dustinmoris/firewall

ASP.NET Core middleware for IP address filtering.

Hi there 👋

• 😀 My name is Dustin...
• ⌨️ I code in C#, F# and Go
• 👌 A little bit of JavaScript and frontend languages too
• 🚀 I maintain a few OSS projects which you can see below...
• 💻 I also love blogging on ➡️ dusted.codes ⬅️
• ☕ I'm massively addicted to coffee
• 🐮 And stopped eating meat in 2️⃣0️⃣1️⃣8️⃣
• 🐠 But I still eat the occasional fish
• 🐅 My Chinese star sign is tiger 🐯
• 🌍 And I love our beautiful planet and wish we'd treat it better
• 💺 This was a list of completely random stuff, just like this seat
• 📫 You can reach me via my blog

Some of the web stuff I build:

• ⌨️ Keyboard Jobs - A job board for software developers, geeks and cyborgs
• 🦒 Giraffe (F# web framework)
• 🍅 .NET Ketchup (.NET news aggregator)
• 🎄 .NET Advent Calendar
• 🧑‍🎄 Go Advent Calendar
• 🇬🇧 Top 10 London (London food & leisure blog)
• 📈 BuildStats.info (Build charts and package badges)

firewall's Issues

Possible to block specific methods/controllers?

Thanks for a nice nuget!

Is it possible to configure it so that it is not on an application leven but more detailed, like having specific IP requirements for a controller/method?

Thanks.

Question

is it possible to protect a specific api's using filter ? also all the requests are coming from cloudflare too

X-Forwarded-For HTTP Header isn't used

I think that the value of X-Forwarded-For is not set in the RemoteIpAddress as stated in the doc. A custom rule is required for load balancers forwarding this header.

Logging?

It would be great if we could log the request from a blocked IP. This is great for analytics, forensics and also to see if perhaps there are some other IPs we should consider allowing (through log analysis). Perhaps ILogger can be injected into the middleware constructor.

Perhaps pass an options via an Action<> param.... i.e.

app.UserFirewall(opts => opts.EnableLogging = true);

and/or

var opts = new FirewallOptions(); app.UserFirewall(opts);

Only deny certain IP addresses

Hi,

I looked through the documentation and source codes, I could not find a built-in way to only block certain IP addresses.

Is it the best way to implement a custom rule by inheriting IFirewallRule and add the logic there?

Block Specific Hosts

Would be great to allow an exclusion style lists as well. Say something like:

DontAllow(List<CIDRs>);
DontAllow(List<IPAddress>);
DontAllow(List<CountryCode>);

Right now, if I want to allow every country, say, except for Micronesia I have to list EVERY country but Micronesia. Same thing if I want to only block a few IPs... That said - great library!!! Thanks for your work!

Block Traffic by Country

Hi @dustinmoris ,

Could you kindly provide an example (sample) of Block Traffic by Country and storing configuration in appsettings.json

How to Block Traffic by Country in the CSF Firewall

It will be a cool feature to add 👍

Except From Localhost not allowing requests from "::1"

I might be missing something but it seems when I hit my service from localhost the remote Ip address is set to "::1" which is not allowed (see screenshot below)

Is this not supposed to be allowed as part of the localhost rule?

MVC sample

@dustinmoris,
Please can you upload a MVC sample to this repository?
If country or IP address is not allowed show blocked error page.
if allowed IP continue to home page 👍

Add support for async rules

I need to support dynamic rules loaded from a DB. Could we get an IAsyncFirewallRule interface where IsAllowed returns ValueTask<bool>?

ExceptFromCloudflare seems to have no effect

 app.UseFirewall(FirewallRulesEngine.DenyAllAccess()
                                            .ExceptFromCloudflare("https://www.cloudflare.com/ips-v4", "https://www.cloudflare.com/ips-v6")
                                            .ExceptFromLocalhost());

Following this example from the documentation in my experience resulted in all requests through Cloudflare being denied. What I am missing?

Support X-Forwarded-For

Could support X-Forwarded-For Ip Address for Nginx forwarded in Linux platform?