{"id":18286759,"url":"https://github.com/xrstf/mkipset","last_synced_at":"2025-04-09T06:26:41.768Z","repository":{"id":142640572,"uuid":"185082296","full_name":"xrstf/mkipset","owner":"xrstf","description":"Tool to manage ipset sets based on Text/YAML/JSON files","archived":false,"fork":false,"pushed_at":"2019-12-26T15:59:27.000Z","size":22,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-02T01:12:20.320Z","etag":null,"topics":["blacklisting","go","ipset","iptables"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/xrstf.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-05-05T21:05:06.000Z","updated_at":"2019-12-26T15:59:30.000Z","dependencies_parsed_at":"2023-04-07T09:26:30.062Z","dependency_job_id":null,"html_url":"https://github.com/xrstf/mkipset","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xrstf%2Fmkipset","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xrstf%2Fmkipset/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xrstf%2Fmkipset/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xrstf%2Fmkipset/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/xrstf","download_url":"https://codeload.github.com/xrstf/mkipset/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247989470,"owners_count":21029320,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blacklisting","go","ipset","iptables"],"created_at":"2024-11-05T13:22:02.083Z","updated_at":"2025-04-09T06:26:41.740Z","avatar_url":"https://github.com/xrstf.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mkipset\n\nThis repository contains an application that can be used to read IP addresses and\nsubnets from a text/JSON/YAML file and convert the entries into entries in an\n[ipset](http://ipset.netfilter.org/) set. Its primary function is to allow webmasters\nwithout root permissions to easily define a blacklist of IPs and have the server\nadministrator use that list to automatically manage the firewall. Therefore the\ngoal is to make it near impossible to fuck up the firewall by inexperienced\nwebmasters and to separate system permissions.\n\nIn its current state, `mkipset` should be run as a regular cronjob (the more frequent,\nthe better). A daemon mode that permanently watches blacklist files may be added\nin the future.\n\nEntries in the blacklists can have a start and/or ending date, but these do **not**\nmap to ipset's native timing functionality. Instead they only serve as a hint\nto `mkipset`. Likewise, it is assumed that `mkipset` runs as a cronjob, so there\nis currently no support for saving/restoring ipset sets on server restores.\n\n## Usage\n\nCreate a configuration file by copying the `config.yaml.dist` and adjust to your\nliking. Note that the set name can be at most 20 characters long, even though\nipset allows 31 characters. This is to allow `mkipset` to generate unique names\nduring set swaps.\n\nAfter creating the config file, define a blacklist file. You can use Text/JSON/YAML\nand its type will be determined by the file extension (.txt, .json or .yml/.yaml).\nLook at the same blacklist files in the `examples/` directory for more information.\n\nSet up a cronjob to run `mkipset` and make sure that your `PATH` is set up\nproperly so that it can find the `ipset` binary:\n\n    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n    # update ipsets\n    * * * * * mkipset -config /etc/mkipset/web-config.yaml /etc/mkipset/web-blacklist.txt\n\nAnd finally create as many iptables rules as you like, referencing your set. In\nthis example, the set is named `blacklist-web` because it contains IPs that we want\nto deny HTTP/HTTPS access to.\n\n    iptables -A INPUT -p tcp --dport 80  -m set --match-set blacklist-web src -j DROP\n    iptables -A INPUT -p tcp --dport 443 -m set --match-set blacklist-web src -j DROP\n\n## Tips\n\n### Multiple Files\n\nYou can feed multiple files into `mkipset`, for example if you want to manage\nblacklist entries on a root level and then also load additional entries defined by\na user on your system. Use the `-ignore-missing` flag if you don't care if some of\nthe blacklist files could not be found, but be aware that you must load at least\none file successfully no matter what.\n\nIf you manage multiple ipset sets, it can be helpful to have a single configuration\nfile instead of one per set. To do so, use the `-set-name` parameter to override the\nset you defined in your configuration file. A crontab could then look like this:\n\n    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n    # update ipsets\n    * * * * * mkipset -config /etc/mkipset/config.yaml -set-name web /etc/mkipset/web-blacklist.txt\n    * * * * * mkipset -config /etc/mkipset/config.yaml -set-name ssh /etc/mkipset/ssh-blacklist.txt\n    * * * * * mkipset -config /etc/mkipset/config.yaml -set-name mail /etc/mkipset/mail-blacklist.txt\n\n### Including Files\n\nIn case you don't know beforehand which files you need, you can also just give `mkipset`\na base **text** file and include others from there. Every line in a text file that begins\nwith `include ` will trigger a recursive include, like so:\n\n    # this is a.txt\n\n    1.2.3.4\n    include b.json\n\nAs you can see, you can include all supported file types, but include directives can only\nappear in text files (assuming text files are written manually and JSON/YAML are managed\nby other tools, so these other tools should handle inclusions).\n\nNote that there is a **hardcoded limit of 100 includes** per input file (so if you run\n`mkipset a.txt b.txt`, both files would get an allowance of 100 includes). This is just to\nprevent accidental include loops.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxrstf%2Fmkipset","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fxrstf%2Fmkipset","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxrstf%2Fmkipset/lists"}