Check current blocklist? (interrogate for list of banned IPs)

[luckman212]

Is there any way to check the current list of blocked/banned IPs? I'd like to be able to query it somehow and use the output to feed my firewall's blocklist to tighten security.

[luckman212]

Just to circle back and explain my use case:

Traefik currently routes logs to stdout OR opentelemetry (but NOT both, although there IS an open Pull Request for this...)

I have all my logs going to Graylog via OTEL for now.

I get a handful of IPs banned every day by Fail2ban (yay) but hunting down the intial requests that caused them to be banned is difficult in the huge sea of logs in my Graylog server.

SO– It would be really convenient if there were a way to view the current (in memory?) list of banned IPs from the middleware plugin via some command/API.

[tomMoulard]

Hello @luckman212,

Thanks for your interest in this Traefik plugin!

What would be your best-case scenario for you? Or what would work the best with your firewall to ingest ?

I imagine parsing the logs of Traefik (and this plugin) is too much of a hassle for your firewall. If you look at the plugin output, you should see a log every time the plugin blocks an IP.

One other solution would be to provide a webhook feature to send a request every time a thing in the pool changes (i.e., an IP is banned/unbanned).

[luckman212]

Thanks for thinking about this!

Currently I'm shipping my Traefik logs via OTLP to Graylog, and was planning to use Graylog to trigger the webhooks when necessary (it feels like adding the webhook directly to your plugin would be a little bit out of scope/bloat)

Yes I do see the log messages from Fail2ban hitting my Graylog server when an IP is banned, e.g.

My firewall (pfSense) supports blocking IPs via a plaintext feed of IPs/CIDR subnets that can be fetched using HTTP.

So what feels like it would be "lightweight" and useful (in my case) would be a way to signal the plugin to dump the current banned IP list as plaintext (and/or JSON) using an API endpoint. Or maybe it can be included in the response from the builtin Middlewares API ? e.g.

curl -s http://localhost:8080/api/http/middlewares/fail2ban-default@file | ...

[tomMoulard]

Sadly, the plugin cannot export data to this endpoint. The response of this endpoint contains the configuration of the plugin and the configuration of Traefik.

example payload

$ curl $TRAEFIK_ENDPOINT/api/http/middlewares/fail2ban@file | jq .
{
  "plugin": {
    "fail2ban": {
      "rules": {
        "bantime": "3h",
        "enabled": "true",
        "findtime": "10m",
        "maxretry": "1000",
        "ports": "80:443"
      },
      "whitelist": {
        "ip": [
          "::1",
          "127.0.0.1"
        ]
      }
    }
  },
  "status": "enabled",
  "usedBy": [
    "traefik@docker",
  ],
  "name": "fail2ban@file",
  "provider": "file",
  "type": "fail2ban"
}

Does having a file that is kept up to date with the content of the banned IP address could work for your use case?

[luckman212]

Yes, a file that stays up to date with the current ban list would be great!

[tomMoulard]

note: could be implemented as a notification after #174 is merged