{"id":13540146,"url":"https://github.com/antonioribeiro/firewall","last_synced_at":"2025-05-14T12:11:35.802Z","repository":{"id":12619711,"uuid":"15290899","full_name":"antonioribeiro/firewall","owner":"antonioribeiro","description":"Firewall package for Laravel applications","archived":false,"fork":false,"pushed_at":"2023-02-17T12:06:34.000Z","size":869,"stargazers_count":1404,"open_issues_count":41,"forks_count":167,"subscribers_count":50,"default_branch":"master","last_synced_at":"2025-04-11T04:59:46.274Z","etag":null,"topics":["attack-detection","attack-prevention","firewall","laravel","php"],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/antonioribeiro.png","metadata":{"files":{"readme":"readme.md","changelog":"changelog.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2013-12-18T18:27:05.000Z","updated_at":"2025-03-31T08:19:56.000Z","dependencies_parsed_at":"2023-10-20T17:29:25.148Z","dependency_job_id":null,"html_url":"https://github.com/antonioribeiro/firewall","commit_stats":{"total_commits":302,"total_committers":24,"mean_commits":"12.583333333333334","dds":"0.11920529801324509","last_synced_commit":"6b3575a7b5977e223620d8281423e5175c875ea7"},"previous_names":[],"tags_count":34,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antonioribeiro%2Ffirewall","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antonioribeiro%2Ffirewall/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antonioribeiro%2Ffirewall/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antonioribeiro%2Ffirewall/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/antonioribeiro","download_url":"https://codeload.github.com/antonioribeiro/firewall/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254140766,"owners_count":22021220,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attack-detection","attack-prevention","firewall","laravel","php"],"created_at":"2024-08-01T09:01:41.354Z","updated_at":"2025-05-14T12:11:30.785Z","avatar_url":"https://github.com/antonioribeiro.png","language":"PHP","funding_links":[],"categories":["Popular/Notable Packages","PHP","\u003ca id=\"0abd611fc3e9a4d9744865ca6e47a6b2\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"ce6532938f729d4c9d66a5c75d1676d3\"\u003e\u003c/a\u003e防火墙\u0026\u0026FireWall"],"readme":"# Firewall 2.2\n\n[![Latest Stable Version](https://img.shields.io/packagist/v/pragmarx/firewall.svg?style=flat-square)](https://packagist.org/packages/pragmarx/firewall) [![License](https://img.shields.io/badge/license-BSD_3_Clause-brightgreen.svg?style=flat-square)](LICENSE) [![Downloads](https://img.shields.io/packagist/dt/pragmarx/firewall.svg?style=flat-square)](https://packagist.org/packages/pragmarx/firewall) [![Code Quality](https://img.shields.io/scrutinizer/g/antonioribeiro/firewall.svg?style=flat-square)](https://scrutinizer-ci.com/g/antonioribeiro/firewall/?branch=master) [![Build](https://img.shields.io/scrutinizer/build/g/antonioribeiro/firewall.svg?style=flat-square)](https://scrutinizer-ci.com/g/antonioribeiro/firewall/?branch=master) [![Coverage](https://img.shields.io/scrutinizer/coverage/g/antonioribeiro/firewall.svg?style=flat-square)](https://scrutinizer-ci.com/g/antonioribeiro/firewall/?branch=master) [![StyleCI](https://styleci.io/repos/15290899/shield)](https://styleci.io/repos/15290899)\n\n## Purpose\n\nThis a \"soft-firewall\" package. Its purpose is to help people prevent unauthorized access to routes **by IP address**. It is able to keep track of IPs, countries and hosts (dynamic ip), and redirect non-authorized users to, for instance, a \"Coming Soon\" page, while letting whitelisted IPs to have access to the entire site. It is now also able to detect and block attacks (too many requests) from single IPs or whole countries.\n\nThis package can prevent some headaches and help you block some access to your apps, but cannot replace firewalls and appliances, for attacks at the network level, you'll still need a real firewall. \n\n## Features\n\n* Control access to routes and groups via black and white lists.\n* Detect and block attacks to your application, from IP addresses or countries.\n* Send Slack notifications in attack events.\n* Allow whitelisted to access the whole site and send everyone else to a \"coming soon page\".\n* Redirect blacklisted users to some other page.\n* Use database or arrays to store IP lists.\n* Whitelist your development machine using a dynamic DNS host name.\n* Done using middleware, so you can protect/unprotect groups of routes.\n* All features are available for hosts, IP addresses, ranges of IP addresses and whole countries.