ns-threat_shield

This is a porting of nethserver-blacklist.

This package is composed of 2 different services:

• ts-ip: block traffic from/to a given list of IPs, it is based on banip
• ts-dns: block DNS queries to a given list of domains, it is based on adblock

If the machine is registered using ns-plug, the system_id and the secret will be used to authenticate requests to URL sources. Please note that to access the extra categories, the machine should have a valid entitlement for this service.

ts-ip

Threat shield IP (ts-ip) blocks traffic from/to a given list of IPs.

The following categories require a valid entitlement:

• yoroimallvl1 (was yoroi_malware_level1 on NS7)
• yoroimallvl2 (was yoroi_malware_level2 on NS7)
• yoroisusplvl1 (was yoroi_souspicious_level1 on NS7)
• yoroisusplvl2 (was yoroi_souspicious_level2 on NS7)
• nethesislvl3 (was nethesis_level3 on NS7)
• nethesisinsightslvl2 (attackers reported by the other Nethesis firewalls, see Nethesis Insights)

After machine registration, above categories will be automatically added to existing banip categories (/etc/banip/banip.custom.feeds).

A special global allowlist will also be added to banip (ban_allowurl option).

Examples

Start the service

Enable the service and select one or more categories to block:

uci add_list banip.global.ban_feed=yoroimallvl1
uci set banip.global.ban_enabled=1
uci commit banip
ts-ip
/etc/init.d/banip restart

To disable ts-ip use:

uci set banip.global.ban_enabled=1
uci commit banip
ts-ip
/etc/init.d/banip restart

Nethesis Insights

On registered machines ts-ip joins the Nethesis Insights threat shield: IPs blocked by the banip log service are reported to the Insights server, and IPs reported by several firewalls can be blocked locally with the nethesisinsightslvl2 feed. Authentication uses the subscription system_id and secret.

Reporting:

• ts-ip sets banip.global.ban_blockhook to /usr/libexec/ts-insights-hook, which appends every blocked IP to /var/run/ns-insights/threat-events.jsonl
• banip supports a single block hook: when ban_blockhook already points to a custom script, ts-ip leaves it untouched, Insights reporting stays disabled and a threat_shield message is logged to /var/log/messages; on unregistration ts-ip removes only its own hook
• /usr/sbin/send-insights-blocklist sends the public IPs to POST /blocklist/v1/events, in batches of 500; the full endpoint URL can be overridden with ns-plug.config.insights_blocklist_url (default https://insights.nethesis.it/blocklist/v1/events); ts-ip adds its 5-minute cron job on registration and removes it, along with the spool, on unregistration
• fire and forget: events that fail to send are dropped
• only failed pushes are logged to /var/log/messages; set banip.global.ban_debug to 1 to log every push

ts-dns

Threat shield DNS (ts-dns) is a special configuration for adblock. The ts-dns is invoked every time adblock is started or reloaded.

The package adds new options to adblock:

• ts_enabled: if set to 1, it enables the download of enterprise categories and community free categories.
• ns_tsdns_zones: the firewall zones where the local DNS enforcement is applied.

Since adblock 4.5.5 the enforcement is rendered as nft rules matching on iifname, so the adb_nftdevforce option needs network devices and not zone names. It is therefore a derived value: it is computed from ns_tsdns_zones by the API and kept aligned with the network setup by the configure-adblock-devices pre-commit hook, so that adding an interface to an enforced zone does not leave its DNS traffic unfiltered. Do not edit adb_nftdevforce by hand.

If ts_enabled is set to 1:

• a new category source file is generated according to the machine registration and the entitlement
• all DNS queries are redirected to the local machine
• adblock is configured to use the new category source file and will be started

As default a machine has access to all community free categories, that are listed at /usr/share/threat_shield/community-dns.sources.gz. If the machine has a subscription and a valid entitlement for nethesis-blacklists, the machine will have access to the enterprise categories, that are listed at /usr/share/threat_shield/nethesis-dns.sources.gz.

DNS block categories will be automatically reloaded every 12 hours.

Enable adblock with all available categories, example:

echo '{"enabled": true, "zones": ["lan"]}' | /usr/libexec/rpcd/ns.threatshield call dns-edit-settings
uci commit adblock && service adblock restart

Keep adblock enabled but disable threat shield categories:

echo '{"enabled": false, "zones": ["lan"]}' | /usr/libexec/rpcd/ns.threatshield call dns-edit-settings
uci set adblock.global.ts_enabled=0
uci commit adblock
/etc/init.d/adblock restart

DNS redirect bypass

Allow bypass of DNS redirect for a specific source IP:

uci add_list adblock.global.ns_tsdns_bypass=192.168.100.2
uci commit adblock
/etc/init.d/adblock reload

For more info see adblock repository.