AdguardTeam / AdguardTeam/AdGuardHome

Support ASN / GeoIP to block client requests from entire hosting servers / countries

Aperta
#1,487 11 commenti 23 reazioni 0 assegnatari Vedi su GitHub
feature request P3: Medium
Lingua principale
TypeScript
Stelle
36.9k
Fork
2.5k
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

### Prerequisites

Please answer the following questions for yourself before submitting an issue. **YOU MAY DELETE THE PREREQUISITES SECTION.**

- [x] I am running the latest version (v0.101.0)
- [x] I checked the documentation and found no answer
- [ ] I checked to make sure that this issue has not already been filed (Too difficult for me to find a fitting search term to search through issues with.)

### Problem Description

As per https://github.com/AdguardTeam/AdGuardHome/issues/1032#issuecomment-600063960.

In 'DNS settings', I request it could become possible to block requests from entire webhost servers at once through their official(?) AS numbers. For instance, the entirety ot `CARInet` could be blocked with *AS10439*, and the entirety of `Dedipath` (incl. their many subcontractors) could be blocked with *AS35913*. This could dramatically reduce the amount of effort and/or time that'd be needed to maintain anti-'Port scanner' client rejection lists.

There is however one big problem: It's not entirely clear to me which website has the best and most up-to-date info on which AS-number-using webhost that is using which IPs. https://ipinfo.io/ has the database that is the most easily accessible by laymen, at least when it comes to non-raw formats; but sometimes isn't entirely up to date on new IP address acquisitions.

However, depending on where AdGuard Home gets their hosting server names for the "Most common clients" statistic from (and whether they get that info on the cheap or not), tying those hosting server names to AS numbers that can be blocked, would likely be the best *and* easiest solution, **but** it'd currently fail to notice, process or block around a third of incoming requests, especially those shown in "Most common clients" as *Mobile end user NAT pool*

### Proposed Solution

In DNS Settings → Disallowed Clients, entries starting with `AS` and followed by digits, will be accepted and used to block requests from entire webhost servers at once.

### Alternatives Considered

None that I'm aware of.

### Additional Information

Many IP CIDR info sites, such as IPinfo, fail to properly compress the CIDRs listed for each webhost, leading to partially redundant CIDRs like `123.45.66.0/23` and `123.45.67.0/24` being listed for the same company at once. This is also something to consider when looking for the best IP address information source.

There's also a theorethical chance that some webhosts have not been assigned AS numbers *at all*. I remember that finding the AS number for `RebeccaHost` was not particularly easy, and `Poney Telecom` I think I gave up trying to find the number of.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.