Community discussions

MikroTik App
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Wed Jan 17, 2018 7:20 pm

Very sorry about that guys. I had to upgrade some server hardware, so I migrated the VM's to a different server. The new server didn't import the DNS vm. The old server if back online now and the VM's returned to their home. All should be good now.
 
mducharme
Trainer
Trainer
Posts: 1777
Joined: Tue Jul 19, 2016 6:45 pm
Location: Vancouver, BC, Canada

Re: Blacklist Filter update script

Wed Jan 17, 2018 8:12 pm

Very sorry about that guys. I had to upgrade some server hardware, so I migrated the VM's to a different server. The new server didn't import the DNS vm. The old server if back online now and the VM's returned to their home. All should be good now.
I had to manually lower the serial number to get the blacklist back, it thought it had the latest blacklist but it was actually empty. (under Scripts in the Environment tab)
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Wed Jan 17, 2018 8:23 pm

I had actually started looking into moving the service to a distributed cloud to prevent this, but It looks like I may be shutting down my business and taking over running a nonprofit.
 
servaris
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Tue May 20, 2014 4:30 pm
Location: Planet Earth
Contact:

[SOLVED] Re: Blacklist Filter update script

Wed Jan 17, 2018 9:47 pm

Thanks to mducharme for pointing out the fix to the failed updates.

Go to system -> scripts
Click on Environment

Negatively increment your blSerial by 1. To be clear, the blSerial WAS 1516197642 and now its 1516197641 as shown below.
script-environment.png
You do not have the required permissions to view the files attached to this post.
 
amity2kare
newbie
Posts: 35
Joined: Tue Feb 13, 2007 4:24 pm
Location: INDIA

Re: Blacklist Filter update script

Thu Jan 18, 2018 10:25 pm

Script works fine at my end. However the address list entries (IntrusBL) disappear in a couple of hours. I have been noticing this behavior since i installed this script and have tried upgrading my routeros version as well but to no avail. My current config is routeros 6.39.3 on CCR1072-1G-8S+.
 
Jacka
Member Candidate
Member Candidate
Posts: 125
Joined: Thu Jan 13, 2011 11:34 am

Re: Blacklist Filter update script

Fri Jan 19, 2018 4:23 pm

The script is still operational ? It's not working in my case. The is no code inside the script...

Image
 
User avatar
frank333
Member
Member
Posts: 330
Joined: Mon Dec 18, 2017 12:17 pm
Location: S.Marino Router model: RB3011UiAS-RM+RBM11G

Re: Blacklist Filter update script

Mon Jan 22, 2018 12:02 am

The script works very well! Thanks IntrusDave, you are a Wizard Master! :)
 
Jacka
Member Candidate
Member Candidate
Posts: 125
Joined: Thu Jan 13, 2011 11:34 am

Re: Blacklist Filter update script

Mon Jan 22, 2018 9:59 am

The script works very well! Thanks IntrusDave, you are a Wizard Master! :)
Then, what I'm doing wrong? Can smb help me out. Thank you.
 
User avatar
frank333
Member
Member
Posts: 330
Joined: Mon Dec 18, 2017 12:17 pm
Location: S.Marino Router model: RB3011UiAS-RM+RBM11G

Re: Blacklist Filter update script

Mon Jan 22, 2018 11:33 am

Then, what I'm doing wrong? Can smb help me out. Thank you.
Jacka,
  • eliminates old variables in the environment
1.png
  • eliminates all blacklists scripts and scheduler
  • reboot router
  • rewrites the launch script
3.png
  • starts the blacklistUpdate script --->run script
  • Must work, it controls ip-->firewall-->address list list
PS:What router and what ros version do you have?
You do not have the required permissions to view the files attached to this post.
Last edited by frank333 on Mon Jan 29, 2018 3:30 am, edited 1 time in total.
 
amity2kare
newbie
Posts: 35
Joined: Tue Feb 13, 2007 4:24 pm
Location: INDIA

Re: Blacklist Filter update script

Mon Jan 22, 2018 2:35 pm

Script works fine at my end. However the address list entries (IntrusBL) disappear in a couple of hours. I have been noticing this behavior since i installed this script and have tried upgrading my routeros version as well but to no avail. My current config is routeros 6.39.3 on CCR1072-1G-8S+.
Any help IntrusDave?
 
kakaxa
just joined
Posts: 15
Joined: Thu Feb 01, 2018 5:46 am

Re: Blacklist Filter update script

Thu Feb 01, 2018 12:00 pm

Thanks @IntrusDave, great work!
 
kakaxa
just joined
Posts: 15
Joined: Thu Feb 01, 2018 5:46 am

Re: Blacklist Filter update script

Fri Feb 02, 2018 8:21 pm

Help me please.
The script works fine, but after adding records to the dynamic sheet, after 15-20 minutes, these records are deleted
Help me understand what this is happening? in the log or what is not

Sorry for my English

-------
Помогите пожалуйста.
Скрипт работает отлично, но после добавления записей в динамический лист, спустя 15-20 минут, эти записи удаляются
Помогите понять от чего такое происходит? в логах ни чего нет
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sat Feb 03, 2018 4:51 am

