# DROP\_HOSTILE whitelisting

**URL:** <https://community.ipfire.org/t/drop-hostile-whitelisting/11991>\
**Category:** Firewall Rules\
**Created:** [22 August 2024 09:38 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991 "2024-08-22T09:38:57Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![shizartistdev](https://community.ipfire.org/user_avatar/community.ipfire.org/shizartistdev/32/11317_2.png) [@shizartistdev](https://community.ipfire.org/u/shizartistdev)\
**Post date:** [22 August 2024 09:38 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/1 "2024-08-22T09:38:57Z")

</div>

I’ve encountered a problem with access to the online shop [ozon.ru](http://ozon.ru) (a Russian analogue of Amazon), which only appeared when the _‘Drop packets from and to hostile networks’_ option was enabled.

 ![изображение](https://community.ipfire.org/uploads/default/original/2X/d/d018f017da2a66fd14e135428bba2dcff997d1c7.png)

I spent some time looking for the solution, and ended up finding [this topic](https://community.ipfire.org/t/traffic-to-my-website-is-dropped-with-drop-hostile/11554), and I tried running location update and re-exporting my location list with the ipset command suggested by @ross_codes:

```auto
/usr/bin/location export --directory=/var/lib/location/ipset --family=ipv4 --format=ipset

```

Unfortunately this didn`t help, so I searched website’s ip-addresses in updated _location list_ and _XD set_, but there were neither addresses nor their subnets there. Also, the website appears to be not listed at Spamhaus or any other blocklist, so it’s shouldn’t be blocked by _HOSTILE_ rule at all.

I’m kinda new here, so I`m not familiar with older core versions, but if I undersood it right - modern versions’ _DROP\_HOSTILE_ uses rules from HOSTILE\_DROP\_IN and HOSTILE\_DROP\_OUT iptabels, which don’t reference to any blocklists.

I fixed this issue using method from [another topic](https://community.ipfire.org/t/can-i-white-list-one-ip-so-it-do-not-get-drop-hostile/11535), and whitelisted all the shop`s ip-addresses i could find in _/etc/sysconfig/firewall.local_, using code below _(based on_ @casabenedetti’s _code from the original post):_

```auto
#!/bin/sh
# Used for private firewall rules

# See how we were called.
case "$1" in
  start)
        ## add your 'start' rules here

        ## Ozon ip addresses
	if ! iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.194.82 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.194.82 --dport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.194.82 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if ! iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.194.82 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.194.82 --sport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.194.82 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if ! iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.193.119 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.193.119 --dport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.193.119 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if ! iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.193.119 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.193.119 --sport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.193.119 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if ! iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.195.117 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.195.117 --dport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.195.117 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if ! iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.195.117 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.195.117 --sport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.195.117 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if ! iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.195.116 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.195.116 --dport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.195.116 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if ! iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.195.116 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.195.116 --sport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.195.116 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if ! iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.195.108 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.195.108 --dport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_OUT -p tcp -d 185.73.195.108 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if ! iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.195.108 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.195.108 --sport 443 -j ACCEPT
		iptables --verbose --insert HOSTILE_DROP_IN -p tcp -s 185.73.195.108 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi
        ## Ozon ip addresses

	;;
  stop)
        ## add your 'stop' rules here

        ## Ozon ip addresses
	if iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.194.82 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.194.82 --dport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.194.82 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.194.82 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.194.82 --sport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.194.82 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.193.119 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.193.119 --dport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.193.119 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.193.119 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.193.119 --sport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.193.119 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.195.117 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.195.117 --dport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.195.117 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.195.117 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.195.117 --sport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.195.117 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.195.116 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.195.116 --dport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.195.116 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.195.116 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.195.116 --sport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.195.116 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi

	if iptables --check HOSTILE_DROP_OUT -p tcp -d 185.73.195.108 --dport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.195.108 --dport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_OUT -p tcp -d 185.73.195.108 --dport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT "
	fi

	if iptables --check HOSTILE_DROP_IN -p tcp -s 185.73.195.108 --sport 443 -j ACCEPT >/dev/null 2>&1 ; then
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.195.108 --sport 443 -j ACCEPT
		iptables --verbose --delete HOSTILE_DROP_IN -p tcp -s 185.73.195.108 --sport 443 -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "OZON_HOSTILE_BYPASS_OUT_IN "
	fi
        ## Ozon ip addresses

        ;;
  reload)
        $0 stop
        $0 start
        ## add your 'reload' rules here
        ;;
  *)
        echo "Usage: $0 {start|stop|reload}"
        ;;
esac

```

And it helped! Connection to the website is actually working now.

But it’s obviously not a permanent fix, and it’s really feels more like a kluge, so I wonder if there is a better solution to my problem.  
And if there is none - I hope this topic will help someone with similar problem.

---

<div class="post-metadata">

**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\
**Post date:** [22 August 2024 09:59 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/2 "2024-08-22T09:59:35Z")

</div>

Welcome to the community. Unfortunately, this I think is the only solution. The ultimate solution would be if the service administrators, move their services to the unbanned servers. But I am very incredulous about this. The alternative is to use a new service, if posible.

