DNSBL/Open Proxy-Blocking

History

I've had some problems with abuse via open proxies for a time ago, and when we were banning abusers, they always found a new proxy to use and register new accounts with. Since this forum was a large type we could'nt just ban e-mails etc just like that, because this was leading to a very large amount of other banned users too.

At IRC, in the other hand, we had Open Proxy Monitors, that was banning everything that was blacklisted in some DNSBL-databases. No spammers had a chance to get in there as long they were listed in such database.

This is a plugin that blocks blacklisted hosts from some different DNSBL's. It uses the global_start-hook, a very simple handler for blocking proxies, and a vBphrase called OPM_Deny.


April 2006

The source has been rewritten a bit. The proxychecker is now using a cache that, by default, stores all ip's in a database for 6 hours. It scans some DNSBL's and can be configured to block proxies from bitmasks (defined in the plugin) which makes it a little bit more reliable, because it does'nt block everything it see).

Configuration is made from the plugin (hopefully there will be a nice admin interface in the future). Exceptions (ip's that can pass through this system even if it is a proxy) are also handled differently now.

// CHANGES
//
// 2008-09-20 (2.0.8)
//
// * Changed the routines for how to handle inclusion/exclusions
// * Splitted up plugins for 3.5/3.6 and 3.7
//
// 2007-08-05
//
// * Fixed reported bug, based on resolved hosts ending with 127
// * Changed database-tables to get rid of (hopefully) duplicate keys
// * Added resolver-function
// * Added two new block-methods available at the efnet-rbl
//
// 2006-06-28 (2.0.6/Another fix)
//
// * Proxyinclusions/exclusions didn't work properly
//
// 2006-06-28 (2.0.5/Fix only)
//
// * Fixed a bug in the $block-array that affected some of the blocking results
//
// 2006-06-28 (2.0.4)
//
// * opm.tornevall.org has a new entry for anonymizers, added support for this
// * Default value on "block everything detected" in plugin changed to "no"
//
// 2006-06-26 (2.0.3)
//
// * Created options for admincp (removed plugin-configuration)
// * Fixed a bit-bug for njabl
// * Plugin is now a function (rbl_livecheck) for external lookups
// * Added options for "only block on newuser-registrations"
//
// 2006-06-22 (2.0.3 RC)
//
// * The monitor is now a function
// * Added small compatibility with other plugins (with return)
//
// 2006-05-13
//
// * sorbs zones added (no bitmasking)
// * opm.blitzed.org removed
// * time() changed to TIMENOW
//
// 2006-04-21
// ==========
//
// * proxyinclusions
// quickly add own hosts that should be treated as a proxy
//


How does it work with other vBulletins?

This filter actually works with both 3.5 and 3.6, but for now, they will be separate versions, but for 3.5 and 3.6 you should look here and for 3.7 you should look here.


How to use the compatibility thing

If you have a plugin that you want to use together with the proxy monitor (only returns a value if a an ip-address is registered as a proxy or not) you can call the function rbl_livecheck like this (example):

PHP Code:

global $rblInstalled;

if ($rblInstalled) {
$remoteIsProxy = rbl_livecheck(1, $_SERVER['REMOTE_ADDR']);

//
// .. your code here ..
//

} 


Report bugs if you find them...



Don't forget to install it

[eoc_Jason]

If you switch the code to a shutdown query, then it shouldn't affect load as much.

[Smiry Kin's]

not sure if its just me. but when i install it, it messes up my index. and won't view it.. i disable - and perfect? :s any way to block any type of proxys?

[XFSImperial]

I experienced similar problems, completely crippled the index.php with a could not locate OPM_Deny message I believe it was. Index works fine with it disabled...

[Smiry Kin's]

maybe a offical release/fix for 3.5.2?

[TMM-TT]

I've been playing around with this code a bit and I'm not sure if this works, so I want to check with you before I say something about the code. If it works, maybe someone can help me with a product update?

First, I created a new table for the database (dumped with mysqlcc ):

CREATE TABLE `proxycache` (
  `ip` varchar(15) NOT NULL default '',
  `dateline` int(11) NOT NULL default '0',
  `listed` int(11) NOT NULL default '0'
) ENGINE=HEAP DEFAULT CHARSET=latin1 COMMENT='proxycache';

And the code, for caching resolved hosts (this is a replacement for my first code actually):

PHP Code:


// #######################################################
// DNSBL/OPM Proxy Blocker for VB 3.5.2
// Based on an old script added to global.php
// Version 1.0.1 - Written by Tomas Tornevall (TMM-TT)

$timestamp = time();
$cleanafter = 21600;
$timediff = $timestamp - $cleanafter;

// Clean up old entries
$db->query_write("DELETE FROM " . TABLE_PREFIX . "proxycache WHERE dateline < $timediff");


// OPM Databases to use
$opmlist = array(
        "opm.blitzed.org",
        "opm.tornevall.org",
        "dnsbl.njabl.org"
        );

// Pick the data we need
$OPMremote = $_SERVER['REMOTE_ADDR'];

// Make the data reversed for DNSBL
$OPMReverseRemote = explode(".", $OPMremote);

$reverseip = "$OPMReverseRemote[3].$OPMReverseRemote[2].$OPMReverseRemote[1].$OPMReverseRemote[0]";

$proxydb = $db->query_first("SELECT ip,listed FROM " . TABLE_PREFIX . "proxycache WHERE ip = '$OPMremote' LIMIT 1");

$proxyexist = $proxydb['ip'];
$proxylisted = $proxydb['listed'];

// If nothing has been added, act normal
if (!$proxyexist) {

foreach ($opmlist as $OPM) {
  $OPMResolved = gethostbyname($reverseip . "." . $OPM);
  $OPMAnswer =  explode(".", $OPMResolved);
  // Block all hosts that has been resolved to 127.0.0.xxx
  if ($OPMAnswer[0] == "127") {$opmfound = 1;}
  }

}


// Manually added OPM's goes here, just in case of problems (You might want to let someone in?)
// Dont forget the $proxylisted = 0 here
//if ($OPMremote == "whatever.you.want.to.protect.here") {$OPMfound = 0;$proxylisted = 0;}

if ($opmfound == 1) {
     $db->query_write("INSERT INTO " . TABLE_PREFIX . "proxycache (ip, listed, dateline) VALUES ('$OPMremote', 1, $timestamp)");
     $proxylisted = 1;
     } else {
     // 127.* was'nt found, so this one is'nt listed. Also check if it was found in the db. If not - add
     if (!$proxyexist) {$db->query_write("INSERT INTO " . TABLE_PREFIX . "proxycache (ip, listed, dateline) VALUES ('$OPMremote', 0, $timestamp)");}
  }

// If found in db, send error
if ($proxylisted == 1) {
          eval(standard_error(fetch_error('OPM_Deny')));
} 


Any comments? Can this work?




Edit/050103: Just found a human-bug, that was fixed from now
$query_write should be $db->query_write, very sorry for that.

[DementedMindz]

seems like these are all using Front-End Error Messages if im correct... and this is no longer in vbulletin 3.5.3 can someone update these?

[thedvs]

works fine in 3.5.3 for me

[Kacela]

I would love for this to come back to life. I had been using it, and it was wonderful! The only drawback was from the "false positives", and sadly, I had to disable it - if someone could step up and code in a conditional statement that checks against a admin-entered .txt or .xml whitelist, put your PayPal link in. and I'll send some "thanks" your way...

[pantec]

I am having problems changing the OPM Phrase that appears to people...

Any IDeas?

[TMM-TT]

I've just uploaded a new version...