Make sure you blDataPath does not start with a /
i.e. it should read "disk1/blTemp.rsc" NOT "/disk1/blTemp.rsc"
 
User avatar
nichky
Forum Guru
Forum Guru
Posts: 1281
Joined: Tue Jun 23, 2015 2:35 pm

Re: Blacklist Filter update script

Sat Feb 03, 2018 6:14 am

Thanks :)
 
kakaxa
just joined
Posts: 15
Joined: Thu Feb 01, 2018 5:46 am

Re: Blacklist Filter update script

Sat Feb 03, 2018 9:59 am

Make sure you blDataPath does not start with a /
i.e. it should read "disk1/blTemp.rsc" NOT "/disk1/blTemp.rsc"
I'm use the default, path is not change.
On 6.41 work fine, or 6.39.3 the list is cleared after 15min :(

UPD: update mikrotik to 6.41 - script works, list nod cleared
 
dehghanimeysam
just joined
Posts: 1
Joined: Sat Feb 10, 2018 4:41 am

Re: Blacklist Filter update script

Sat Feb 10, 2018 4:56 am

Thank you for providing this
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11619
Joined: Thu Mar 03, 2016 10:23 pm

Re: Blacklist Filter update script

Sun Mar 11, 2018 11:16 pm

A huge thank you from me!

And a question: does anybody know of a similar list, covering IPv6 address filtering?
 
specky
just joined
Posts: 1
Joined: Sun Aug 24, 2014 5:43 pm

Re: Blacklist Filter update script

Mon Mar 19, 2018 11:47 pm

Great script

But its caught a few false positives in the mix from a service we use called Everycloud.
Thanks
 
Grolski
just joined
Posts: 1
Joined: Mon Mar 19, 2018 8:05 pm

Re: Blacklist Filter update script

Thu Mar 22, 2018 1:22 pm

Hello,

I am very impressed with the effectiveness with the IP blacklist by IntrusDave and the scripts he has written. It is the most effective from the ones (the usual suspects) I have used so far.

I have two issue/questions (as none expert) that someone may easily solve.

1. I Drop all Input into my router with some exceptions to allow management. This is effective but also blocks the script to contact the servers and download the latest ip blacklist. What is the best solution to overcome this issue. Remove the Drop all input towards my router or enter an exception rule to allow the script to work. The attempts that I have tried (Layer 7 protocol with URL) were not successful. :(
2. Is there a easy way to extend the Timeout of Dave's list so one could run the script every two days or so? Maybe it is unwise to do so and that could also be an answer.

Regards
Wilko
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sat Mar 24, 2018 5:32 pm

It's been a nice run. Almost 3 years, and over 2200 active users. But I am shutting down the this service. With the new US tax laws and this new US "sex trafficking law" (which isn't really about sex trafficking) I simply can't afford to keep the service running. Bandwidth and rack space is just too expensive now, and I'm making $0.

Thank you all for the support.
 
RyperX
Frequent Visitor
Frequent Visitor
Posts: 72
Joined: Thu May 21, 2015 11:14 am

Re: Blacklist Filter update script

Sat Mar 24, 2018 6:12 pm

Thank you for providing this service for so long, worked really well!

Maybe you could create a guide how it would be possible to create such lists by his own or where you fetch all the information?
 
Taylor
newbie
Posts: 33
Joined: Wed Aug 13, 2014 12:27 am

Re: Blacklist Filter update script

Sat Mar 24, 2018 6:23 pm

It's been a nice run. Almost 3 years, and over 2200 active users. But I am shutting down the this service. With the new US tax laws and this new US "sex trafficking law" (which isn't really about sex trafficking) I simply can't afford to keep the service running. Bandwidth and rack space is just too expensive now, and I'm making $0.

Thank you all for the support.
bw is cheap i can get a server for 8 bucks a month with 12TB of bw. i feel its more than cost as to why you're stopping it.

Need any help?
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sat Mar 24, 2018 7:40 pm

bw is cheap i can get a server for 8 bucks a month with 12TB of bw. i feel its more than cost as to why you're stopping it.

Need any help?
If you think $8/month is the cost of a real server, a real firewall, real rack space, real bandwidth, real maintenance, real electricity... Then you are either delusional or have never owned/operated a true network. My servers are not shared VPS servers at some bulk hosting company. My firewalls are not software firewalls. For the last 17 years I have maintained a 48U rack, with 10gbps redundant fiber, a diesel generator with enough fuel for 7 days, a double-conversion UPS with 8 hours of backup time. The rack holds 13 servers, the smallest is an 8 core xeon with 8TB storage and 64GB ram. The largest being dual 12 core xeon, 384GB ram and 64TB. I have 3 CCR1016's and 2 CCR1072's.

So no, $8 doesn't cover it.

I'm also betting that 95% of the 2200 users of the list would not accept pulling a script from a shared server and then running it on their routers. The amount of security and isolation required is far beyond what you can do with a bulk host. Each step of the process to collect the data, build the list, and then push out the list is isolated from the net, not even on the same network that is connected to the internet.

