How do I block a host by ASN? Example - AS16276

Question

There are a handful of especially toxic hosts out there. There is no reason we need to allow any of their IP's access to our servers. Is there a way we can block them using their ASN or other global identifier? I would prefer to do this in HTACCESS for app/server portability, but APF is fine too.

An example would be blocking the following hosts. Over 50% of their IP's are on blacklists already, or they operate proxy exit points for companies like PacketFlip:

• AS4134 - ChinaNet
• AS9808 - Guangdong Mobile Com
• AS16276 - OVH SAS
• AS15003 - Nobis Tech Group
• AS36352 - ColoCrossing
• AS29761 - QuadraNet
• AS15895 - Kyivstar PJSC
• AS50915 - S.C. Everhost S.R.L.
• AS53889 - Micfo
• AS57858 - Fiber Grid OU

Answer 1

You can use https://www.enjen.net/asn-blocklist/

An example i.e. colocrossing: https://www.enjen.net/asn-blocklist/index.php?asn=AS36352&type=htaccess

If you need to download it to a server and don't want html then add &api=1 to the end of the link.

Answer 2

Check out mod_asn:

mod_asn is an Apache module that uses BGP routing data to look up the autonomous system (AS) and the network prefix (subnet) which contains a given (clients) IP address.

mod_asn is usable as standalone module, and the lookup result can be used by scripts or other Apache modules. For instance, a download redirector could base its decisions on the lookup result provided by mod_asn.

I don't have any direct experience with this, but it sounds promising.

Someone with direct experience with this module should feel free to edit this answer to add relevant specific details.

Additionally, you can talk with your network administrator to have these ASNs blocked or ignored at the router, then you don't have to make this an application configuration problem. A (major?) drawback to the mod_asn approach is that it doesn't stop naughty IP addresses from trying to attack other services on your host or network, it will only drop HTTP/HTTPS requests to the configured apache servers.

Answer 3

Ok, although Mun's answer is spot on for finding ASN's, it relies on static checks/updates then pasting into deny lists/firewalls. I have been using APF for too long. Looking through configs, I realized that CSF firewall has an option to block via ASN and/or country code (ISO). It queries Maxmind GEOIP database. Here is the desc from /etc/csf/csf.conf

SECTION:Country Code Lists and Settings

Country Code to CIDR allow/deny. In the following two options you can allow or deny whole country CIDR ranges. The CIDR blocks are generated from the Maxmind GeoLite Country database http://www.maxmind.com/app/geolitecountry and entirely relies on that service being available

Specify the the two-letter ISO Country Code(s). The iptables rules are for incoming connections only

Additionally, ASN numbers can also be added to the comma separated lists below that also list Country Codes. The same WARNINGS for Country Codes apply to the use of ASNs. More about Autonomous System Numbers (ASN): http://www.iana.org/assignments/as-numbers/as-numbers.xhtml

You should consider using LF_IPSET when using any of the following options

WARNING: These lists are never 100% accurate and some ISP's (e.g. AOL) use non-geographic IP address designations for their clients

WARNING: Some of the CIDR lists are huge and each one requires a rule within the incoming iptables chain. This can result in significant performance overheads and could render the server inaccessible in some circumstances. For this reason (amongst others) we do not recommend using these options

WARNING: Due to the resource constraints on VPS servers this feature should not be used on such systems unless you choose very small CC zones

WARNING: CC_ALLOW allows access through all ports in the firewall. For this reason CC_ALLOW probably has very limited use and CC_ALLOW_FILTER is preferred

Each option is a comma separated list of CC's, e.g. "US,GB,DE"

The conf options in question are these:

CC_DENY=""

CC_ALLOW=""

And there are more specific filters below it in the conf file to further groom blockage.

Answer 4

Yes, it's possible, and it work!

Make sure you are legally entitled to use an mmdb ASN database.

1. Get a legal to ASN to IP use database. Check if the below connection is offered according to rights: GitHub: P3TERX/GeoLite.mmdb: MaxMind's GeoIP2 GeoLite2 Country, City, and ASN databases

And place it in a directory as:

/usr/share/GeoIP/GeoLite2-ASN.mmdb

And also download the country database:

# curl -Lo /usr/share/GeoIP/GeoLite2-Country.mmdb https://git.io/GeoLite2-Country.mmdb

Before installing mod_maxminddb do the following:

2. Install the libmaxminddb library. This can be installed via PPA in Ubuntu.

 sudo add-apt-repository ppa:maxmind/ppa
 
 sudo apt update
 
 sudo apt install libmaxminddb0 libmaxminddb-dev mmdb-bin

3. Install the dev package for your apache version, in my case, this was done like below:

# sudo apt install apache2-dev

4. Installing MaxMind with Apache:

# curl -Lo /usr/share/GeoIP/mod_maxminddb-1.2.0.tar.gz https://github.com/maxmind/mod_maxminddb/releases/download/1.2.0/mod_maxminddb-1.2.0.tar.gz

# tar -xvzf /usr/share/GeoIP/mod_maxminddb-1.2.0.tar.gz -C ~/

# cd ~/mod_maxminddb-1.2.0

Note. ~ is short for the home directory.

