A248 / LibertyBans

The be-all, end-all of discipline.
https://ci.hahota.net:8443/job/LibertyBans/
GNU Affero General Public License v3.0
169 stars 41 forks source link

[Feature Request]: Exclude (private) IPs from '/alts' and '/ipban' #285

Open Folas1337 opened 4 weeks ago

Folas1337 commented 4 weeks ago

I have confirmed that ...

Description

Some backstory to why I am even requesting this as it might otherwise sound ridiculous: I am using a very peculiar setup with Docker with two individual physical servers and its containers are connected through a so-called overlay network. This works beautifully BUT it has one fatal flaw which I only realized recently: It can sometimes (seemingly at random) decide to do IP masquerading which means the IPs of users get replaced by one of the so called docker_gwbridge. I already tried to disable IP masquerading but that'll render the containers useless and moving them to the host network is also a bit of a stupid idea from a security standpoint. I might find a better solution in the future but currently there is no easy solution and for complexity reasons I might never consider them.

However docker_gwbridge does use private IPs and in my opinion they should note be taken into consideration by '/alts' and '/ipban'.

There are two possible solutions here, one is hard coding private IPs and the other is to make it configurable which also means it could adjust to other use cases more easily.

The hard coded solution would exclude private IP addresses like these from Wikipedia: https://en.wikipedia.org/wiki/Private_network

The configurable solution would allow you to specify your own networks like 192.168.0.0/16 for IPv4 or fd00::/8 for IPv6 in the config file.

Both solutions would then check said networks/IP addresses and if it's part of the results of '/alts' it would be omitted or if it was used in an '/ipban' command, it would simply tell you that you can't/shouldn't ban private IPs as that should never be necessary.

Personally I'd prefer the second option where you can use your own networks so it's more flexible and can be adjusted to different use cases but I'll leave the ultimate choice up to you.

It could also be one config option for the alts command and one of the ipban to give ultimate control but that's up to you once again :)