Not to mention the amount of posts, PMs, and emails I get from users demanding that I make changes or run things a different way. It's just not worth it anymore.
 
Taylor
newbie
Posts: 33
Joined: Wed Aug 13, 2014 12:27 am

Re: Blacklist Filter update script

Sat Mar 24, 2018 10:01 pm

I would be fine with keeping the service alive. Having a 48u rack for such a piss easy and small script is a bit outrageous. I think you're the delusional one. I"m sure you used that rack for way more than this script.

I'm simply saying you can keep the script stuff online for way cheaper if you wanna still help the community.
 
User avatar
Rhoos
just joined
Posts: 22
Joined: Sun Dec 20, 2015 3:48 pm
Location: Costa Rica
Contact:

Re: Blacklist Filter update script

Sun Mar 25, 2018 12:31 am

Thank you Dave for such a great service provided all these years; would it be possible for you to put at the disposal of "premium" users of this forum your IP blacklist system so that someone else can continue to provide the service?

Richard
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sun Mar 25, 2018 2:00 am

I would be fine with keeping the service alive. Having a 48u rack for such a piss easy and small script is a bit outrageous. I think you're the delusional one. I"m sure you used that rack for way more than this script.

I'm simply saying you can keep the script stuff online for way cheaper if you wanna still help the community.
Never said my company was dedicated to the blacklist. It's BS like this that helped me decide to shut it down.
 
chippers
newbie
Posts: 26
Joined: Tue Apr 02, 2013 7:45 am

Re: Blacklist Filter update script

Sun Mar 25, 2018 2:29 am

Hey Dave, really sorry to hear you are shutting down but completely understand. Just like to thank you for the script and for me personally, I used it on multiple devices with multiple customers and it must have saved me more than a few times from bad things happening. I used to monitor the firewall rule connected to the script and see the bytes get blocked. It was amazing how high it got at times.

Echoing others here, I would encourage you to throw everything on GitHub or similar, if for nothing else, for us all to learn from your scripting and infra experience, its how the community grows. Once again, thanks for the excellent script and your (free) support of this product. I wish you well in your new role.
 
User avatar
Deantwo
Member
Member
Posts: 331
Joined: Tue Sep 30, 2014 4:07 pm

Re: Blacklist Filter update script

Sun Mar 25, 2018 2:31 am

So this is why have gotten notification emails from this thread all day.
Sorry to hear you are shutting down Dave, but with what you explain it is understandable.

I ended up making my own blacklist script last year, so I never actually used your service much more than as a test. But I at least want to thank you for the help and inspection you gave me. ^^

I'd glady share a few snippets from my scripts if people are interested. Mostly I made a C# program that create a dynamic blacklist file every 4 or so hours from different public blacklists and format them into a single script files for my routers to download.
 
Taylor
newbie
Posts: 33
Joined: Wed Aug 13, 2014 12:27 am

Re: Blacklist Filter update script

Sun Mar 25, 2018 4:01 am

I would be fine with keeping the service alive. Having a 48u rack for such a piss easy and small script is a bit outrageous. I think you're the delusional one. I"m sure you used that rack for way more than this script.

I'm simply saying you can keep the script stuff online for way cheaper if you wanna still help the community.
Never said my company was dedicated to the blacklist. It's BS like this that helped me decide to shut it down.
You did, otherwise why would we care if you had to pay for a 48u rack? Why even mention that? That has nothing to do with this script.

I'd advise you to publish your scripts and collections on github and maybe someone will pick it up and use an $8/m VDS for us ;)

But i'm fairly certain you wont.
 
jgro
newbie
Posts: 49
Joined: Sat Jun 10, 2017 7:33 am

Re: Blacklist Filter update script

Sun Mar 25, 2018 4:47 am

It's been a nice run. Almost 3 years, and over 2200 active users. But I am shutting down the this service.
Thank you, Dave, for a valiant effort.

For everyone who was using Dave's Blacklist, let me recommend the Malicious IP blacklist from SquidBlackList.org, available for download from https://www.squidblacklist.org/download ... licous.rsc . I've been using it for a while and have not run into any problems because of it.

You can download and import it with a simple script:
# File path for squid blacklist. Change to use attached storage if available (e.g. "disk1/bl/drop.malicious.rsc")
:local sblPath "flash/bl/drop.malicious.rsc"
 

:log warning "Downloading squidblacklist malicious BL to $sblPath"

/tool fetch address=www.squidblacklist.org host=www.squidblacklist.org mode=http src-path=/downloads/drop.malicious.rsc dst-path=$sblPath  ;


:log warning "Importing squidblacklist malicious BL from $sblPath"

/import  $sblPath  ;
The downloaded blacklist does not actually block anything, it just creates 3 address lists you can do what you want with (1 for each of the 3 sources they use to compose the final list). I have:
/ip firewall raw
add action=drop chain=prerouting comment="Attack from sbl dshield" log=yes log-prefix="BL dshield" src-address-list="sbl dshield"
add action=drop chain=prerouting comment="Attack from sbl blocklist.de" log=yes log-prefix="BL blocklist.de" src-address-list="sbl blocklist.de"
add action=drop chain=prerouting comment="Attack from sbl spamhaus" src-address-list="sbl spamhaus"
 
Ryo
just joined
Posts: 5
Joined: Thu Jan 11, 2018 8:00 am

Re: Blacklist Filter update script

Sun Mar 25, 2018 7:22 pm

Hi Dave, thanks for ur work.

but i think mod should unpin this thread because this script/service is no longer working.
 
msatter
Forum Guru
Forum Guru
Posts: 2912
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Blacklist Filter update script

Sun Mar 25, 2018 9:14 pm

Thanks Dave for the free ride and it worked very good. Learned a lot with which I can help other...even with my limiting knowledge of scripting.

