Cavemanon/haproxy-protection
8
Fork 0
mirror of https://gitgud.io/fatchan/haproxy-protection.git synced 2025-05-09 02:05:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add geo blocking for country and continent, changes get_ip_var lua script section to use two tables

Browse Source
This commit is contained in:
Thomas Lynch
2023-10-15 18:13:52 +11:00
parent 2f9823bf51
commit 1dd69fd924
7 changed files with 38 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
haproxy/haproxy.cfg
View File

@ -56,11 +56,11 @@ frontend http-in
#option forwardfor
# optional geoip handling (maps required) and alt-svc header addition
# http-request set-var(req.xcc) src,map_ip(/etc/haproxy/map/geoip.map)
http-request set-var(req.xcc) src,map_ip(/etc/haproxy/map/geoip.map)
http-request set-var(req.asn) src,map_ip(/etc/haproxy/map/iptoasn.map)
# http-request set-var(txn.xcn) var(req.xcc),map(/etc/haproxy/map/cctocn.map)
# http-request set-header X-Country-Code %[var(req.xcc)]
# http-request set-header X-Continent-Code %[var(txn.xcn)]
http-request set-var(txn.xcn) var(req.xcc),map(/etc/haproxy/map/cctocn.map)
http-request set-header X-Country-Code %[var(req.xcc)]
http-request set-header X-Continent-Code %[var(txn.xcn)]
http-request set-header X-ASN %[var(req.asn)]
# drop requests with invalid host header
@ -70,14 +70,18 @@ frontend http-in
# debug information at /.basedflare/cgi/trace
http-request return status 200 content-type "text/plain; charset=utf-8" lf-file /etc/haproxy/template/trace.txt if { path /.basedflare/cgi/trace }
# acl for blocked IPs/subnets/ASN
# acl for blocked IPs/subnets/ASN/country
http-request lua.set-lang-json
acl found_in_blockedip_map src,map_ip(/etc/haproxy/map/blockedip.map) -m found
acl found_in_blockedasn_map var(req.asn),map(/etc/haproxy/map/blockedasn.map) -m found
acl blocked_ip_or_subnet_or_asn var(txn.blocked_ip_or_subnet_or_asn) -m bool
http-request lua.set-ip-var blockedip txn.blocked_ip_or_subnet_or_asn ip if found_in_blockedip_map
http-request lua.set-ip-var blockedasn txn.blocked_ip_or_subnet_or_asn asn if found_in_blockedasn_map
http-request deny deny_status 403 if blocked_ip_or_subnet_or_asn
acl found_in_blockedcc_map var(req.xcc),map(/etc/haproxy/map/blockedcc.map) -m found
acl found_in_blockedcn_map var(txn.xcn),map(/etc/haproxy/map/blockedcn.map) -m found
acl blocked_bool var(txn.blocked_bool) -m bool
http-request lua.set-ip-var blockedip txn.blocked_bool ip if found_in_blockedip_map
http-request lua.set-ip-var blockedasn txn.blocked_bool asn if found_in_blockedasn_map
http-request lua.set-ip-var blockedcc txn.blocked_bool cc if found_in_blockedcc_map
http-request lua.set-ip-var blockedcn txn.blocked_bool cn if found_in_blockedcn_map
http-request deny deny_status 403 if blocked_bool
# ratelimit (and for tor, kill circuit) on POST bot-check. legitimate users shouldn't hit this.
http-request track-sc0 src table bot_check_post_throttle if { path /.basedflare/bot-check } { method POST }

2
haproxy/map/blockedasn.map
View File

@ -1 +1 @@
12345 admin:asdf
#12345 admin:asdf

1
haproxy/map/blockedcc.map Normal file
View File

@ -0,0 +1 @@
AU admin

0
haproxy/map/blockedcn.map Normal file
View File

2
haproxy/map/cctocn.map
View File

@ -1 +1 @@
XX ZZ
AU OC

2
haproxy/map/geoip.map
View File

@ -1 +1 @@
1.2.3.4/24 XX
0.0.0.0/0 AU