\n* Super fast, less than 10ms increase in each request.\n* Highly configurable.\n\n## Concepts\n\n### Blacklist\n\nAll IP addresses in those lists will no be able to access routes filtered by the blacklist filter.\n\n### Whitelist\n\nThose IP addresses, ranges or countries can\n\n- Access blacklisted routes even if they are in a range of blacklisted IP addresses.\n- Access 'allow whitelisted' filtered routes.\n- If a route is filtered by the 'allow whitelisted' filter and the IP is not whitelisted, the request will be redirected to an alternative url or route name.\n\n## Attack Detection\n\n![attack](docs/attack.png)\n\nFirewall is able to detect simple attacks to your page, by counting requests from the same IP or country. Just enable it on your `config/firewall.php` and, to receive notifications, configure the Slack service in `config/services.php`:\n   \n```php\n'slack' =\u003e [\n    'webhook_url' =\u003e env('SLACK_WEBHOOK_URL'),\n],\n```\n\nand add the route notification method to your user model:\n\n```php\n/**\n * Route notifications for the Slack channel.\n *\n * @return string\n */\npublic function routeNotificationForSlack()\n{\n    return config('services.slack.webhook_url');\n}\n``` \n\n## IPs lists\n\nIPs (white and black) lists can be stored in array, files and database. Initially database access to lists is disabled, so, to test your Firewall configuration you can publish the config file and edit the `blacklist` or `whitelist` arrays:\n\n```php\n'blacklist' =\u003e array(\n    '127.0.0.1',\n    '192.168.17.0/24'\n    '127.0.0.1/255.255.255.255'\n    '10.0.0.1-10.0.0.255'\n    '172.17.*.*'\n    'country:br'\n    '/usr/bin/firewall/blacklisted.txt',\n),\n```\n\nThe file (for instance `/usr/bin/firewall/blacklisted.txt`) must contain one IP, range or file name per line, and, yes, it will search for files recursively, so you can have a file of files if you need:\n\n```\n127.0.0.2\n10.0.0.0-10.0.0.100\n/tmp/blacklist.txt\n```\n\n## Redirecting non-whitelisted IP addresses\n\nNon-whitelisted IP addresses can be blocked or redirected. To configure redirection you'll have to publish the  `config.php` file and configure:\n\n```php\n'redirect_non_whitelisted_to' =\u003e 'coming/soon',\n```\n\n## Artisan Commands\n\nYou have access to the following commands:\n\n#### Global\n\n```\n  firewall:cache:clear  Clear the firewall cache.\n  firewall:list         List all IP address, white and blacklisted.\n  firewall:updategeoip  Update the GeoIP database.\n```\n\n#### When database is enabled\n\n```\n  firewall:blacklist          Add an IP address to blacklist.\n  firewall:clear              Remove all ip addresses from white and black lists.\n  firewall:remove             Remove an IP address from white or black list.\n  firewall:whitelist          Add an IP address to whitelist.\n```\n\nThose are results from `firewall:list`:\n\n```\n+--------------+-----------+-----------+\n| IP Address   | Whitelist | Blacklist |\n+--------------+-----------+-----------+\n| 10.17.12.7   |           |     X     |\n| 10.17.12.100 |     X     |           |\n| 10.17.12.101 |     X     |           |\n| 10.17.12.102 |     X     |           |\n| 10.17.12.200 |           |     X     |\n+--------------+-----------+-----------+\n```\n\n```\n+-----------------------+-----------+-----------+\n| IP Address            | Whitelist | Blacklist |\n+-----------------------+-----------+-----------+\n| 172.0.0.0-172.0.0.255 |           |     X     |\n| country:br            |           |     X     |\n| host:mypc.myname.com  |     X     |           |\n+-----------------------+-----------+-----------+\n```\n\n## Facade\n\nYou can also use the `Firewall Facade` to manage the lists:\n\n```php\n$whitelisted = Firewall::isWhitelisted('10.17.12.1');\n$blacklisted = Firewall::isBlacklisted('10.0.0.3');\n\nFirewall::whitelist('192.168.1.1');\nFirewall::blacklist('10.17.12.1', true); /// true = force in case IP is whitelisted\nFirewall::blacklist('127.0.0.0-127.0.0.255');\nFirewall::blacklist('200.212.331.0/28');\nFirewall::blacklist('country:br');\n\nif (Firewall::whichList($ip) !