Gonna miss the flawless working of it!
 
amity2kare
newbie
Posts: 35
Joined: Tue Feb 13, 2007 4:24 pm
Location: INDIA

Re: Blacklist Filter update script

Sun Mar 25, 2018 9:24 pm

Thanks Dave,

It's people like you who keep the community alive with their contributions. Best of luck with your new role.

Regards
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2880
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Blacklist Filter update script

Sun Mar 25, 2018 11:49 pm

Thank you Dave.
Could you be so kind and shere your valuable technology? Could you publish all scripts?
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sun Mar 25, 2018 11:57 pm

Thank you Dave.
Could you be so kind and shere your valuable technology? Could you publish all scripts?
Unfortunately no. The server side (contrary to what a few hear think) isn't just a "script" it's a network of over 300 honeypots and some very advanced AI code to analyze threats. That system is proprietary and is still in use for the paying clients that I have left. Even if it wasn't in use, it's not just a simple script that I can post. Nor do I want to give away thousands of hours of code.

there is a chance that I will bring it back, but on a low cost subscription basis. though it's doubtful.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2880
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Blacklist Filter update script

Mon Mar 26, 2018 12:04 am

I understand your decision about server side. What about just client side code?
 
eddieb
Member
Member
Posts: 327
Joined: Thu Aug 28, 2014 10:53 am
Location: Netherlands

Re: Blacklist Filter update script

Mon Mar 26, 2018 11:46 am

Thanks for all the effort you put into this Dave.
I was using your service for over a year and it helped me to keep my network save.
I surely would consider a small subscription fee to keep it

Eddie
 
User avatar
amt
Long time Member
Long time Member
Posts: 529
Joined: Fri Jan 16, 2015 2:05 pm

Re: Blacklist Filter update script

Mon Mar 26, 2018 12:08 pm

Thank you for providing this great service .....
 
User avatar
amt
Long time Member
Long time Member
Posts: 529
Joined: Fri Jan 16, 2015 2:05 pm

Re: Blacklist Filter update script

Mon Mar 26, 2018 12:12 pm

It's been a nice run. Almost 3 years, and over 2200 active users. But I am shutting down the this service.
Thank you, Dave, for a valiant effort.

For everyone who was using Dave's Blacklist, let me recommend the Malicious IP blacklist from SquidBlackList.org, available for download from https://www.squidblacklist.org/download ... licous.rsc . I've been using it for a while and have not run into any problems because of it.

You can download and import it with a simple script:
# File path for squid blacklist. Change to use attached storage if available (e.g. "disk1/bl/drop.malicious.rsc")
:local sblPath "flash/bl/drop.malicious.rsc"
 

:log warning "Downloading squidblacklist malicious BL to $sblPath"

/tool fetch address=www.squidblacklist.org host=www.squidblacklist.org mode=http src-path=/downloads/drop.malicious.rsc dst-path=$sblPath  ;


:log warning "Importing squidblacklist malicious BL from $sblPath"

/import  $sblPath  ;
The downloaded blacklist does not actually block anything, it just creates 3 address lists you can do what you want with (1 for each of the 3 sources they use to compose the final list). I have:
/ip firewall raw
add action=drop chain=prerouting comment="Attack from sbl dshield" log=yes log-prefix="BL dshield" src-address-list="sbl dshield"
add action=drop chain=prerouting comment="Attack from sbl blocklist.de" log=yes log-prefix="BL blocklist.de" src-address-list="sbl blocklist.de"
add action=drop chain=prerouting comment="Attack from sbl spamhaus" src-address-list="sbl spamhaus"
what should i use for storage ? I have 72 core and there is no any attached storage. should i add for this job ? now its using flash. is make any problem for using flash for this job ?

thanks.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2880
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Blacklist Filter update script

Mon Mar 26, 2018 12:25 pm

It is temporary locations to download ... it does not matter where it is ... after importing lists script could be removed form flash, disk etc.
 
User avatar
acortesguasch
just joined
Posts: 7
Joined: Tue Dec 19, 2017 6:04 pm

Re: Blacklist Filter update script

Mon Mar 26, 2018 3:54 pm

DAve, thank you fo your insight and the servce you provided. It will be missed.
I just started in the MikroTik world and your script was one of the first things I studied in order to improve my RouterOS knowledge.

