Host Filter
Login Guard slows down and bans an address after it has failed to log in. Host Filter works before that. It refuses connections from addresses already known to be bad, so a bot never reaches the logon screen.
It works like the blocklists in a firewall. The lists are downloaded on a schedule and kept in memory, and each new connection is checked against them locally in microseconds. There is no DNS lookup and no web request while a caller is connecting.
Every incoming connection to Telnet, RLogin, SSH, FTP, NNTP, BinkP, the web server and the web terminal is checked. A refused connection is closed silently, because a message only helps a scanner. These are never filtered: this PC (addresses starting 127.), your private LAN ranges (unless you set exemptprivate no) and anything on an allow list.
The checks
| Check | What it does |
|---|---|
| Spamhaus DROP | Network blocks that have been hijacked or belong to criminal operations. A short list with very few false positives. Refreshed at most once a day. |
| DShield | The SANS Internet Storm Center's list of the networks attacking the most hosts right now. Short but fresh. Free for non-commercial use. |
| Your blacklist | Configs\PBBLACKLIST.TXT: addresses, networks, ranges and wildcards you choose, and host names such as *.bot.example.net. Host names are matched against reverse DNS, which is looked up in the background, so a name is first known the second time an address connects. |
| AntiHammer | An address that opens too many connections in a short time (by default more than 20 in a minute) is blocked for 10 minutes. Web and BinkP connections are not counted. |
| AntiScanner | Bots that scan the Telnet port send their own protocol (a web request, an SSH banner, a TLS hello, an RDP or SMB probe) the moment they connect. A real Telnet caller does not. PBDispatch waits a quarter of a second for a new caller to speak first; if what arrives is one of those protocols, the address is blocked for an hour on every service and no node is started. The RLogin port gets the same check. |
| Block countries | blockcountry CN RU blocks every address range assigned to those countries, using free public data refreshed daily. This shows where the address block was assigned, which is usually but not always where the caller is. Nothing is blocked until you list a country. |
| Only these countries | onlycountry US CA turns away everyone not in those countries. Use it with care: mobile carriers, VPNs and travelling callers can look as if they are elsewhere. Try onlycountrymode log first. Nothing is turned away until every listed country's data has downloaded, so a failed download can never lock everybody out. A country cannot be in both lists. |
Downloaded lists are cached in Configs\HostFilter, so they work from the moment PBDispatch starts, even without Internet access. A download that fails, or comes back empty or far smaller than before, never replaces the list already in use. The next try is in an hour (five minutes if no list has ever been downloaded).
Setting it up
Host Filter is on by default, blocking with Spamhaus DROP and DShield. To change anything, open Network > Host Filter in PBConfig. For each check choose Block, Log only or Off, type country codes and the addresses to always allow, and click Save. Then in PBDispatch choose Dispatcher > Reload Configs > Host Filter: Reload Config. No restart is needed.
Log only is for trying a list out: the log shows Host Filter: log-only match for … and the caller still gets in.
If you write Configs\PBHOSTFILTER.CFG by hand, a mistake is reported in the log and the defaults are used. PBConfig refuses to open a file it cannot read, and refuses to save it until it is fixed or removed.
| Setting | Meaning | Default |
|---|---|---|
enabled | yes or no. | yes |
exemptprivate | Never filter private LAN ranges. | yes |
allow <ip>[/bits] | Never filter this address or network. Repeatable. | none |
blacklist <file> | Your own list. A plain name is looked up in Configs. | PBBLACKLIST.TXT |
blacklistmode | block, log or off. | block |
antihammer | block, log or off. | block |
hammerconnects / hammerseconds / hammerminutes | More than this many connections (3 to 1000) within this many seconds (5 to 3600) blocks the address for this many minutes (1 to 10080). | 20 / 60 / 10 |
antiscanner | block, log or off. | block |
scannerminutes | How long a detected scanner stays blocked. | 60 |
blockcountry <cc> … | Two-letter country codes to block (the United Kingdom is GB). Up to 60. | none |
countrymode | block, log or off. | block |
onlycountry <cc> … | Turn away everyone outside these countries. Up to 60. | none |
onlycountrymode | block, log or off. | block |
feed <id> <mode> | ids: spamhaus-drop, dshield. | block |
updatehours | Refresh interval for downloaded lists, 1 to 168 hours. | 24 |
What you see
- The log shows Host Filter enabled at start-up, a line whenever a list is updated, and a line for a refused connection (at most once every 10 minutes per address).
- Tools > Host Filter Status… shows each list, how many entries it holds, when it was updated and how often it matched.
- Tools > Update Host Filter Lists Now downloads the lists straight away (not more often than every 15 minutes).
- The dashboard's Network panel shows how many callers were turned away in the last hour and day, and a row for each list with its size, age and matches. A row turns yellow when a download failed or is partial.
If a real caller is refused
Their address is on one of the lists. Find it in the log, add it to Always allow on PBConfig's Host Filter screen (or as an allow line), and reload. Callers on shared addresses (carrier NAT) and hosting providers are the usual cases. The lists are shared community data with no warranty, which is why Log only is there.
Limits
AntiScanner covers the Telnet and RLogin ports only. Host Filter is IPv4 only, so an IPv6 caller is not checked. The inter-BBS message service is filtered too: a refused connection gets no answer at all, but its UDP queries do not count toward AntiHammer.