== false)  // returns false, 'whitelist' or 'blacklist'\n{\n    Firewall::remove($ip);\n}\n```\n\nReturn a blocking access response:\n\n```php\nreturn Firewall::blockAccess();\n```\n\nSuspicious events will be (if you wish) logged, so `tail` it:\n\n```\nphp artisan tail\n```\n\n## Blocking Whole Countries\n\nYou can block a country by, instead of an ip address, pass `country:\u003c2-letter ISO code\u003e`. So, to block all Brazil's IP addresses, you do:\n\n```\nphp artisan firewall:blacklist country:br\n```\n\nYou will have to add this requirement to your `composer.json` file:\n\n```\n\"geoip/geoip\": \"~1.14\"\n```\n\nor\n\n```\n\"geoip2/geoip2\": \"~2.0\"\n```\n\nYou need to enable country search on your firewall.php config file: \n\n```php\n'enable_country_search' =\u003e true,\n```\n\nAnd you can schedule this command to update your cities GeoIp database regularly: \n\n```\nphp artisan firewall:updategeoip\n```\n\nYou can find those codes here: [isocodes](http://www.spoonfork.org/isocodes.html)\n\n## Session Blocking\n\nYou can block users from accessing some pages only for the current session, by using those methods:\n\n```php\nFirewall::whitelistOnSession($ip);\nFirewall::blacklistOnSession($ip);\nFirewall::removeFromSession($ip);\n```\n\n## Playground \u0026 Bootstrap App \n\nClick [here](http://pragmarx.com/firewall) to see it working and in case you need a help figuring out things, try [this repository](https://github.com/antonioribeiro/pragmarx.com). \n\n![playground](docs/playground.png)\n\n## Installation\n\n### Compatible with\n\n- Laravel 4+ (version 1.*) \n- Laravel 5.0, 5.1, 5.2 and 5.3 (version 1.*)\n- Laravel 5.4, 5.5, 5.6 and 5.7 (version 2.*)\n\n### Installing\n\nRequire the Firewall package using [Composer](https://getcomposer.org/doc/01-basic-usage.md):\n\n```\ncomposer require pragmarx/firewall\n```\n\n* Laravel 5.5 and up\n\n    You don't have to do anything else, this package uses Package Auto-Discovery's feature, and should be available as soon as you install it via Composer.\n\n* Laravel 5.4 and below\n\n    Add the Service Provider and the Facade to your app/config/app.php:\n\n```php\nPragmaRX\\Firewall\\Vendor\\Laravel\\ServiceProvider::class,\n```\n\n```php\n'Firewall' =\u003e PragmaRX\\Firewall\\Vendor\\Laravel\\Facade::class,\n```\n\nAdd middlewares to your app/Http/Kernel.php\n\n```php\nprotected $routeMiddleware = [\n    ...\n    'fw-only-whitelisted' =\u003e \\PragmaRX\\Firewall\\Middleware\\FirewallWhitelist::class,\n    'fw-block-blacklisted' =\u003e \\PragmaRX\\Firewall\\Middleware\\FirewallBlacklist::class,\n    'fw-block-attacks' =\u003e \\PragmaRX\\Firewall\\Middleware\\BlockAttacks::class,\n];\n```\n\nor \n\n```php\nprotected $middlewareGroups = [\n    'web' =\u003e [\n        ...\n    ],\n\n    'api' =\u003e [\n        ...\n    ],\n    \n    'firewall' =\u003e [\n        \\PragmaRX\\Firewall\\Middleware\\FirewallBlacklist::class,\n        \\PragmaRX\\Firewall\\Middleware\\BlockAttacks::class,\n    ],\n];\n```\n\nThen you can use them in your routes:\n\n```php\nRoute::group(['middleware' =\u003e 'fw-block-blacklisted'], function () \n{\n    Route::get('/', 'HomeController@index');\n});\n```\n\nOr you could use both. In the following example the allow group will give free access to the 'coming soon' page and block or just redirect non-whitelisted IP addresses to another, while still blocking access to the blacklisted ones.\n\n```php\nRoute::group(['middleware' =\u003e 'fw-block-blacklisted'], function () \n{\n    Route::get('coming/soon', function()\n    {\n        return \"We are about to launch, please come back in a few days.\";\n    });\n\n    Route::group(['middleware' =\u003e 'fw-only-whitelisted'], function () \n    {\n        Route::get('/', 'HomeController@index');\n    });\n});\n```\n\n**Note:** You can add other middleware you have already created to the new groups by simply \nadding it to the `fw-allow-wl` or `fw-block-bl` middleware group.\n\nMigrate your database\n\n```\nphp artisan migrate\n```\n\n**Warning:** If you already have a Firewall package installed and migrated, you need to update your migration name, in the `migrations` table, to `2014_02_01_311070_create_firewall_table`, otherwise the migrate command will fail tell you the table already exists.  \n\nTo publish the configuration file you'll have to:\n\n**Laravel 4**\n\n```\nphp artisan config:publish pragmarx/firewall\n```\n\n**Laravel 5**\n\n```\nphp artisan vendor:publish --provider=\"PragmaRX\\Firewall\\Vendor\\Laravel\\ServiceProvider\"\n```\n\n## TODO\n\n- Tests, tests, tests.\n\n## Author\n\n[Antonio Carlos Ribeiro](http://twitter.com/iantonioribeiro) \n\n## License\n\nFirewall is licensed under the BSD 3-Clause License - see the `LICENSE` file for details\n\n## Contributing\n\nPull requests and issues are more than welcome.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fantonioribeiro%2Ffirewall","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fantonioribeiro%2Ffirewall","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fantonioribeiro%2Ffirewall/lists"}