Thank you very much :)
 
User avatar
Steveocee
Forum Guru
Forum Guru
Posts: 1120
Joined: Tue Jul 21, 2015 10:09 pm
Location: UK
Contact:

Re: Blacklist Filter update script

Mon Mar 26, 2018 5:49 pm

I'm totally gutted that I've now only seen this thread at the end of it's life. I was looking for something exactly like this and was under the impression nothing was about.

@OP You really need to market this as a subscription based list, judging by the amount of people who have said thanks I'm sure you'd make something out of it, whether that offsets your costs only you can determine though.
 
idoch
just joined
Posts: 6
Joined: Mon Mar 26, 2018 6:54 pm

Re: Blacklist Filter update script

Mon Mar 26, 2018 7:06 pm

First off: a Hearty THANK YOU to Dave for putting this together and sharing with the community for all this time. The usefulness of this list is undeniable and it's sad to see it go. Many networks and their users are less safe today because of the end of this list. :(

On another note, Dave - I hope that you DO begin a subscription service for this list. While the list has been demonstrably useful; I have always been reluctant to use this list in a production / business capacity BECAUSE it's completely free and BECAUSE there is no agreement, or "consideration" for using the list. Many of us are happy to pay for the service, I (for one) didn't even know that there was an option to pay for the list!.
 
User avatar
jspool
Member
Member
Posts: 469
Joined: Sun Oct 04, 2009 4:06 am
Location: Oregon

Re: Blacklist Filter update script

Mon Mar 26, 2018 8:50 pm

Thanks Dave! Its always a battle protecting ones network. The people that use free antivirus would likely be the ones that expect such a service free and the people that understand that you get what you pay for would support a paid service. Personally I prefer a BGP based solution. Since there isn't anything worth while in that arena I decided to build my own BGP blocklist system. So far beta testing has been good. On average its blocking 55,000 prefixes. As Dave mentioned it takes a considerable amount of time coding and deduplication across all of the available sources. I am integrating my own honeypot collectors now since I always seem to have a considerable number of attackers that are not present on existing lists.
 
andcz
just joined
Posts: 5
Joined: Tue Mar 20, 2018 10:36 am

Re: Blacklist Filter update script

Tue Mar 27, 2018 9:39 am

How about MikroTik company will pick up this effort, and provide the service to all the MikroTik owners ?

That would be great (and I will be even totaly willing to pay extra, like a per-year subscription or such),
and
most importantly,
this will provide a specific chain of trust - on getting the correct IP black-list from the manufacturer, that could be actually trusted.

The active black-list is a must-have for anyone running any network.

Also, there are many free, respectable services, that do publish blacklists coming from honeypots.
Example: https://project.turris.cz/en/greylist
So there should be not so much issue on getting the inputs for the official service.

I do definitelly vote for this. Anyone else ?
 
User avatar
Steveocee
Forum Guru
Forum Guru
Posts: 1120
Joined: Tue Jul 21, 2015 10:09 pm
Location: UK
Contact:

Re: Blacklist Filter update script

Tue Mar 27, 2018 10:46 am

How about MikroTik company will pick up this effort, and provide the service to all the MikroTik owners ?

That would be great (and I will be even totaly willing to pay extra, like a per-year subscription or such),
and
most importantly,
this will provide a specific chain of trust - on getting the correct IP black-list from the manufacturer, that could be actually trusted.

The active black-list is a must-have for anyone running any network.

Also, there are many free, respectable services, that do publish blacklists coming from honeypots.
Example: https://project.turris.cz/en/greylist
So there should be not so much issue on getting the inputs for the official service.

I do definitelly vote for this. Anyone else ?
I highly doubt MikroTik are going to take on a project like this. Maybe it could be something we do as a community?
 
andcz
just joined
Posts: 5
Joined: Tue Mar 20, 2018 10:36 am

Re: Blacklist Filter update script

Tue Mar 27, 2018 11:19 am

I'm in a need of such a service, thus my reaction. No offense given, I hope :)

In today's world, this shall be a native service provided with the platform.
Whichever manufacturer of routing platforms is going to provide this as a basic service, is then going to win the market.

Sure, it might be simple money to just build the hw platform with a software stack,
and let the users to build and run add ons;
yet given the actual (and future) world-wide situation, everyone shall
not only be looking for a market differentiator (which such a service could and will provide), but also to ensure the core cyber security features.
Having a official and long-term ip-black-list as a service, would be a great leap forward.
This should come from a trusted source (as the platform manufacturer would be, to a certain degree) and be a part of a standard installation (configurable, of course).

Running this from a community source is always a temporary and non-audited solution, as this thread has shown.
Sure, this original source was a side result (if I read the topic correctly) of a cyber security outfit, using all the side ways on how to remove attacks to their customer's infrastructure,
which required pushing as many RB owners to adapt the distributed list; so it in fact paid for itself (this way around).
And why not. In the end, it helped everybody. But once it stopped to be useful to the OP, the service ceased.
This is why I have this rather pushy approach to ask the manufacturer to provide this service on their own.

Just my 5 cents. Hope no one would get any bad feeling from this, not my intention.
 
