TIPS Bulk load whitelist IPs in ipbx2020's firewall?

[JFrost]

Hey now.
Is there a relatively easy way to load a list of IPs into the firewall to whitelist? (like a copy/paste to a file would be great)

This is for uptime robot. The list is like 60 or 70 IPs so I don't wanna do it by hand.

Thank you

 

[dhoppy]

If they are ranges, then you can use the add-ip script like this one I use for adding Vitelity IP address ranges:

./add-ip vitelity1 64.2.142.0/24

 

[JFrost]

They are close-ish but not complete ranges that can notate like that. They are disparate IPs.

Thx anyway tho.

 

[wardmundy]

@JFrost: Take a look at /usr/local/sbin/iptables-custom. Toward the end of the file and just above End of Trusted Provider section, you'll see some entries that look like this:

/usr/sbin/iptables -I INPUT -s 167.99.119.244  -j ACCEPT

What I typically do is load your list of IP addresses below there. Then cut-and-paste "/usr/sbin/iptables -I INPUT -s " to the front of each address. Then cut-and-paste " -j ACCEPT" to the end of each line. Save changes and iptables-restart.

 

[JFrost]

Thanks @wardmundy . Will this accept FQDNs as well as IPs? I just saw they publish a list of IPs or a list of fqdns (linked below in case it helps)

https://uptimerobot.com/inc/files/ips/IPv4.txt

https://uptimerobot.com/inc/files/ips/IPv6.txt

https://uptimerobot.com/inc/files/ips/hostnames.txt

thx.

 

[wardmundy]

FQDNs are fine in iptables-custom. That's what it was originally designed for.

 

[dhoppy]

Will this accept FQDNs as well as IPs?

 

[ostridge]

The list is like 60 or 70 IPs

So you have a list - well you could edit the list to make it into a script.

#!/bin/bash
#format  no-spaces-in-name no.spacesin.ip.address
#/root/add-ip namewithoutspaces 123.456.789.10

/root/add-ip ip-vitelity1 64.2.142.0/24
/root/add-ip ip-yourprovider2 64.2.142.0/24
 
#format FQDN's  no-spaces-in-name no-spaces-in-fqdn-address
#/root/add-fqdn namewithoutspaces <sip.yourprovider.com>

/root/add-fqdn fq-examplename1 <sip.example.com>
/root/add-fqdn fq-examplename2 <proxy.annotherexample.com>

Of course you will need to know how to make that file into an executable script - so just ask again.

 

[JFrost]

Thanks all.

So the way I did it was open the list of IPs in excel then I made a new column before and after and added the pre and post parts of the command (and copied down as far as I needed). Then in a 4th column I did a 'concatenate' of the 3 columns to build up a command.

Then I exported that as CSV, opened it in Notepad++ and using column mode trimmed away all the extra stuff (other columns on teh sheet, etc)

Last, copied the manicured list and pasted it into nano.
A little ghetto-style but did the trick. Whitelist works great now.

Ty.

 

[JFrost]

Had to rebuild on Deb 10 and 2021 so circling back here. For anyone else, Notepad++ has a column mode that I didn't know about last time. Makes this much easier (no janking around with Excel or extra steps.)

Also, I tried adding their IPv6 addresses and iptables choked. Do we not handle IPv6 (does it matter) or is iptables-custom the wrong file to do it in?

thx.

 

[kenn10]

IncrediblePBX does not support IPV6 and if you loaded IPV6 in the iptables_custom, that will definitely screw things up. Don't load IPV6 at all.

 

[JFrost]

IncrediblePBX does not support IPV6 and if you loaded IPV6 in the iptables_custom, that will definitely screw things up. Don't load IPV6 at all.

Yes, as I pointed out, iptables choked on restart.

Wasn't sure if that was strictly because iPBX doesn't support at all or if there was another procedure so now I know.

 

[wardmundy]

For a scripting solution to do a bulk load of IP addresses to your whitelist, take a look at this script we used to load the new Skyetel 2 IP addresses:

http://incrediblepbx.com/update202030.tar.gz

And for those that don't remember the history, we developed the iptables-custom add-on for IPtables after we discovered that a single, failed FQDN in the base IPtables config file caused the entire IPtables load to fail. With iptables-custom, each IP address or FQDN address is loaded separately. So, if one address or FQDN fails, it simply gets skipped and the script moves on to the next rule to load.

 

[krzykat]

Will this accept FQDNs as well as IPs?

Yes, but make sure the FQDN's are static. If they change, the IPtables won't know about it unless it is reloaded. In cases where we've had external sites that needed to be whitelisted to a not so static IP's, we've had a Cronjob that does a reload once a day.

 

[KUMARULLAL]

For a scripting solution to do a bulk load of IP addresses to your whitelist, take a look at this script we used to load the new Skyetel 2 IP addresses:

http://incrediblepbx.com/update202030.tar.gz

And for those that don't remember the history, we developed the iptables-custom add-on for IPtables after we discovered that a single, failed FQDN in the base IPtables config file caused the entire IPtables load to fail. With iptables-custom, each IP address or FQDN address is loaded separately. So, if one address or FQDN fails, it simply gets skipped and the script moves on to the next rule to load.

Great,
I am assuming the entries in iptables-custom, be deleted as well.
Can ports be specified as well?

 

[wardmundy]

Delete anything you like, and any IPtables commands can be included. Just remember to use iptables-restart to start and restart IPtables as it loads the base config and then the iptables-custom rules.