AutoBlock.conf

# AutoBlock Configuration Syntax
# 1. This file is not case sensitive.
# 2. Anything after and including a '#' character is ignored and is treated as a comment.  Note 
#      that comments are stripped out before any other processing so a continuation backslash 
#      character after the '#' will get stripped away with the comment.  Blank lines, including 
#      those that result from comment stripping, are ignored.
# 3. Statements are not cumulative. Subsequent lines that assign values to a previously assigned  
#      config variables will overwrite the previous assignment.
# 4. Max line length is 1023 characters.  Anything after that is treated as a comment and ignored.
# 5. When a variable allows multiple values, they must be separated by a comma plus optional spaces 
#      or tabs.
# 6. All variables must be defined even if they are left blank.  If not, an error is generated.
# 7. If a variable is not valid or misspelled, it will be ignored without error or warning.
# 8. The order of the variable definitions is not relevant. 
# 9. Long lines may be continued onto the next line by adding a backslash "\" character at the end 
#      of the line and before any comment "#" characters.  Note that characters escaped with a \ 
#      are not currently supported.
# 10. Variables that accept file paths may not have any spaces - even inside quotes.
# 11. A variable definition line consists of:
#    <optional spaces or tabs> variable name ":" <optional spaces or tabs> <optional values>  <optional "\r"> "\n" 



# LOGFILEPATH is the path where important processing messages are written.  This is not the asterisk 
# log file.  If this variable is a valid path, then any AutoBlock messages will be written there.  
# If you don't want any logging, leave this variable blank.  Only messages of WARN or higher level will be saved.
# NOTE: Be sure to use forward slashes '/' and not backslashes '\' because the latter is treated as a line continuation.
# Allowed Values: Blank or any valid path where the program has permission to create and write files.

# LogFilePath:                                 # leave blank if you don't want any logs
# LogFilePath:    "./AutoBlock.log"            # custom log location
LogFilePath:      "/var/log/AutoBlock.log"     # default log location



# VERBOSITY, sets the minimum severity of messages that are displayed to the console.  
# The parameters work as follows:
#   QUIET  - No messages of any level.
#   FATAL  - Severe errors that could stop the program.
#   WARN   - Errors, but the program can continue.
#   STATUS - Chatty messages - read file successfully, etc.
# Allowed Values: QUIET, FATAL, WARN, STATUS

# Verbosity: QUIET
# Verbosity: FATAL
# Verbosity: WARN
Verbosity: STATUS


# DRYRUN, if set to TRUE, will process the messages file normally, but will not attempt to copy the 
# resulting blocklist to the router.  Set this to FALSE for normal processing.  
# Allowed Values: TRUE, FALSE

DryRun: TRUE


# ASTERISKNOTICEFILE - This is the path to the Asterisk log file (messages.log).  It can be in 
# the usual location or in a custom location.  
# Allowed Values: Must be a valid path to the asterisk log file and the program must have read permission.

AsteriskNoticeFile:  "/var/log/asterisk/messages.log"   # default location



# The FIREWALLBLOCKLISTPATH variable is the path where the processed blocklist will be copied.  This can be 
# on your router or the asterisk machine itself.  It needs to be on a server capable of blocking using ipsets.  
# Most modern versions of openwrt support ipsets.
# Allowed Values: Must be a valid path on the machine it is later copied to and the program must have write 
# permission using the method of copy defined elsewhere.

FirewallBlockListPath:   '/etc/luci-uploads/AutoBlock/blocklist.txt'  # location on openWrt router to copy 


# REQUESTTYPES list the sip requests that will be processed.  Only "REGISTER", "INVITE" and "OPTIONS" are
# currently supported. Normally, you want to process all of them, but you can omit some if you need to for 
# special cases.  You can also just use a wildcard "*" to indicate that all known request types should be 
# processed.  Multiple request types must be separated by a comma and optional spaces.
# Allowed Values: Either "*" by itself or one or more of "REGISTER", "INVITE" and/or "OPTIONS" separated by 
# commas and optional spaces.