User avatar
Steveocee
Forum Guru
Forum Guru
Posts: 1120
Joined: Tue Jul 21, 2015 10:09 pm
Location: UK
Contact:

Re: Blacklist Filter update script

Tue Mar 27, 2018 11:36 am

I agree with you, I would love to have a service like this available, I can think of multiple places where it would be employed.

It's not just a bunch of hardware though is it? What happens about false positives and somewhere legitimate is not reachable? Who will administer that, the manufacturer is then employing bodies to vet the lists and handle inbound queries on domains and what if something isn't picked up and it causes an issue, as a client you would hold the vendor responsible for X amount of loss of kit/earnings etc. It's a vast ocean to dive into because of a users project no longer being maintained.

Also what about when the worlds internet gears finally turn and all this investment into a platform becomes null overnight with a move to IPv6? Complete change/upgrade.

You could wait for a long time for a manufacturer to do this, which they won't as they're making money from selling their kit, or you can go to a real RBL provider and pay for a list or you hook onto community versions such as this was.
 
i4jordan
Frequent Visitor
Frequent Visitor
Posts: 77
Joined: Mon Sep 02, 2013 1:42 am

Re: Blacklist Filter update script

Wed Mar 28, 2018 11:12 pm

I also would pay for such a service, no problem.
Maybe you can make something with a pay per device/year option?

In any way thank you for the intrusBL service!
 
kakaxa
just joined
Posts: 15
Joined: Thu Feb 01, 2018 5:46 am

Re: Blacklist Filter update script

Thu Mar 29, 2018 6:51 pm

at whom the record set remained(blacklist) share please.
Dave - you many thanks that shared such remarkable set
=================
что ни у кого не сохранился лист?
поделитесь остатками пожалуйста
 
blakhawk23
just joined
Posts: 2
Joined: Thu Aug 10, 2017 11:10 am

Re: Blacklist Filter update script

Sat Apr 14, 2018 10:02 am

Thank you Dave for a great service. It was nice. And yes... i would pay for this extra layer of security....
 
User avatar
frank333
Member
Member
Posts: 330
Joined: Mon Dec 18, 2017 12:17 pm
Location: S.Marino Router model: RB3011UiAS-RM+RBM11G

Re: Blacklist Filter update script

Sat Apr 21, 2018 5:20 pm

dear dave, sorry you want to close the server, I ask you just this, sets a monthly price fair, and post it qua payment via paypal or bitcoin, if the initiative is not successful then you will decide whether to close or not, what do you say?
Your script I need a lot is a shame to lose it!!
frank.
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sun Apr 22, 2018 11:33 pm

So, I've thought about this a lot. I was quite surprised by the support generated. So I think I will restart the service as a paid service to pay for the server and backspace. In total, the servers currently cost me about $1750 a month, but I'm downsizing everything and going to try and get it down to a more manageable $250~500/month.

I'm going to rebuild this from the ground up, no I want be doing BGP just because of the amount of administrative overhead.
I would really like to wait on the script side, as I'm hoping to see if I can use the function library that Mikrotik has mentioned may be coming soon.

If their are features you would want to see, let me know and I'll put them on the list of possibles.
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sun Apr 22, 2018 11:39 pm

One feature for a paid version I would like to implement is a management portal.
* Manage your subscription options (Number of devices permitted to use your sub / payment method)
* Manage your device serial numbers associated with your subscription
* Manage a whitelist of IPs/Subnets that you need excluded from your list
* Manage a blacklist of IPs/Subnets that you need included in your list
 
User avatar
acortesguasch
just joined
Posts: 7
Joined: Tue Dec 19, 2017 6:04 pm

Re: Blacklist Filter update script

Mon Apr 23, 2018 12:55 pm

Please, when you have it all worked up and ready to accept suscriptions notify it here.
We'll be eager to use it.
 
amity2kare
newbie
Posts: 35
Joined: Tue Feb 13, 2007 4:24 pm
Location: INDIA

Re: Blacklist Filter update script

Mon Apr 23, 2018 9:58 pm

@IntrusDave you can count me in for the paid service. The feature list sounds good. Do let us know on this thread and we'll be most happy to do beta testing for you.
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Tue Apr 24, 2018 7:22 pm

I'd like some input on what this is worth to people in $USD.
My thought was $5/month for 5 devices, $10/month for 15 devices.
 
aboiles
Frequent Visitor
Frequent Visitor
Posts: 56
Joined: Sat Nov 07, 2015 6:52 pm

Re: Blacklist Filter update script

Tue Apr 24, 2018 10:21 pm

Dave that sounds reasonable to me, could also be yearly subscriptions.
Say $50 yr 5 devices, $150 yr 15 devices.
 
dmercer
just joined
Posts: 3
Joined: Sat Jul 08, 2017 3:53 am

Re: Blacklist Filter update script

Wed Apr 25, 2018 12:38 am

Thanks for all your work. I too would be happy to pay. 50/year for 5 devices would be great. I would sign up for two blocks
 
nwa
newbie
Posts: 29
Joined: Sun Aug 17, 2014 3:02 pm

Re: Blacklist Filter update script

Mon Apr 30, 2018 6:03 pm

privat... 10 for 1 device in a year... i dont need more devices
 
jausovec
just joined
Posts: 17
Joined: Fri Mar 06, 2015 9:55 am

Re: Blacklist Filter update script

Wed May 02, 2018 1:23 pm

10€/device/year. Private use.
 
