I think you need to approach this issue from a different direction. There are a
number of problems with your proposed solution
- It is a maintenance nightmare.
- It is a reactive rather than proactive solution. You will only add blocked IPs once
the IPs have tried to break in. This could be too late
- It ignores the problem that many IPs are assigned dynamically. Just because you
were attacked from a specific IP yesterday, it doesn't necessary hold that the same
individual is using that IP today.
Generally, the starting point with traditional firewalls is you begin by blocking
everything and then start opening up only what is needed. When this begins to be a
problem, it frequently identifies an underlying architecture weakness.
For example, if I have a server, I will start by blocking all incoming connections
and then look at the services I'm running and assess where they need to be accessed
from. If I am running a web server, does it need access from everywhere is does it
just need access from my company network or a subnet within that network?
If it needs access from everywhere, then I'll permit all IP addresses to access
it. If it only needs to be accessed from my company network, I'll only allow access
from that IP range.
Depending on the system architecture and application requirements, a basic firewall
may not be sufficient. For example, you have a web application which in general needs
to be open to the world, but there are URLs within the application used for
administration which you want to lock down to just a small number of IP addresses. In
this case, either the application will provide the level of access control you need
i.e. serves up a page forbidden error for requests from any IP which isn't part of
the admin list or you have an application firewall which sits between your boarder
firewall and your application.
Sometimes, the problem is that you need to provide admin access to a resource, but
you don't know what IP address the user will be coming from. In these situations, you
might have to insist that the admin person users a company VPN, which will allow them
to connect from anywhere, but will restrict their client address to a range within
your VPN subnet. Alternatively, you may use some form of reverse proxy where the
admin person needs to connect through an authenticated proxy and the IP adddress for
the resource is restricted to the IP of the proxy. The problem with this solution is
that you will possibly now see attacks against your proxy. However, this might be OK
as you have added another layer of complexity which may provide sufficient
protection - now attackers must first compromise your proxy and them compromise your
admin service (assuming they use different passwords of course).
There are also firewalls which provide IDS+IPS facilities. The IDS looks for
suspicious behaviour, such as large numbers of failed authentication requests to a
service. When such an event is detected, it triggers the IPS to put a temporary
block/drop on the source IP. Such systems can be very good, but they can be difficult
to get configured correctly, often need a bit of maintenance and need to be
monitored to detect issues with things like false positives which might result in
legitimate traffic being blocked.
The other approach you can do is to rate limit the resource. Brute force attempts
depend on being able to perform high numbers of attempts in a short period. If you
rate limit the request, brute force attacks can become impractical because they take
too long. A common example is to have a login page where a delay is used in
responding to failed login attempts. As the number of login attempts increases, the
delay increases.
Rather than blocking addresses, I would be looking for a solution which allows you to
only permit specific addresses to the areas you are concerned about. If this is not
possible because it is something like a general login page for your customers and you
cannot know what IP addresses they are coming from, then I would be looking at what
additional IDS/IPS you might be able to implement at either the application or
application firewall level. If you have no other solution than to block IP addresses,
I would be seeking a solution which allows temporary blocking and which will remove
the blocks after an acceptable period. To be effective, the blocking must be an
automated process - blocking IP addresses after an attempted brute force attack is
usually shutting the gate after the horse has bolted.
