Overview

The Clavister NetShield Firewall implements a Blacklist of traffic types which can be utilized to protect against traffic coming from specific Internet sources.

Certain subsystems have the ability to optionally blacklist an IP address when certain conditions are encountered. These subsystems are:

Blacklist Entry Data

Each entry in the blacklist holds the following set of data fields:

When a rule, such as a threshold rule, is the triggering object and its action specifies to blacklist the traffic, an entry in the blacklist is created and many of the properties listed above are assigned the corresponding values from the triggering object.

The Service object used in the triggering object is not copied directly to the blacklist entry. Instead, it is broken down into its components and these are assigned to the Proto and Port properties of the blacklist entry. This is because the entries in the blacklist are not configuration objects as they are with the whitelist.

The blacklist CLI Command

The administrator can manually add, list and delete blacklist entries using the CLI command blacklist. It is also possible to display the entries in the Whitelist configuration object but not edit it. Editing the whitelist is discussed in Section 25.2, Whitelisting.

The basic form of the command without options will list both the current blacklist and whitelist:

System:/> blacklist
		
                 Whitelisted Addresses

Source Interface  Source IP        Destination IP  Service
----------------  ---------------  --------------  -------
if1               203.0.113.9      all-nets        all_tcp

                               Blacklisted Addresses

        Source  Source       Dest      Dest              Trigger   Trigger
Proto   Iface   IP           IP        Port/ID  Timeout  System    Object
------  ------  ------------ --------- -------- -------- --------- -------
ALL     if1     203.0.113.1  all-nets  0-65535  n/a      CLI       n/a

To get just the blacklist or just the whitelist, use the -show=blacklist or -show=whitelist options:

System:/> blacklist -show=blacklist

The option -show=all is the same as blacklist with no options.

Manually Adding a Blacklist Entry

To manually add a blacklist entry, use the -add option. The following command blocks the source IPv4 address 203.0.113.2 arriving at the if1 interface:

System:/> blacklist -add -srciface=if1 -srcip=203.0.113.2
		
                    Added entry to blacklist:
										
        Source   Source       Dest       Dest     
Proto   Iface    IP           IP         Port/ID    Timeout
------  -------  -----------  ---------  ---------  -------
ALL     if1      203.0.113.2  all-nets   0-65535    n/a

The source address could have been specified as an address object called my_bad_address:

System:/> blacklist -add -srciface=if1 -srcip=my_bad_src_address

Note that in either case, only a single IPv4 or IPv6 address can be specified as the source IP. A range or network cannot be specified.

Also, as a minimum, the -srcip and -srciface options must both be specified when adding a blacklist entry. The destination IP will default to all-nets if not specified and the Proto and Port properties will match all protocols if not specified (as shown in the example above).

Manually adding whitelist entries is done by adding WhitelistRule object as children to the predefined Whitelist configuration object. This is discussed in Section 25.2, Whitelisting.

Manually Removing a Blacklist Entry

It is possible to manually remove a blacklist entry with the -remove option. Like adding an entry, at least the -srciface and -srcip options must be specified:

System:/> blacklist -remove -srciface=if1 -srcip=203.0.113.2

Searching for Blacklist Entries

The -lookup option will list blacklist entries that match a set of criteria. To display all entries with a source IP of 203.0.113.2, the command would be the following:

System:/> blacklist -lookup -srcip=203.0.113.2
		
                    Matched Blacklist Entries
										
       Source  Source       Dest      Dest               Trigger    Trigger
Proto  Iface   IP           IP        Port/ID   Timeout  System     Object
-----  ------  -----------  --------  -------   -------  ---------  -------
ALL    if1     203.0.113.2  all-nets  138       42       Threshold  myrule1

Processing Duplicate Blacklist Entries

When a new blacklist entry is added, cOS Stream searches the existing entries to make sure that it is not a duplicate of an existing entry. A duplicate means that all parameters are the same except for the timeout. When a duplicate is detected, the entry with the longer timeout is retained in the list and the one with the shorter timeout is discarded.