User avatar
kometchtech
Member Candidate
Member Candidate
Posts: 194
Joined: Sat Jun 15, 2013 4:25 am
Location: Japan
Contact:

Re: Blacklist Filter update script

Sun May 06, 2018 3:53 pm

  • I think that I am pleased if I can pay annually and discounted.
  • I am glad that payment can be made with paypal.
 
foxxiu7
just joined
Posts: 5
Joined: Sun Aug 25, 2013 3:30 am

Re: Blacklist Filter update script

Mon May 07, 2018 2:15 am

single device, $10/year
 
hhgttg42
just joined
Posts: 8
Joined: Wed Oct 12, 2016 4:48 am

Re: Blacklist Filter update script

Sun May 13, 2018 3:53 am

Dave! First off I will GLADLY pay 5$/month for up to 5 devices!

Secondly, thank you for this awesome service you have provided to the community. I had been using it since sometime last year and it helped me sleep better at night knowing a good chunk of the negative aspects of the internet will stay away from my setups.

Please keep us posted and godspeed!
 
User avatar
acortesguasch
just joined
Posts: 7
Joined: Tue Dec 19, 2017 6:04 pm

Re: Blacklist Filter update script

Mon May 14, 2018 1:22 am

Private Use: 10$/year/device
Commercial Use: 5$/month up to 5 devices

Let's hope you can make it work
 
dadaniel
Member Candidate
Member Candidate
Posts: 220
Joined: Fri May 14, 2010 11:51 pm

Re: Blacklist Filter update script

Thu May 17, 2018 5:34 pm

It is temporary locations to download ... it does not matter where it is ... after importing lists script could be removed form flash, disk etc.
But it is imported as static entries because of missing timeout parameter in the script, so they are written to NAND on every change. They should change it in the script
 
zeane
just joined
Posts: 12
Joined: Fri Apr 11, 2008 5:14 am
Location: Cape Town - SOUTH AFRICA

Re: Blacklist Filter update script

Thu Jun 21, 2018 5:55 pm

Please do keep us posted as to your development.
Please also consider those of us in places like South Africa, where US$1 works out at almost 15 times that price in ZAR.

- LESS IS MORE -
If you look at statistical data of the most successful PAID apps in the Google Play Store, the 99c apps do far better in sales than anything priced over that amount. (You do the math >> Google charges mere cents [or a fraction thereof] for many of its ad services << Doesn't that tell you something about charging less for more, and still being financially successful!!)

- REMEMBER -
In todays online environment, you have customers not only from a single country, but now the entire globe as your market place....

- ANOTHERWORDS -
Please make your products more accessible to more customers, and you'll be able to make way more money, which in turn will facilitate your ability to have better resources to maintain and deliver your product.

The weather and politicans are already killing us -
FOR THE MOST PART - here in Cape Town. So, your kind consideration [when determining a fee], is GREATLY APPRECIATED!

Thank you and keep up the excellent work...

ANTHONY.capetown
 
msatter
Forum Guru
Forum Guru
Posts: 2912
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Blacklist Filter update script

Thu Jun 21, 2018 8:25 pm

Antony, I understand your suggestion and you can't ask for a lower price for parts of the world. It would be possible if Dave could also his daily shoppings in SA.

Maybe Bitcoin or other digital money have beter rates or as you sugest Playstore in a app with a subscription. You still have yo buy that 'currency'.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Blacklist Filter update script

Mon Jun 25, 2018 11:23 am

you can't ask for a lower price for parts of the world
You cannot just because everyone is doing like this? :) Google Play Music, Battlenet Shop - they all have different prices for Russia, for example.
 
jausovec
just joined
Posts: 17
Joined: Fri Mar 06, 2015 9:55 am

Re: Blacklist Filter update script

Thu Jul 05, 2018 1:38 pm

Hi. Do we maybe have some new info? Do we maybe know, if the service will be started again (in exchange for money)? As wrote I am willing to pay 10€/year/device.
Thank you, Uros
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Mon Jul 09, 2018 2:53 am

Not really an update, just information.

I'm still trying to figure out what to do with my life. At 43, I started not liking what I was doing for work. I've tried a few different things, including running a large non-profit for a while. Now I'm closing in on 45 and I still don't know. Fact is, I'm best at tech stuff and car stuff.

Anyway. I've shutdown all of my hardware servers and pulled them from the datacenter. It was just costing too much.

I'm currently experimenting with Google Cloud Compute platform to see if it will be a viable home for a new blacklist service. I hope to have new servers completed this week, and hope to start building a new Blacklist from scratch maybe next week. I still haven't found any decent subscription management systems. Anyone have suggestions on something Open Source?
 
blakhawk23
just joined
Posts: 2
Joined: Thu Aug 10, 2017 11:10 am

Re: Blacklist Filter update script

Mon Jul 09, 2018 4:04 pm

Hi Dave,
I think your black-ist vas a great extra security layer. I think 10$ / device /year sounds great and from me and the company where i work you will have 3 subscriptions.
Again, nice work!
Keep it up.
 