# RequestTypes: register, options   # Omit invite processing
RequestTypes: *                     # process all known requests


# ALLOWNAMEDSERVER, if set TRUE, will cause the program to ignore error messages if the user has connected 
# to your server by name (e.g.- "Myserver.com") as opposed to an IP address.  In most cases, but not all, 
# attackers will connect to your server by its IP address, whereas legitimate users will use your domain name.
# It is safest to set this value to FALSE which will process all errors equally.  A positive integer can also 
# be used which would be the same as TRUE, but only until that count was reached.  So if the count is 50, 
# then the first 50 errors are ignored, but the 51st error will be processed.  If a count is used, then the 
# number should be sufficiently large to prevent a legitimate user with a misconfigured ATA from being 
# accidentally blocked.  The counts are reset every time the program is run and are not IP specific.
# Allowed Values: "True", "False" or a positive integer less than 100,000.

# AllowNamedServer: 500      # Up to 500 error lines ignored when connected by domain name
# AllowNamedServer: true     # Don't process connections that connected via the server's domain name
AllowNamedServer:   false    # All connections are processed the same



# ALLOWEDNUMERICALIDS is a numerical range of valid numerical accounts on your asterisk server.  This is for 
# numerical account numbers only.  If you have any numerical user id's, they should be listed here as a range.  
# If you don't have any numerical user account names, and only have alphanumeric account names (eg-"Sally", 
# "John2", etc.) then leave this blank.  If the attacker attempts to register using a numerical account not 
# in this list, he gets added to the block list.  Don't add numbers here that are not actual login id's.
# Allowed Values: Positive integers and integer ranges defined by a hyphen between two positive integers and 
# separated by a comma and optional space.  For integer ranges, the lower number must be defined first.

# AllowedNumericalIDs:                  # leave blank if only alphanumeric id's are allowed
AllowedNumericalIds:  0, 4000-5000      # change for your implementation


# IGNOREBLOCKS is a white list.  You should set this to your local IP address range plus any external 
# users with stable IP addresses.  IP ranges must be specified as a CIDR block and not as a hyphenated range.  
# Not listing a user's IP here does not automatically block them, however, if a user connects from any of the 
# listed IP's, no processing will be done for that IP.  It is also possible to whitelist a valid domain name
# when the user's IP address can change.  You should only use this list if you have had a problem with 
# legitimate users getting accidentally blocked.  Normally, just set this to your local IP Netrange.
# NOTE: You can use a '\' if you need more than one line.
# Allowed Values: Dotted IP addresses, with or without a "/" netblock size, and domain names, all separated 
# by commas and optional spaces.

# IgnoreBlocks: 192.168.1.0/24,  users.ddns.domain.com/24    # example of domain name with netblock.
IgnoreBlocks: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16


# MINCIDR is the minimum allowable number of cidr netblock bits.  The lower this number, the more IP's are 
# blocked.  If WHOIS returns a netblock size of 8, you might not want to block that many IP addresses.  You can 
# set this variable to a larger number like maybe 16.  This forces the cidr to be no smaller than this value 
# regardless of the value returned by WHOIS.  So if this variable is set to 16, and WHOIS returns 5, then the 
# cidr size will be changed to 16.  If WHOIS returns a cidr >= this variable, then the WHOIS value is used.
# Allowed Values: A positive integer < 32 and must not be >= MaxCidr below.

MinCidr: 8


# MAXCIDR is the maximum allowable number of cidr netblock bits.  The higher this number, the fewer IPs are 
# blocked.  Sometimes WHOIS will return a single IP address ("/32") when it either has a problem or the entry is 
# actually a "/32" netrange.  It is best to override this with a maximum value like 24 to ensure that at least a 
# minimum sized netblock is added to the block list.  Note that if MinCidr and MaxCidr are equal or overlap, 
# unpredictable results may occur and the program may crash.
# Allowed Values: A positive integer > MinCidr above and <= 32.