---

<div class="post-metadata">

**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\
**Post date:** [22 August 2024 10:47 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/3 "2024-08-22T10:47:50Z")

</div>

Consider that even if a GUI system were implemented in IPFire to unblock those IPs by choice, the main problem is that the firewall would be at risk. If a server is banned like that, there must be a valid reason. Taking away the protections in those cases, I don’t see it as good. This is what I think. 😉

I report a scenario:

1. You unblock port 443 on the hostile IP x.x.x.x.
2. You come across a site www…com
3. Lo and behold that site contains viruses, because it is hosted on the very server banned x.x.x.x
4. Imagine what could happen to your PC.

This scenario cannot happen, if you keep the hostile IP x.x.x.x blocked.

Do you understand the problem?

---

<div class="post-metadata">

**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\
**Post date:** [22 August 2024 11:11 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/4 "2024-08-22T11:11:43Z")

</div>

May be able to change firewall settings  
[https://www.ipfire.org/blog/introducing-elementary-network-protection-dropping-all-traffic-from-and-to-hostile-networks-by-default](https://www.ipfire.org/blog/introducing-elementary-network-protection-dropping-all-traffic-from-and-to-hostile-networks-by-default)

---

<div class="post-metadata">

**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\
**Post date:** [22 August 2024 11:30 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/6 "2024-08-22T11:30:20Z")

</div>

Okay, I think I understand. Spamhaus built into IPFire sounds like a great system to me. I apologize for the post I removed 😊 😊 😊.

---

<div class="post-metadata">

**Author:** ![shizartistdev](https://community.ipfire.org/user_avatar/community.ipfire.org/shizartistdev/32/11317_2.png) [@shizartistdev](https://community.ipfire.org/u/shizartistdev)\
**Post date:** [22 August 2024 12:04 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/7 "2024-08-22T12:04:12Z")

</div>

I understand this, that’s why I’m not diabling this DROP feature completely - it’s extremely useful in most cases, but the service that is being blocked - is a giant online-marketplace (that’s also the reason why I can’t use alternatives - this service is neccecary for the company I’m working in). It`s being used across all the country, and it’s very unlikely for it to be compromised or blacklisted.

Also, neither the domain name nor it’s IP addresses are listed at [spamhaus](https://check.spamhaus.org/):

 ![No issues at spamhaus](https://community.ipfire.org/uploads/default/original/2X/1/11db04f456a31301c1a9bb029ae80271e723c795.png)  
Or any other blacklists:  
 ![185.73.194.82](https://community.ipfire.org/uploads/default/original/2X/c/c289681e4fd6fbdb062bef62083b31ae20e416af.png)  
 ![185.73.193.119](https://community.ipfire.org/uploads/default/original/2X/c/c3c00c38b6c6f0b563059f48849a2586b8088041.png)

That’s why it’s weird, that it’s even getting blocked at the first place.

---

<div class="post-metadata">

**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\
**Post date:** [22 August 2024 12:08 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/8 "2024-08-22T12:08:07Z")

</div>

I understand. In cases like this you come to a compromise. I, too, have decided to open for now.

The case that the IPs are not in the spamlist is strange. It should not block in this case 🤔 🤔 🤔. For this I am waiting for suggestions from other users.

---

<div class="post-metadata">

**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\
**Post date:** [22 August 2024 12:17 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/9 "2024-08-22T12:17:44Z")

</div>

However, I remember there was another link where there were spamlists. It seems to me that something had changed. Did you look here?  
[https://www.spamhaus.org/drop/asndrop.json](https://www.spamhaus.org/drop/asndrop.json)

> [@Block of 69.42.215.252 (freedns.afraid)](https://community.ipfire.org/t/block-of-69-42-215-252-freedns-afraid/11272/12):
>
> The IP 69.42.215.252 is assigned to AS17048 - Awknet Communications, LLC which is listed on SPAMHAUS ASN-DROP list. [https://www.spamhaus.org/drop/asndrop.json](https://www.spamhaus.org/drop/asndrop.json)

---

<div class="post-metadata">

**Author:** ![shizartistdev](https://community.ipfire.org/user_avatar/community.ipfire.org/shizartistdev/32/11317_2.png) [@shizartistdev](https://community.ipfire.org/u/shizartistdev)\
**Post date:** [22 August 2024 12:26 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/10 "2024-08-22T12:26:02Z")

</div>

Oh, it’s actually listed here.  
 ![ozon](https://community.ipfire.org/uploads/default/original/2X/d/dfdc41051279de005162579993061299661797e5.png)  
That’s explains why connection is blocked…

But why is it even in the blacklist? It’s just an online shop…  
I guess we’ll never know.

---

<div class="post-metadata">

**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\
**Post date:** [22 August 2024 12:28 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/11 "2024-08-22T12:28:10Z")

</div>

Correct. We would never know. Maybe because the servers that host bad actors cost less? Who knows. 😡

---

<div class="post-metadata">

**Author:** ![shizartistdev](https://community.ipfire.org/user_avatar/community.ipfire.org/shizartistdev/32/11317_2.png) [@shizartistdev](https://community.ipfire.org/u/shizartistdev)\
**Post date:** [22 August 2024 13:36 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/12 "2024-08-22T13:36:28Z")

</div>

Thank you for the help ❤  
I’ll try to contact ozon’s support and notify them about this, maybe they will do something about it

---

<div class="post-metadata">

**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\
**Post date:** [22 August 2024 14:04 UTC](https://community.ipfire.org/t/drop-hostile-whitelisting/11991/13 "2024-08-22T14:04:34Z")

</div>

You can only do that. That is what I did with my service as well, but I received no response. Hopefully, a big store will be more willing to explain 😉 👍