User avatar
Steveocee
Forum Guru
Forum Guru
Posts: 1120
Joined: Tue Jul 21, 2015 10:09 pm
Location: UK
Contact:

Re: Blacklist Filter update script

Mon Jul 09, 2018 5:07 pm

Not really an update, just information.

I'm still trying to figure out what to do with my life. At 43, I started not liking what I was doing for work. I've tried a few different things, including running a large non-profit for a while. Now I'm closing in on 45 and I still don't know. Fact is, I'm best at tech stuff and car stuff.

Anyway. I've shutdown all of my hardware servers and pulled them from the datacenter. It was just costing too much.

I'm currently experimenting with Google Cloud Compute platform to see if it will be a viable home for a new blacklist service. I hope to have new servers completed this week, and hope to start building a new Blacklist from scratch maybe next week. I still haven't found any decent subscription management systems. Anyone have suggestions on something Open Source?
You just need to do what makes you happy. It's fine not to know what to do with your life as long as you enjoy not knowing what to do.
If you love tech and cars, do something that involves putting tech in cars and innovate in that area. 8 years ago I was made redundant from my then dream job of being a car audio specialist, I quickly fell into my second hobby which was PC gaming and computers. Now I would love to apply my knowledge of tech, small SoC systems and mobile networking into the automotive sector however I am happy(ish) with what I am doing and this thread is about your amazing service!
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2880
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Blacklist Filter update script

Mon Jul 09, 2018 5:58 pm

...
I'm still trying to figure out what to do with my life. At 43, I started not liking what I was doing for work. I've tried a few different things, including running a large non-profit for a while. Now I'm closing in on 45 and I still don't know.
You need "grown-up gap year" :D :D
 
hhgttg42
just joined
Posts: 8
Joined: Wed Oct 12, 2016 4:48 am

Re: Blacklist Filter update script

Mon Jul 09, 2018 6:27 pm

[...]

I'm still trying to figure out what to do with my life. At 43, I started not liking what I was doing for work. I've tried a few different things, including running a large non-profit for a while. Now I'm closing in on 45 and I still don't know. Fact is, I'm best at tech stuff and car stuff.

[...]

I'm currently experimenting with Google Cloud Compute platform to see if it will be a viable home for a new blacklist service. I hope to have new servers completed this week, and hope to start building a new Blacklist from scratch maybe next week. I still haven't found any decent subscription management systems. Anyone have suggestions on something Open Source?
To the first point, you gotta do what you love. Often the things we're good at aren't what we love though...so that's a tricky one.

As for a subscription system, check out 'Servicebot' and 'Kill Bill'. I don't have experience with them, but they're open-source and look like they'll get the job done. There's always PayPal (*shudders*) or setting up something directly e.g. with Stripe as an alternative.

Best of luck!
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Wed Jul 11, 2018 3:15 am

New topic for development of the new service

viewtopic.php?f=9&t=136666
 
marcrisse
just joined
Posts: 24
Joined: Tue Feb 16, 2016 9:16 pm
Location: Germany

Re: Blacklist Filter update script

Thu Aug 02, 2018 9:19 pm

Do you need some servers in europe? Perhaps I can help you?
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Thu Aug 02, 2018 9:51 pm

Servers shouldn’t be an issue, I’ve moved my physical servers to google cloud and will be running on google’s CDN
 
jo2jo
Forum Guru
Forum Guru
Posts: 1003
Joined: Fri May 26, 2006 1:25 am

Re: Blacklist Filter update script

Fri Aug 03, 2018 8:19 am

Thanks for running the service all these years and doing such a great job with the script and updates! ive really appreciated it. I too would pay 5 (maybe 10$) a month for this same service to continue.

Is there anywhere we can signup for an email/alert when your paid service goes live? (other than sub'ing to this thread which will have lots of other "noise").

(also you might want to put a date under your red txt about the service going down, in your first post. its a bit hard to figure out if the service is already down, or if you are planning to take it down). thanks
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Fri Aug 03, 2018 8:28 am

Thanks! Check out the development topic. I posted an early pre-alpha script to try and start stress testing the database.
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Sat Aug 04, 2018 11:20 pm

Here is a form to fill out if you want to be notified when the new service goes live:

https://goo.gl/forms/UQMYqKJ54E0iV35l2
 
willianmp
just joined
Posts: 1
Joined: Tue Jul 21, 2015 7:39 am

Re: Blacklist Filter update script

Tue Sep 11, 2018 6:31 pm

failure: closing connection: <404 Not Found> 35.236.78.203:443 (4)
 
IntrusDave
Forum Guru
Forum Guru
Topic Author
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: Blacklist Filter update script

Thu Sep 13, 2018 8:09 pm

Who is online

Users browsing this forum: Google [Bot], InfraErik, loloski and 35 guests