MaxCidr: 24


# USEWHOIS, when set to true, causes the program to ask WHOIS what the official netblock size is.  Normally you 
# want to set this to TRUE in order to block all IP's that a public VPN might be using.  Many hackers will use 
# VPN's in order to avoid getting detected and also to make it easier to get a new IP address when the old one 
# gets blocked.  By blocking the VPN's entire netblock, the hacker must subscribe to a different public VPN in 
# order to continue his attack.  If you have a huge number of "unique" IP addresses that need to be blocked, 
# sometimes this will delay processing since each WHOIS lookup takes one second.  This is because it you try to 
# hit the WHOIS server any faster, it can result in YOUR server being treated as an attacker and blocked.  If 
# you set this variable to FALSE, then WHOIS will not be contacted and the IP netblock size will be set to the 
# value of MaxCidr above.  This will save you one second for each "Unique" IP added but at the risk of letting 
# hackers that use VPN's to have continued access to your server.  NOTE that whois is only contacted for NEW IPs 
# that have been found.  So depending on the cron frequency, leaving this active will rarely add more than 10
# seconds to each run.  Imported IP lists are never processed by whois so they don't add to the whois processing time.
# Allowed Values: "True" or "false"

UseWhois: true        # recommended


# TRANSFER COMMAND
# This is the command that will send the ipset file to the router or firewall.
# Allowed: This can be any valid cli command.  The variable %src% is replaced with a local path to the local ipset.
#  The %dst% variable is replaced with the path to the ipset on the router.
#  Recommended: "rsync -c -e 'ssh -o BatchMode=yes' %src% root@tomato.lan:%dst%"
#  Also Recommended: "scp -O -o BatchMode=yes %src% root@tomato.lan:%dst%"   // -O forces legacy mode for openwrt
#  Also Recommended: "cp %src% %dst%"    // Recommended only if using the firewall on the asterisk machine.
#  PLEASE TEST THESE COMMANDS MANUALLY BEFORE INCLUDING THEM HERE.  MAKE SURE THAT SSH WORKS WITH KEYS SO PASSWORD NOT REQUIRED.

# Be sure to use the correct IP of your router (this is not automatically set).
TransferCmd:  "timeout 300 rsync -c -e 'ssh -o BatchMode=yes' %src% root@192.168.1.1:%dst%"  


# FIREWALL RELOAD COMMAND
# This is the command that will reload the firewall after the ipset has been transferred.
# Recommended:  "ssh -o BatchMode=yes root@192.168.1.1 ' /etc/init.d/firewall reload' "   // use ssh to remote reload
# For local firewalls: "/etc/init.d/firewall reload"                  // directly reload (**example only**)


ReloadCmd:  "ssh -o BatchMode=yes root@192.168.1.1 ' /etc/init.d/firewall reload' "



# IMPORT PUBLIC ASTERISK HACKER IP LIST
# There are several publicly posted IP sets online that you can add to your own blacklist.
# In order for the parser to include them properly, they must have only one IP on each line with no 
# characters except numbers, dots and an optional '/'.  Only IPv4 is supported.  The import variable parameters may be a 
# valid url or a valid path to a local file.  If you find an Ipset in a different format, then you need to 
# write your own script to read it and write a file in the proper format, then include the file path here.
# To include more than one list, separate with commas and use backslash characters to continue the line.

Import: "https://raw.githubusercontent.com/sgofferj/sipblocklist/refs/heads/master/sipblocklist.zone" , \
        "https://www.voipbl.org/update"


# COMPRESS IMPORTED ADDRESSES
# To keep the IP address list small, a compression algorithm groups nearby IPs into blocks.
# This variable sets the threshold for grouping: it defines the percentage of IPs that must 
# be present in a range before the system merges them into a single CIDR block.
# 
# For example, if a 4-address block has 3 active IPs (75%) and this variable is set to 60%, 
# the system will merge them into a single block (e.g., 1.2.3.0/30) because 75% is higher than 60%.
# The variable value should be a number between 0 and 100 inclusive.  However, if the percentage is too 
# low, the entire address space will be grouped into 0.0.0.0/0, if it is too high, then compression will
# be ineffective.  Optimal values seem to be between 50 and 75.

Compress: 50



# This is the number of days to keep the IP block banned.  Set to -1 to have no expiration.
# If a public ban list is imported, if the IP is still present in the imported list, it will be re-added.

EXPIRE:  7