After going to the directory the ModMaxminddb was downloaded to, activate it:

# ./configure

# sudo make install

5. Set .htaccess rule to block certain ASN (ISPs):

<IfModule mod_maxminddb.c>

MaxMindDBEnable On

MaxMindDBSetNotes On

MaxMindDBFile CITY_DB /usr/share/GeoIP/GeoLite2-City.mmdb

MaxMindDBFile ASN_DB /usr/share/GeoIP/GeoLite2-ASN.mmdb



MaxMindDBEnv COUNTRY_CODE CITY_DB/country/iso_code

MaxMindDBEnv CONTINENT_CODE CITY_DB/continent/code

MaxMindDBEnv MM_ASN ASN_DB/autonomous_system_number

MaxMindDBEnv MM_ASORG ASN_DB/autonomous_system_organization

MaxMindDBNetworkEnv ASN_DB ASN_DB_NETWORK

SetEnvIf MM_ASN ^(31708|9930|26496|21501|12876|38731|41564|399471|51852) BlockAsn
SetEnvIf Remote_Addr ^(66\.249\.) !BlockAsn
SetEnvIf REQUEST_URI ^(.*/\.well\-known/acme\-challenge/.*) !BlockAsn
order allow,deny
allow from all
Deny from env=BlockAsn <env=SecondBlockName> <env=ThirdBlockName>

</IfModule>

Test via curl on SSH CLI:

curl -I --header "X-Forwarded-For: 52.47.88.71" "https://currenge.com/" --referer "https://google.com/" --user-agent "hsts-preload-bot"


curl -I --header "X-Forwarded-For: 3.249.149.161" "https://currenge.com/" --referer "https://google.com/" --user-agent "Hola"


curl -I --header "X-Forwarded-For: 23.128.248.18" "https://currenge.com/" --referer "https://google.com/" --user-agent "Hola"


curl -I --header "X-Forwarded-For: 34.76.75.95" "https://currenge.com/" --referer "https://google.com/" --user-agent "Duplex on the web"

curl -I --header "X-Forwarded-For: 34.76.75.45" "https://currenge.com/" --referer "https://google.com/" --user-agent "yadadd"


curl -I --header "X-Forwarded-For: 34.76.75.25" "https://currenge.com/" --referer "https://google.com/" --user-agent "balbla"


curl -I --header "X-Forwarded-For: 104.167.241.0" "https://currenge.com/" --referer "https://google.com/" --user-agent "bing"

curl -I --header "X-Forwarded-For: 104.167.241.0" "https://currenge.com/" --referer "https://google.com/" --user-agent "Bella"


curl -I --header "X-Forwarded-For: 34.76.78.159" "https://currenge.com/" --referer "https://google.com/" --user-agent "Duplex on the web"


curl -I --header "X-Forwarded-For: 104.167.241.20" "https://currenge.com/" --referer "https://google.com/" --user-agent "Bingbot"

Answer 5

So in regards to this statement: CSF I wanted to clarify a few things. You can automate with asn-blocklist. All you need to do is add '&api=1' to the end of your url. For example: https://www.enjen.net/asn-blocklist/index.php?asn=AS36352&type=nginx&api=1

This will download a raw version of the file without any html. All you need to do after such is automate with a simple bash script on using wget, copying over the old file, and reloading your program(nginx).

#!/bin/bash

mkdir /tmp/asn
cd /tmp/asn

wget --content-disposition "https://www.enjen.net/asn-blocklist/index.php?asn=AS36352&type=nginx&api=1"
wget --content-disposition "https://www.enjen.net/asn-blocklist/index.php?asn=AS133165&type=nginx&api=1"
## Repeat wget here for all the asns you want. 

cp /tmp/asn/* /etc/nginx/conf.d/
service nginx reload

rm -rf /tmp/asn
echo done...

In effect, you can quickly keep your blocklist(s) up to date, and without the use of manual importing of the blocklist(s).

At that it is simply understanding your usage case / platform to automate the script for your personal needs.