AdguardTeam / AdguardTeam/AdGuardHome
Support ASN / GeoIP to block client requests from entire hosting servers / countries
- Lingua principale
- TypeScript
- Stelle
- 36.9k
- Fork
- 2.5k
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
### Prerequisites
Please answer the following questions for yourself before submitting an issue. **YOU MAY DELETE THE PREREQUISITES SECTION.**
- [x] I am running the latest version (v0.101.0)
- [x] I checked the documentation and found no answer
- [ ] I checked to make sure that this issue has not already been filed (Too difficult for me to find a fitting search term to search through issues with.)
### Problem Description
As per https://github.com/AdguardTeam/AdGuardHome/issues/1032#issuecomment-600063960.
In 'DNS settings', I request it could become possible to block requests from entire webhost servers at once through their official(?) AS numbers. For instance, the entirety ot `CARInet` could be blocked with *AS10439*, and the entirety of `Dedipath` (incl. their many subcontractors) could be blocked with *AS35913*. This could dramatically reduce the amount of effort and/or time that'd be needed to maintain anti-'Port scanner' client rejection lists.
There is however one big problem: It's not entirely clear to me which website has the best and most up-to-date info on which AS-number-using webhost that is using which IPs. https://ipinfo.io/ has the database that is the most easily accessible by laymen, at least when it comes to non-raw formats; but sometimes isn't entirely up to date on new IP address acquisitions.
However, depending on where AdGuard Home gets their hosting server names for the "Most common clients" statistic from (and whether they get that info on the cheap or not), tying those hosting server names to AS numbers that can be blocked, would likely be the best *and* easiest solution, **but** it'd currently fail to notice, process or block around a third of incoming requests, especially those shown in "Most common clients" as *Mobile end user NAT pool*
### Proposed Solution
In DNS Settings → Disallowed Clients, entries starting with `AS` and followed by digits, will be accepted and used to block requests from entire webhost servers at once.
### Alternatives Considered
None that I'm aware of.
### Additional Information
Many IP CIDR info sites, such as IPinfo, fail to properly compress the CIDRs listed for each webhost, leading to partially redundant CIDRs like `123.45.66.0/23` and `123.45.67.0/24` being listed for the same company at once. This is also something to consider when looking for the best IP address information source.
There's also a theorethical chance that some webhosts have not been assigned AS numbers *at all*. I remember that finding the AS number for `RebeccaHost` was not particularly easy, and `Poney Telecom` I think I gave up trying to find the number of.
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.