search

palinkas-jo-reggelt / hMailServer-Firewall-Ban

Windows Defender Firewall Ban for hMailServer
GNU General Public License v3.0
10 stars 2 forks source link

readme 

_  _ _  _  __  _ _    ____ ____ ____ _  _ ____ ____     
|__| |\/| /__\ | |    [__  |___ |__/ |  | |___ |__/     
|  | |  |/    \| |___ ___] |___ |  \  \/  |___ |  \     
____ _ ____ ____ _ _ _  __  _    _       ___   __  _  _ 
|___ | |__/ |___ | | | /__\ |    |       |__] /__\ |\ | 
|    | |  \ |___ |_|_|/    \|___ |___    |__]/    \| \|

Ban Spammers to Windows Defender Firewall. Use of various reject methods in EventHandlers.vbs to call Firewall Ban. Integrated web admin.

Demo here: https://firewallban.dynu.net/

The demo is a fully functioning PHP web admin so you can how to administer hMailServer-triggered bans.

Prerequisites

1) Working hMailServer 5.7.0 2) Working MySQL OR MSSQL with hmailserver database 3) Working Apache/IIS with PHP 4) May require updating Powershell 5) May require MySQL-Connector-Net found here: https://dev.mysql.com/downloads/connector/net/

Instructions - INSTALLING

1) Copy everything from EventHandlers.vbs into your EventHandlers.vbs (default location: C:\Program Files (x86)\hMailServer\Events\EventHandlers.vbs) 2) Copy vbsjson.vbs to hMailServer Events folder (default location: C:\Program Files (x86)\hMailServer\Events) 3) Install RvdH's DNS resolver (https://d-fault.nl/files/) 4) Copy RvdH's Disconnect.exe to hMailServer Events folder (https://d-fault.nl/files/) 5) Edit variables in Config.ps1 6) Run hmsFirewallBanDBSetup.ps1 to setup database tables. 6) Change group policy for firewall log to log dropped connections. Set log location Config.ps1. From cmd/administrator:

netsh advfirewall set allprofiles logging filename "C:\scripts\hmailserver\fwban\pfirewall.log"
netsh advfirewall set allprofiles logging droppedconnections enable

7) Create scheduled task to run every 5 minutes with action:

Instructions - UPGRADING

If you installed or last upgraded before v.0.56 (11/27/19), you will need to run hmsRetroConsolidateRules.ps1 and hmsRetroAddRuleName.ps1 before proceeding with any other upgrade.

If you installed or last upgraded before v.0.61 (1/20/20), you will need to run hmsRetroAddPTR.ps1 before proceeding with any other upgrade.

If you installed or last upgraded before v.0.77 (2/16/20), you will need to run hmsRetroAddBlocksIPTable.ps1 before proceeding with any other upgrade.

After the above is satisfied, replace your old files with the new ones. Update EventHandlers.vbs accordingly.

SQL Create Tables

Moved to hmsFirewallBanDBSetup.ps1

Flag Logic

Flag    Meaning
====    =======
NULL    Has been added as a firewall rule
1       Has been released from firewall (firewall rule deleted)
2       Marked for release by manual release (release.php) but not firewall rule not yet deleted - after firewall rule deleted, reset flag to 1
3       Marked for reban by manual reban (reban.php) but firewall rule not yet added - after firewall rule added, reset flag to NULL
4       Default entry - signifies IP has been added to database but firewall rule has not yet been added - after firewall rule added, reset flag to NULL
5       Marked SAFE in webadmin but firewall rule not yet deleted - permanently removes firewall rule and prevents future bans
6       Marked SAFE and firewal rule deleted
7       Marked for removal from SAFE list and firewall rule added

Security Notes

The only security is provided by .htaccess blocking connections outside your LAN. You will not want the web admin to be publicly available for obvious reasons - someone might ban you! The .htaccess restricts access to localhost and your LAN subnet only. If you want to allow access to the WAN, I strongly suggest you password protect the directory or do something else that will keep outsiders out as they will have the ability to control your firewall.

Other Notes

I ran across an issue where a single IP hammered my server enough times to cause ip-api.com to rate limit me (150/minute). Besides that, since firewall rules get added on an interval (via scheduled task / powershell), many connections between the interval can add redundant IPs to the rule list. To get around both of these issues I setup RvdH's disconnect and SorenR's autoban. On each trigger now, three functions should be called:

1) Disconnect 2) Autoban 3) Firewall Ban

This way, autoban will temporarily block the IP and thereby prevent calling firewall ban multiple times for the same IP. This will drastically reduce the number of redundant IP entries in the database. Additionally, hmsFirewallBan deletes redundant IPs WITHIN THE 5 MINUTE INTERVAL ONLY. This method allows for duplicate IPs in the database as ban > release > ban would be 3 separate incidents and a bona fide reason to have duplicate entries.

Intrusion Dection System (IDS)

IDS credit to SorenR: https://www.hmailserver.com/forum/viewtopic.php?p=209545#p209545

IDS is very simple, but pure genius. It counts the number of connections that did not complete a transaction: either by accepting a message or by logon. Three strikes and you're out. When an IP has three strikes it gets added to the firewall ban with ban reason "IDS" and the IP is removed from the IDS count.

Changelog