ban_logterm 'sshd.*Connection closed by.*\[preauth\]'
 285 list ban_logterm 'SecurityEvent=\"InvalidAccountID\".*RemoteAddress='
 286 ```
 287
 288 **allow-/blocklist handling**
 289 banIP supports local allow and block lists (IPv4, IPv6, CIDR notation or domain names), located in /etc/banip/banip.allowlist and /etc/banip/banip.blocklist.
 290 Unsuccessful login attempts or suspicious requests will be tracked and added to the local blocklist (see the 'ban\_autoblocklist' option). The blocklist behaviour can be further tweaked with the 'ban\_nftexpiry' option.
 291 Furthermore the uplink subnet will be added to local allowlist (see 'ban\_autowallowlist' option).
 292 Both lists also accept domain names as input to allow IP filtering based on these names. The corresponding IPs (IPv4 & IPv6) will be extracted in a detached background process and added to the sets.
 293
 294 **allowlist-only mode**
 295 banIP supports an "allowlist only" mode. This option restricts the internet access from/to a small number of secure websites/IPs, and block access from/to the rest of the internet. All IPs and Domains which are _not_ listed in the allowlist are blocked.
 296
 297 **redirect Asterisk security logs to lodg/logread**
 298 banIP only supports logfile scanning via logread, so to monitor attacks on Asterisk, its security log must be available via logread. To do this, edit '/etc/asterisk/logger.conf' and add the line 'syslog.local0 = security', then run 'asterisk -rx reload logger' to update the running Asterisk configuration.
 299
 300 **tweaks for low memory systems**
 301 nftables supports the atomic loading of rules/sets/members, which is cool but unfortunately is also very memory intensive. To reduce the memory pressure on low memory systems (i.e. those with 256-512Mb RAM), you should optimize your configuration with the following options:
 302
 303     * point 'ban_basedir', 'ban_reportdir' and 'ban_backupdir' to an external usb drive
 304     * set 'ban_cores' to '1' (only useful on a multicore system) to force sequential feed processing
 305     * set 'ban_splitsize' e.g. to '1000' to split the load of an external set after every 1000 lines/members
 306     * set 'ban_reportelements' to '0' to disable the CPU intensive counting of set elements
 307
 308 **tweak the download options**
 309 By default banIP uses the following pre-configured download options:
 310 ```
 311     * aria2c: --timeout=20 --allow-overwrite=true --auto-file-renaming=false --log-level=warn --dir=/ -o
 312     * curl: --connect-timeout 20 --fail --silent --show-error --location -o
 313     * uclient-fetch: --timeout=20 -O
 314     * wget: --no-cache --no-cookies --max-redirect=0 --timeout=20 -O
 315 ```
 316 To override the default set 'ban_fetchparm' manually to your needs.
 317
 318 **send E-Mail notifications via 'msmtp'**
 319 To use the email notification you must install & configure the package 'msmtp'.
 320 Modify the file '/etc/msmtprc', e.g.:
 321 ```
 322 [...]
 323 defaults
 324 auth            on
 325 tls             on
 326 tls_certcheck   off
 327 timeout         5
 328 syslog          LOG_MAIL
 329 [...]
 330 account         ban_notify
 331 host            smtp.gmail.com
 332 port            587
 333 from            <address>@gmail.com
 334 user            <gmail-user>
 335 password        <password>
 336 ```
 337 Finally add a valid E-Mail receiver address.
 338
 339 **change existing banIP feeds or add a new one**
 340 The banIP blocklist feeds are stored in an external JSON file '/etc/banip/banip.feeds'.
 341 A valid JSON source object contains the following required information, e.g.:
 342 ```
 343         [...]
 344         "tor": {
 345                 "url_4": "https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst",
 346                 "url_6": "https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst",
 347                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 348                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
 349                 "focus": "tor exit nodes",
 350                 "descurl": "https://github.com/SecOps-Institute/Tor-IP-Addresses"
 351         },
 352         [...]
 353 ```
 354 Add an unique object name (no spaces, no special chars) and make the required changes: adapt at least the URL the regex to the new feed.
 355 **Please note:** if you're going to add new feeds, **always** make a backup of your work, cause this file is always overwritten with the maintainers version on every banIP update.
 356
 357 ## Support
 358 Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-support-thread/16985) or contact me by mail <dev@brenken.org>
 359
 360 ## Removal
 361 * stop all banIP related services with _/etc/init.d/banip stop_
 362 * remove the banip package (_opkg remove banip_)
 363
 364 Have fun!
 365 Dirk