[New] IP Banning help / questions

IP banning sounds a bit odd to me now. At work I can pick any from 15 proxy-servers located across the globe. And I'll be in different countries.

On the internet, there are quite some proxies and anonimizers.
I'm not sure that is still an accurate way to ban people that are pretty persistent.

Quote: Originally posted by quibel

one more question re banning IPs. if i ban a range that someone has already used to register can that person still log in or will it ban them as well. Q

When I'm not mistaken --> Ban.

I don't know if you want to ban IP's in the Admin Panel ... Or by modifying a little bit in the header.php (where the actual banning is done)
The last one would be the easier.


This is the code-snippet that checks the database;

Code:

// Check if the client is ip-banned if ($SETTINGS['ip_banning'] == 'on') { $ips = explode(".", $onlineip); $query = $db->query("SELECT id FROM ".X_PREFIX."banned WHERE ((ip1='$ips[0]' OR ip1='-1') AND (ip2='$ips[1]' OR ip2='-1') AND (ip3='$ips[2]' OR ip3='-1') AND (ip4='$ips[3]' OR ip4='-1')) AND NOT (ip1='-1' AND ip2='-1' AND ip3='-1' AND ip4='-1')"); $result = $db->num_rows($query); $db->free_result($query); if ($result > 0) { // Block all non-admins $serror = 'ip'; } }

I've done some testing, and on my server, the IP can be used with 'smaller' and 'bigger' signs. If you add this here, below the code I just showed you, that should work;

Code:

if ( $onlineip > "110.80.0.0" AND $onlineip < "110.90.0.0" ) { $serror = 'ip'; }

Might be faster then writing a complete hack

Glad I could provide you some insight

Yes, that could be done like that.

Just a quick question; The IP checks, that is just for registration? Or for general board browsing?

Or cut it in pieces....
-> Allow all registrations coming from IP ranges U, V, W ...
-> Deny all registrations coming from IP ranges X, Y,Z ...
-> For the rest, use the normal approval steps.

-> Deny board browsing from IP ranges D, E, F.




Don't know anything about your hosting package, and bandwidth costs... deny certain IP's to browser your board, might help you save something there.

Could you attach your member.php? Maybe yours is different then the plain normal one.

I was originally thinking about doing it on registration but I suppose doing it as the page opens for browsing makes more sence. Then they cant even register so I wont have to do any approving .

I just added your original code and set it from 1.1.1.1 to 255.255.255.255 and uploaded (just to test).

I could browse as an admin but when i logged out, or used a test member account, or moderator account i got this error : "You are banned. You may not view the forums, post, make new topics, send U2U's or edit your posts".

I like it

Bandwidth isnt to much of an issue.

header.php attached.

At presnt I now have 267 IP bans in place (mostly 2nd level ip range), these could be reduced by using ranges a-b, c-d etc which I am currently sorting out on a spreadsheet.

For browsing the board (ignoring registration) it really doesnt matter if you are from a good address or an unknown so really that takes us back to just stopping those in the banned range from using.

so yeah .....
--> if you fall into one of the banned ranges (a-b,c-d,e-f etc)then error, do not pass go, do not collect $200
--> anything else checked like normal, possible browsing, posting, registration etc.

Cheers

Q

Attachment: header.php (28kB)
This file has been downloaded 432 times

Sounds good enough
Now I don't know how you want to provide the ranges.

Network ranges can be specified as:
1. Wildcard format: 1.2.3.*
2. CIDR format: 1.2.3/24 OR 1.2.3.4/255.255.255.0
3. Start-End IP format: 1.2.3.0 - 1.2.3.255


If you only wish to use #3, the following would be interesting. I'd say, ban single IP's in the Admin Panel, and then the ranges using the function below.

Add to the bottom of config.php (perhaps a nice place for it)

Code:

$banned_ranges = array ( '10.0.0.0|10.255.255.255', // single class A network '172.16.0.0|172.31.255.255', // 16 contiguous class B network '192.168.0.0|192.168.255.255', // 256 contiguous class C network '169.254.0.0|169.254.255.255', // Link-local address also refered to as Automatic Private IP Addressing '127.0.0.0|127.255.255.255' // localhost );

As an example, the private address ranges are specified. Perhaps no good idea to keep them there..


Add to functions.inc.php

Code:

function ip_in_range ($ip) { global $banned_ranges; $long_ip = ip2long ($ip); if ($long_ip != -1) { foreach ($banned_ranges AS $pri_addr) { list ($start, $end) = explode('|', $pri_addr); if ($long_ip >= ip2long ($start) && $long_ip <= ip2long ($end)) { return true; } } } return false; }

in header.php , find this

Code:

if ($result > 0) { // Block all non-admins $serror = 'ip'; } }

Replace with this

Code:

if ($result > 0) { // Block all non-admins $serror = 'ip'; } if ( ip_in_range($onlineip) ) { $serror = 'ip'; } }

Found the function over here;
http://stackoverflow.com/questions/13818064/check-if-an-ip-a...


The stuff was spread out over multiple files, as it might come in handy in other parts of the board as well sometime.

That is completely correct

No Go

End of config file looks like (just put in 3 ranges to cover all while testing)

Code:

// IP Range Banning $banned_ranges = array ( '1.0.0.0|100.255.255.255', '101.0.0.0|200.255.255.255', '201.0.0.0|250.255.255.255' ); // Do not edit below this line. // --------------------------- return; ?>

Only other thing I changed was the function name to
"ip_ban_range ($ip)" rather than "ip_in_range ($ip)"

of cource I then changed the header text to match.

Im guessing it has to be the function call itself but I dont know how to test that.

Im not overly concerned about it being used elsewhere, As if they are banned at the header they wont be able to do anything further in anyways.
Maybe your original code : if "ip>a and <b" or "ip>c and ip<d" etc etc is the way to go ???

Q